#Fedify

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-31

ActivityPubサーバーを構築してみたいけれど、どこから始めればよいかわからない方には、Fedifyのチュートリアル『自分だけのフェディバースのマイクロブログを作ろう!』をおすすめします。包括的でステップバイステップのガイドで、完全に機能する連合型アプリケーションの構築方法を丁寧に解説しています。フェディバースに飛び込みたい開発者にぴったりです!

#ActivityPub #Fedify #チュートリアル #フェディバース #fediverse

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-31

If you're interested in building your own #ActivityPub server but don't know where to start, I recommend checking out #Fedify's #tutorial Creating your own federated microblog. It provides a comprehensive, step-by-step guide that walks you through building a fully functional federated application. Perfect for developers who want to dive into the #fediverse!

#fedidev

Fedify: an ActivityPub server frameworkfedify@hollo.social
2025-05-28

We're planning to reorganize our #GitHub labels to better reflect #Fedify's project structure! 🏷️

Currently using GitHub's default labels, but we want something more tailored to our needs—like component-specific labels (vocab, federation, actor, etc.), runtime tags (Deno/Node/Bun), and #ActivityPub compatibility tracking.

The proposal includes hierarchical labeling with categories like:

  • type/ for bug, feature, documentation
  • component/ for different parts of Fedify
  • activitypub/ for interop issues with Mastodon, Misskey, etc.

We'd love your thoughts! What labels would be most helpful for contributors and maintainers?

Check out the full proposal: https://github.com/fedify-dev/fedify/issues/238.

#fedidev

Fedify: an ActivityPub server frameworkfedify@hollo.social
2025-05-26

While #Fedify's #Vocabulary API provides comprehensive support for #ActivityPub and major vendor extensions, its code-generation approach makes runtime extensions challenging. However, the project welcomes contributions to expand the supported types and properties.

Fedify accepts vocabulary contributions when they meet any of these criteria:

  • Documented in FEP (Fediverse Enhancement Proposals) or equivalent specification
  • Already adopted by widely-used #fediverse implementations like Mastodon or Pleroma
  • Thoroughly discussed within the Fedify community (Discord, Matrix, GitHub Discussions)

Contributing new vocabulary is straightforward. The vocabulary definitions live in YAML files within the fedify/vocab/ directory. To add a new type, create a new .yaml file. To add properties to existing types, extend the properties section in the relevant .yaml file.

This approach ensures Fedify's vocabulary coverage grows with the fediverse ecosystem while maintaining type safety and comprehensive documentation. If you're working with custom ActivityPub extensions, consider contributing them upstream to benefit the entire community.

For detailed guidance on the contribution process, see the Extending the vocabulary section in Fedify's docs.

#fedidev

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-22

This patch for @vite is blocking #Fedify's Cloudflare Workers support. They say it'll be included in #Vite 7, but I can't wait that long, so I'm not sure what to do… 🤔

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-20

Occasionally I think the #Fedify project might need to leave #Deno. I'm even thinking that while adding Cloudflare Workers support… 🤔

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-20

I've been thinking about adding a debug dashboard to #Fedify that shows all #ActivityPub activities being sent and received in real-time. This would include filters by activity type, detailed inspection of JSON-LD content, signature verification details, and retry management for failed deliveries.

As a #fedidev, would you find this useful for troubleshooting federation issues? Any other features that would be helpful in such a debugging tool?

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-19

We've just submitted an #application to the Sovereign Tech Fund for the #Fedify project! Hoping to further develop and enhance the framework for a more robust federated web.

#STF #ActivityPub #fund

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-18

For those interested in supporting #Fedify's development, we do have an Open Collective page where community #sponsorship is welcome.

Even small contributions help sustain development and show there's interest in open source #ActivityPub tools. Thanks to our existing sponsors who've already been helping move the project forward!

The goal remains the same: make building federated applications more accessible to developers so the #fediverse can continue to grow and thrive.

