Fedify: an ActivityPub server framework

🎉 Excited to announce that #Fedify is now on Open Collective! Support the project's development starting at:

• Backer (from $5/mo)
• Supporter (from $25/mo)
• Sponsor (from $100/mo)
• Corporate Sponsor (from $500/mo)
• Custom donations welcome

Your support will help us maintain and improve Fedify. Check it out here:

https://opencollective.com/fedify

#OpenCollective #support #backing #sponsor #donation

Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

• Type-safe objects for Activity Vocabulary (including some vendor-specific extensions)
• #WebFinger client and server
• HTTP Signatures & Linked Data Signatures & Object Integrity Proofs
• Middleware for handling webhooks
• #NodeInfo protocol
• #Node.js, #Deno, and #Bun support
• CLI toolchain for testing and debugging

If you're curious, take a look at the #Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

@chris_hayes Thank you for letting us know! Fixed!

スタンドアロンのActivityPubボットを作成するためのTypeScriptフレームワーク、BotKitを発表します！

一般的なMastodonボットとは異なり、BotKitで作成したボットは、プラットフォームの制約なく完全に独立して動作するFediverseボットです。シンプルで直感的なAPIにより、TypeScriptファイル1つでボットを作成できます。

現在はDenoのみの対応で、今後Node.jsとBunのサポートも予定しています。堅牢なFedifyをベースに開発されています。

https://botkit.fedify.dev/

독립형 ActivityPub 봇을 만들기 위한 TypeScript 프레임워크인 BotKit을 소개합니다!

일반적인 Mastodon 봇과 달리, BotKit으로 만든 봇은 플랫폼의 제약 없이 완전히 독립적으로 동작하는 연합우주(fediverse) 봇입니다. 간단하고 직관적인 API로 TypeScript 파일 하나만으로도 봇을 만들 수 있어요.

현재는 Deno만 지원하지만, Node.js와 Bun 지원도 계획하고 있습니다. 견고한 Fedify 기반으로 제작되었습니다.

https://botkit.fedify.dev/

Introducing #BotKit: A #TypeScript framework for creating truly standalone #ActivityPub bots!

Unlike traditional Mastodon bots, BotKit lets you build fully independent #fediverse bots that aren't constrained by platform limits. Create your entire bot in a single TypeScript file using our simple, expressive API.

Currently #Deno-only, with Node.js & Bun support planned. Built on the robust #Fedify foundation.

https://botkit.fedify.dev/

The last "big" code thing I need to get done before the alpha test of my current @fedify project is the task queue - make sure routine data updates happen, consider individual importance and urgency, respect external API rate limits, etc.

But that's super intimidating so I'm currently procrastinating by making it a cute lil home page instead. 🙃

#FediDev #ActivityPub #Fedify #WebDev

Okay, the patch was merged today, and the fix will be shipped in Akkoma's next release!

あんま人の悪口言いたくないけど「なんか起きても読む気になれない」みたいなコードを運用していたので、この点においてfedifyは最高

fedifyつかって自分もミニマムななにかを作ってみる必要がある気がするし、それは正月の遊びとして最高に楽しそうだな

Now that I got some fond memories of #typescript (read: Stockholm Syndrome), I sort of want to build stuff with #fedify. 😅

Though what I *really* want is an option like it for #ElixirLang. Maybe a project for the new year. 🤔

Not like we don't have #Akkoma, #Bonfire, #Pleroma, and #Mobilizon as examples of what could be a standard library. 😄

https://fedify.dev/

Are you getting the following error when trying to look up any Activity Streams objects from #Akkoma that contain custom emojis?

jsonld.SyntaxError: Invalid JSON-LD syntax; "@id" value must a string.

This is because they represent an Emoji object as an invalid JSON-LD object. Fortunately, this patch fixes that issue, so keep an eye out for it.

Since #Fedify 1.4.0, Object will have the emojiReactions property, which corresponds to the fedibird:emojiReactions property extended by #Fedibird.

I'm currently brainstorming a framework for creating fediverse bots called #BotKit, based on #Fedify. It's less flexible than Fedify, but the goal is to make it possible to create simple fediverse bots with much less code. What do you think?

#fedidev #ActivityPub

@silverpill It looks great! Could it be applied to likes and emoji reactions?

@fedify

I am going to implement Conversation Containers instead of inbox forwarding. This mechanism keeps conversations synchronized, but also enables backfilling and moderation of replies.

A Call for Better Activity Signatures in the Fediverse

Why Major ActivityPub Implementations Should Adopt Object Integrity Proofs

Let's say you have accounts named alice@bar and bob@baz that don't follow each other, but they both follow john@foo. When alice@bar replies to john@foo's post, how can bob@baz see this reply?

This problem applies not only to replies, but also to things like likes and emoji reactions. One of the ways that ActivityPub implementations solve this problem is through inbox forwarding. The idea is to forward the reply received by john@foo to bob@baz as well.

Fedify makes inbox forwarding easy and convenient with its forwardActivity() method. But the question is, can bob@baz trust the activity forwarded by john@foo?

