Anyone know of an ActivityPub validator that I can just point to a site?

I’m trying to debug why Owncast’s federation features are not working when installed via Site.js and hitting a brick wall. Capturing https traffic, it doesn’t look like a remote follow request from Mastodon is hitting the server.

I’m pretty sure the problem is with Site.js’s HTTP proxy settings but not sure what.

This stuff is ridiculously complex to debug. How do y’all do it?

· · Web · 4 · 5 · 3

@aral something like would be really nice

@aral i would work on it someday but it means actually looking at activitypub in depth which I've been putting off :p

@aral @f0x

Afraid there aren't good tools for you. As you know I maintain with stuffz.

There's the (currently offline) .. I've never used it and dunno if it fits your query and what its state is.

And @dansup but that is undergoing a revamp atm, I think.

> This stuff is ridiculously complex to debug. How do y’all do it?

Think its folks gritting teeth, I guess, and wade through the complexity 😅

@aral @f0x @dansup

Oh, if you have keywords to search for.. might do that on #SocialHub in the forum archive.

There's also the (ridiculously linked across the web):

@humanetech @f0x @dansup Thanks, the only thing I’m seeing is a warning in the Owncast logs about a crpto/rsa verification error:

verification error for crypto/rsa: verification error

Searching for that didn’t bring up anything. Will keep looking 🤷‍♂️

@humanetech @f0x @dansup Right, so, mystery solved via trial and error: the Site.js HTTP proxy server had changeOrigin set to true. I’m assuming that was messing up the http signature verification.

@aral A problem with http signatures possibly? Does the proxy change headers that are covered by the signature?

@humanetech @f0x @dansup

@aral The fediverse is totally missing this. I have a #funkwhale instance and a #gotosocial instance that are not working right - it's not just developers but end-users who need this debugging tooling. something like qualys' SSL server tester but for #ActivityPub stuff would be incredible. I dont know what Site.js is doing but I guess federation is dealing a lot with http signatures. On your Mastodon page there is your public key and that is used to encrypt messages. But maybe the answer for request of the key has to be correctly signed to ensure it was not tampered. Proxy should not change anything in important in http headers.

@michal Yep, that’s what it was ( – I had change origin set to true. It was difficult to debug as nothing was throwing an HTTP error at all so it looked as if it was succeeding. Thankfully Owncast actually logged a warning :)

Thanks for replying by the way; appreciate it :)

Sign in to participate in the conversation
Aral’s Mastodon

This is my personal Mastodon.