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-18

Just received word that @fedify wasn't selected for @nlnet's Open Call this round. While disappointing, I understand the competition was fierce with many worthy projects seeking limited funding.

The journey continues though—#Fedify development will move forward at its own pace. Thanks to everyone who's shown interest and support for this project so far. Building tools for the #fediverse remains important work, and I'm committed to seeing it through.

If you know of other funding opportunities that might be a good fit for open source #ActivityPub tools, I'm all ears.

Fedify: an ActivityPub server frameworkfedify@hollo.social
2025-05-16

Good news! We've officially added #Cloudflare #Workers support to the #Fedify roadmap. We've created a detailed issue to track our implementation plan: https://github.com/fedify-dev/fedify/issues/233.

The effort will be tackled in phases, including compatibility assessment, core adaptations for Workers' environment, KV store and message queue implementations, and finally integration with Cloudflare's ecosystem. This will be a substantial project that we'll break down into several sub-issues.

If you're interested in contributing to any specific aspect of Workers support, please comment on the main issue to coordinate efforts.

#CloudflareWorkers

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-13

As #Fedify's author, I'm contemplating its adoption beyond Ghost's #ActivityPub implementation. Finding potential users for ActivityPub tools seems challenging—perhaps I'm addressing a very niche need?

While the technical complexity of ActivityPub makes tools like Fedify valuable, I wonder about the actual market demand for federation outside specific communities.

Open, decentralized systems make sense to many developers, but businesses often prefer closed ecosystems that align with traditional models.

Still, I see potential as the #fediverse grows and digital sovereignty concerns increase. Fedify aims to lower the technical barriers to federation.

I'm curious: Which projects would benefit most from Fedify today? What would make federation compelling enough for platforms to implement?

Would appreciate perspectives from both developers and platform owners.

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-12

Just wrote the Why Fedify? section in the #Fedify docs.

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-11

Okay, I've just deployed a bleeding edge #Fedify, which implements both RFC 9421 and double-knocking, to Hackers' Pub. If you'd like to test your implementations against a real server, please give it a try! (If you want to create an account, let me know—I can invite you.)

#fedidev #ActivityPub

洪 民憙 (Hong Minhee)hongminhee@hollo.social
2025-05-09

Looking for #ActivityPub implementations with #RFC9421 support! 🔍

As mentioned in the Fedify announcement below, I've implemented RFC 9421 (HTTP Message Signatures) and need to verify its interoperability with other ActivityPub implementations.

The challenge is that most major ActivityPub projects don't seem to have full RFC 9421 implementations in production yet. If you're working on an ActivityPub project that:

  • has implemented RFC 9421 (even in a development branch)
  • is currently implementing it
  • has plans to implement it soon

Please reach out! I'd love to collaborate on interoperability testing to ensure our implementations work properly with each other before merging this into #Fedify's main branch.

Any leads or connections would be greatly appreciated! 🙏

#fedidev

Fedify: an ActivityPub server frameworkfedify@hollo.social
2025-05-09

We're excited to announce that we've implemented RFC 9421 (HTTP Message Signatures) in #Fedify, complete with our double-knocking mechanism to maintain backward compatibility with the draft cavage version.

This implementation includes both signature generation and verification, meaning #RFC9421 is used when both sending and receiving activities. While we haven't merged the RFC 9421 implementation branch yet, we're currently conducting interoperability tests with development versions of Mastodon and other #ActivityPub implementations. Once these tests confirm compatibility, we'll proceed with the merge.

As noted in the attached docs, although RFC 9421 is the final and official standard for HTTP Signatures, the draft cavage version remains widely used across the #fediverse. Our double-knocking mechanism ensures maximum compatibility by trying the RFC 9421 version first, then falling back to draft cavage if needed.

Currently, we support RSA-PKCS#1-v1.5 key pairs for generating HTTP Message Signatures, with plans to expand to other signature types in future releases.

We look forward to contributing to a more standardized and secure fediverse!

#fedidev

HTTP Message Signatures

This API is available since Fedify 1.6.0.

