Mastodon instances in "secure mode" canot use the relay

[mhamzahkhan]

Mastodon relays that have AUTHORIZED_FETCH or "secure mode" enabled, do not work with the relay (https://docs.joinmastodon.org/admin/config/#authorized_fetch).

Looks like this is because you have to sign the request when fetching the public key here:

Activity-Relay/models/models.go

Line 100 in 528e801

req, _ := http.NewRequest("GET", url, nil)

Without it, the request returns a 401 from instances that have secure mode enabled.

[yukimochi]

Mastodon explains that relays do not work properly in secure mode. (Appears when trying to enable relay in secure mode.)

It is unclear whether the relay will work correctly by signing the request during account acquisition. However, I think it's a good idea to use signatures for account acquisition, so I'll incorporate it into my implementation plan.

[thystra]

FYI from a downstream maintainer: this is implemented and production-validated
in thystra/Activity-Relay v2.5.0.

The relay signs remote actor and ActivityPub-object GET requests with the
relay actor identity. Validation against Mastodon with AUTHORIZED_FETCH=true
confirmed that the unsigned control request returned HTTP 401 while the
relay-signed request returned HTTP 200 with ActivityPub JSON. The same code then
completed a production soak with secure-mode Mastodon receiving new relay
traffic.

Release details:
https://github.com/thystra/Activity-Relay/releases/tag/v2.5.0

This is a downstream implementation, not a claim that it has been merged
upstream.