Because HTTP Signatures sign the HTTP request that contains the activity, not the activity itself, john@foo can't sign an activity created by alice@bar when it's forwarded by him, because forwarding requires creating a new HTTP request. (The HTTP request includes things like the Host header, so a new signature is required for each new recipient.)

So, alice@bar needs to sign her activity in a way that allows john@foo to forward it. In the fediverse, there are two ways to do this: Linked Data Signatures and Object Integrity Proofs. Fedify automatically attaches all three types of signatures (HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs) to every activity it sends, so activities are free to be forwarded between ActivityPub software created with Fedify.

However, major ActivityPub implementations such as Mastodon and Misskey still sign activities with HTTP Signatures only, or only some activities with Linked Data Signatures. (Note that Linked Data Signatures is an outdated standard, and Object Integrity Proofs are recommended.)

So, why are we talking about this at length? We strongly urge major ActivityPub implementations to adopt Object Integrity Proofs, or at minimum Linked Data Signatures, for activity signing!

A Call for Better Activity Signatures in the Fediverse

Why Major ActivityPub Implementations Should Adopt Object Integrity Proofs

Let's say you have accounts named alice@bar and bob@baz that don't follow each other, but they both follow john@foo. When alice@bar replies to john@foo's post, how can bob@baz see this reply?

This problem applies not only to replies, but also to things like likes and emoji reactions. One of the ways that ActivityPub implementations solve this problem is through inbox forwarding. The idea is to forward the reply received by john@foo to bob@baz as well.

Fedify makes inbox forwarding easy and convenient with its forwardActivity() method. But the question is, can bob@baz trust the activity forwarded by john@foo?

Because HTTP Signatures sign the HTTP request that contains the activity, not the activity itself, john@foo can't sign an activity created by alice@bar when it's forwarded by him, because forwarding requires creating a new HTTP request. (The HTTP request includes things like the Host header, so a new signature is required for each new recipient.)

So, alice@bar needs to sign her activity in a way that allows john@foo to forward it. In the fediverse, there are two ways to do this: Linked Data Signatures and Object Integrity Proofs. Fedify automatically attaches all three types of signatures (HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs) to every activity it sends, so activities are free to be forwarded between ActivityPub software created with Fedify.

However, major ActivityPub implementations such as Mastodon and Misskey still sign activities with HTTP Signatures only, or only some activities with Linked Data Signatures. (Note that Linked Data Signatures is an outdated standard, and Object Integrity Proofs are recommended.)

So, why are we talking about this at length? We strongly urge major ActivityPub implementations to adopt Object Integrity Proofs, or at minimum Linked Data Signatures, for activity signing!

Did you know? Fedify allows you to customize the links in WebFinger responses. Just put your Link objects in the urls property of the Actor object returned by the actor dispatcher!

https://unstable.fedify.dev/manual/actor#webfinger-links

年末にやってみたいサイドプロジェクトをお探しですか？Fedifyを使って自分だけのActivityPubサーバーを作ってみてはいかがですか？

https://github.com/dahlia/fedify-microblog-tutorial-ja

연말에 할 사이드 프로젝트를 찾고 계신가요? Fedify를 이용해 여러분만의 ActivityPub 서버를 만들어 보는 것은 어떠세요?

https://hackmd.io/@hongminhee/fedify-tutorial-ko

Looking for a side project to do over the holidays? Why not create your own #ActivityPub server with #Fedify?

https://fedify.dev/tutorial/microblog

@Rumisan 私はChatGPTではなくClaudeを使っていますが、Claudeのプロジェクト機能を活用して、プロジェクトにFedifyのドキュメントを全て入れて質問しています。実際にチュートリアルやサンプルコードをそうやって生成した事も有ります！

Since #Fedify 1.4.0, our next release, the fedify lookup command will have the -t/--traverse option! It takes a URL of the collection, and traverse its items from the beginning to the end. Here's a demo:

とりあえず、最近fedifyでDevContainer経由で建てたローカルのリレーサーバとMastodonでリレーの処理が確認できそうなことがわかったんで動作確認手順まとめてます

そういやリレーサーバの疎通確認、fedify tunnel使ってできたよ

@hongminhee
Yay!

fedify 튜토리얼 읽어봐야지..

「Fedifyの長所：Denoで動くけど、DenoはRustコードに埋め込みやすい（??）」

https://mitir.social/notes/a1loh2gwn3

I made a thing. You can put a Mastodon post URL in the search box and it will show the post.

https://fediverse.hayes.software

I was learning #Fedify and I wanted to make a minimal Next.js example of a "read-only" app that was for consuming the Fediverse and didn't mess with interactions. It started as a boilerplate to benefit other devs, but the act of making it forced me to learn a lot more about Fedify and ActivityPub.
#WebDev #Demo

@chris_hayes Yes, it corresponds to the misskey:isCat property! According to the docs:

Used on actors to indicate that they in some way identify as a cat, expressed as a boolean value. If this property is set to true, displaying the actor or their notes will have some special effects attached in some clients.

I was looking at the properties on the Person #ActivityPub object implemented by #fedify, and wasn't expecting this one, haha!

I'm presuming this is #Misskey related? The quirks of having to implement many different versions of a spec!