RFC 9421, also known as HTTP Message Signatures, is the final revision of the HTTP Signatures specification. Although it is the official standard, it is not widely used in the fediverse yet. As of May 2025, major ActivityPub implementations, such as Mastodon, et al., still rely on the draft cavage version of HTTP Signatures for signing portable activities.

Fedify automatically signs activities with the sender's private key if the actor keys dispatcher is set and the actor has any RSA-PKCS#1-v1.5 key pair. If there are multiple key pairs, Fedify selects the first RSA-PKCS#1-v1.5 key pair among them.

NOTE

Although HTTP Message Signatures support other than RSA-PKCS#1-v1.5, Fedify currently supports only RSA-PKCS#1-v1.5 key pairs for generating HTTP Message Signatures. This limitation will be lifted in the future releases.Double-knocking HTTP Signatures

This API is available since Fedify 1.6.0.

As you read above, there are two revisions of HTTP Signatures: the draft cavage version and the RFC 9421 version. The draft cavage version is declared as obsolete, but it is still widely used in the fediverse, and many ActivityPub implementations still rely on it. On the other hand, the RFC 9421 version is the official standard, but it is not widely used yet.

To support both versions of HTTP Signatures, Fedify uses the double-knocking mechanism: trying one version, then falling back to another if rejected. If it's the first encounter with the recipient server, Fedify tries the RFC 9421 version first, and if it fails, it falls back to the draft cavage version. If the recipient server accepts the RFC 9421 version, Fedify remembers it and uses the RFC 9421 version for the next time. If the recipient server rejects the RFC 9421 version, Fedify falls back to the draft cavage version and remembers it for the next time.
Fedify: an ActivityPub server frameworkfedify@hollo.social
2025-04-29

We're pleased to announce that #Fedify has been included in the Nivenly Fediverse Security Fund program!

The @nivenly Foundation has launched a security bounty fund to support contributors who identify and help fix #security vulnerabilities in popular #fediverse software. Both Fedify and @hollo are among the selected projects that meet their responsible security disclosure requirements.

This program will run from April–September 2025, with bounties of $250–$500 USD for high and critical security vulnerabilities.

We're honored to be recognized alongside other established fediverse projects like Mastodon, Misskey, and Lemmy. This further encourages our commitment to maintaining strong security practices.

If you're interested in contributing to Fedify's security, please follow our responsible disclosure process outlined in our SECURITY.md file.

Learn more about the program:

https://nivenly.org/blog/2025/04/01/nivenly-fediverse-security-fund/

2025-04-29

素晴らしい :clapping:

新しい分散/連合型SNS「Pulsate」を開発している - /dev/sdR2 laminne.hatenablog.jp/entry/20

#Fediverse #Hono #Fedify

Nicolas Borboënnborboen@social.epfl.ch
2025-04-25

What to learn more about the #fediverse and #ActivityPub? This tutorial (fedify.dev/tutorial/microblog) from @fedify is a really good starter. It explains how to implement a really simple #federated server and see how communication exchange are done with AP.

#tutorial #activitypubdev #fedify #typescript #library

https://fedify.dev/ websitehttps://github.com/fedify-dev/fedify
卡拉今天看了什麼ai_workspace@social.mikala.one
2025-04-24

Creating your own federated microblog | Hacker News

Link
Creating your own federated microblog | Hacker News
https://news.ycombinator.com/item?id=37598304

📌 Summary:
本文介紹如何使用 Fedify 這個 ActivityPub 伺服器框架,從零開始打造一個簡易的分散式微網誌(microblog)。教程聚焦於 Fedify 的實作與運用,無須事先深入瞭解 ActivityPub 協議細節。過程中涵蓋從開發環境建置、TypeScript 與 JSX 基礎、資料庫設計與連接,到 ActivityPub actor(帳號)建立、加密金鑰管理、Inbox 設計、追蹤關係管理、貼文發佈與通知等核心功能。透過 SQLite 作為資料庫,配合Node.js及 Hono 網頁框架,搭建單帳號微網誌應用,實現與 Mastodon 等 ActivityPub 服務的互通。文章同時展示如何利用 Fedify 的指令建立開發環境,啟動本地伺服器,以及使用 fedify tunnel 快速將本地服務暴露於公網,便於跨伺服器交流與實測。最終完成的系統支援帳號建立、追蹤及取消追蹤、查看追蹤與被追蹤帳號列表、發表與接收貼文,以及時間軸展示,並且實作 ActivityPub 的多種核心物件與活動類型,如 Person、Note、Follow、Accept、Undo 等。文章也提出安全性、認證機制、XSS 防範、媒體附加、標註等進階議題與改善方向。整體流程搭配大量程式碼範例與實際測試指令,對欲學習 ActivityPub 服務架設或開發分散式微網誌應用者具高度參考價值。

🎯 Key Points:
→ 教學目標與受眾設定
 ★ 適合熟悉 HTML、HTTP、SQL、JSON、基本 JavaScript 但不需 ActivityPub 與 Fedify 經驗的開發者。
 ★ 教學以單帳號微網誌為例,實作核心聯邦功能,無包含認證、編輯、搜尋等。

→ 環境建置
 ① 使用 Node.js 20.x 以上版本搭配 npm 安裝 Fedify CLI。
 ② 使用 fedify init 搭建專案骨架,採用 Hono 框架與 In-memory 快取。
 ③ Visual Studio Code 配合 TypeScript 及 Pico CSS 建構開發環境與 UI。

→ 資料庫設計與腳本執行
 ★ SQLite 為資料庫,建立 users、actors、keys、follows、posts 等多張表,明確定義主鍵、外鍵與約束條件。
 ★ 使用 better-sqlite3 連接與操作 SQLite,配合 TypeScript 型別定義保持安全與自動補全。

→ ActivityPub actor(使用者帳號)實作
 ★ Account 建立時,同步新增 users 與 actors 表記錄,維護聯邦用戶資料。
 ★ 實作 actor dispatcher,採內容協商 (Content Negotiation) 回應 HTML 或 ActivityPub JSON。
 ★ 生成並管理 RSA、Ed25519 兩種加密金鑰以簽署活動,透過 Fedify 接口完成金鑰產生、匯入匯出。

→ Inbox 與活動(Activity)處理
 ★ 設計 Inbox 接收 Follow、Undo、Accept、Create 等活動。
 ★ 收到 Follow 時,新增追蹤資料並回覆 Accept。
 ★ 收到 Undo(Follow) 時,處理取消追蹤。
 ★ 收到 Accept(Follow) 時,加入資料庫以確認雙方追蹤關係。
 ★ 接收並儲存 Create(Note) 活動,實現跨服務貼文同步。

→ 前端功能與路由設計
 ★ 建立基本頁面:設定頁、個人資料頁、個人貼文列表、貼文詳情頁、追蹤者與正在追蹤者列表。
 ★ 利用 JSX 建構組件,包含 Layout、Profile、PostList、FollowerList 等。
 ★ UI 表現使用 Pico CSS,兼顧易用性與輕量。

→ 與 Mastodon 等既有 ActivityPub 服務互通性測試
 ★ 利用 fedify tunnel 暴露本機服務至公網,方便跨服務測試。
 ★ 成功在 Mastodon 搜尋與瀏覽自訂帳號及貼文。
 ★ 在 ActivityPub.Academy 發送與接收追蹤請求、推文,確保活動流程正確。

→ 進階與安全性考量
 ★ 教學中無認證機制,任何人皆可發文,存有安全隱憂。
 ★ 直接顯示遠端貼文 HTML 內容,可能導致 XSS 攻擊。
 ★ 建議未來加入登入驗證、防範 XSS,並擴充支援圖片附加、標註、個人資料設定等功能。

🔖 Keywords:
#ActivityPub #Fedify #分散式微網誌 #加密金鑰 #Inbox

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst