Skip to content

Conversation

ClearlyClaire
Copy link
Contributor

See #33290 (comment)

Basically, Mastodon sends account deletion notices to all known servers so any record can be swiftly deleted across the network.

It is expected that remote servers which cannot verify the signature will either:

  • skip processing the message because they do not know of the deleted account
  • try to refresh the account and end up on a 410, promptly deleting the account

However, those behaviors, while sensible, implemented by and encouraged by Mastodon for several years, are not specified by ActivityPub.

When an ActivityPub delivery fails because of a signature verification failure, the most likely reason is that the recipient does not know the sender's key (either because it has changed, or because the sender is not known at all). In both cases, the recipient will be unable to fetch an updated key, as the sending server will return a 410, and retrying delivery in this scenario does not make sense.

However, signature verification could also fail because of an implementation bug (although that would affect pretty much all other activities as well) or significant clock skew. We unfortunately don't have a way to differentiate between these cases.

@Gargron Gargron added this pull request to the merge queue Jan 17, 2025
Merged via the queue into main with commit 092e60e Jan 17, 2025
31 checks passed
@Gargron Gargron deleted the fixes/dont-retry-unsalvageable-auth-error branch January 17, 2025 09:23
vmstan pushed a commit to vmstan/mastodon that referenced this pull request Mar 27, 2025
@ClearlyClaire ClearlyClaire added the to backport PR needed to be backported label Apr 22, 2025
AstroProfundis pushed a commit to AstroProfundis/mastodon that referenced this pull request May 7, 2025
robin-maki added a commit to byulmaru/mastodon that referenced this pull request May 8, 2025
commit e6591bf
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue May 6 15:08:57 2025 +0200

    Fix code style issue

commit 30e25ff
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue May 6 08:39:08 2025 +0200

    Bump version to v4.3.8

commit 5ef82d7
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue May 6 08:27:36 2025 +0200

    Update dependency net-imap

commit e14bf63
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue May 6 08:26:43 2025 +0200

    Update dependency nokogiri

commit 6d46225
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue May 6 15:02:13 2025 +0200

    Merge commit from fork

    * Check scheme in account and post links

    * Harden media attachments

    * Client-side mitigation

    * Client-side mitigation for media attachments

commit ec20232
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon May 5 15:01:16 2025 +0200

    Add warning for REDIS_NAMESPACE deprecation at startup (mastodon#34581)

commit e6a6c26
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon May 5 15:13:08 2025 +0200

    Remove double-query for signed query strings (mastodon#34610)

commit 86a8aa5
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon May 5 15:12:07 2025 +0200

    Add built-in context for interaction policies (mastodon#34574)

commit a9f8b1a
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon May 5 15:11:26 2025 +0200

    Fix incorrect redirect in response to unauthenticated API requests in limited federation mode (mastodon#34549)

commit 698e4fd
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Fri Apr 25 11:00:54 2025 +0200

    Fix sign-up e-mail confirmation page reloading on error or redirect (mastodon#34548)

commit 72b1af1
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Fri Jan 17 10:12:59 2025 +0100

    Change activity distribution error handling to skip retrying for deleted accounts (mastodon#33617)

commit 6f16011
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Wed Apr 2 09:14:21 2025 +0200

    Bump version to v4.3.7 (mastodon#34328)

commit 65a6840
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue Apr 1 10:53:49 2025 +0200

    Fix static version of animated PNG emojis not being properly extracted (mastodon#34337)

commit 527d920
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Tue Apr 1 11:10:20 2025 +0200

    New Crowdin Translations for stable-4.3 (automated) (mastodon#34336)

    Co-authored-by: GitHub Actions <noreply@github.com>

commit 6d53e8c
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Fri Mar 28 16:30:28 2025 +0100

    Add delay to profile updates to debounce them (mastodon#34137)

commit d9fb61f
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Fri Mar 28 10:20:32 2025 +0100

    Change account suspensions to be federated to recently-followed accounts as well (mastodon#34294)

commit 6af733d
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Thu Mar 27 14:41:13 2025 +0100

    Change `AccountReachFinder` to consider statuses based on suspension date (mastodon#34291)

commit 29eae75
Author: Matt Jankowski <matt@jankowski.online>
Date:   Tue Nov 12 03:38:08 2024 -0500

    Define constants for sampling sizes in `AccountReachFinder` (mastodon#32805)

commit 8a3f25a
Author: David Roetzel <david@roetzel.de>
Date:   Wed Mar 26 14:26:24 2025 +0100

    Use fixed order in flaky spec (mastodon#34279)

commit 0615feb
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Wed Mar 26 12:33:59 2025 +0100

    Add support for paginating partial collections in `SynchronizeFollowersService` (mastodon#34277)

commit 86d8df0
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue Mar 25 16:50:05 2025 +0100

    Fix follower synchronization mechanism erroneously removing followers from multi-page collections (mastodon#34272)

commit 105e5b1
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue Mar 25 16:20:36 2025 +0100

    Fix bookmarks and favourites not being filtered (mastodon#34260)

commit d6442b5
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue Mar 25 14:11:49 2025 +0100

    Fix filters not applying in detailed view (mastodon#34259)

commit 653868b
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon Mar 24 10:59:05 2025 +0100

    Change user archive signed URL TTL from 10 seconds to 1 hour (mastodon#34254)

commit 4cb3fe3
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Tue Mar 18 15:50:41 2025 +0100

    Fix handling of malformed/unusual HTML (mastodon#34201)

commit 8197e65
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon Mar 24 09:58:15 2025 +0100

    Fix `CacheBuster` being queued for missing media attachments (mastodon#34253)

commit c48413a
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon Mar 17 17:40:28 2025 +0100

    Fix incorrect URL being used when cache busting (mastodon#34189)

commit 9be3915
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon Mar 24 15:07:27 2025 +0100

    Fix streaming server refusing unix socket path in `DATABASE_URL` (mastodon#34091)

commit 2340f4d
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Wed Jan 29 11:15:32 2025 +0100

    Fix “x” hotkey not working on boosted filtered posts (mastodon#33758)

commit cdcd77e
Author: David Roetzel <david@roetzel.de>
Date:   Thu Mar 13 13:32:38 2025 +0100

    Bump version to v4.3.6

commit c79c9e8
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Thu Mar 13 09:37:45 2025 +0100

    Update dependency `omniauth-saml`

commit e84031e
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Thu Mar 13 09:22:13 2025 +0100

    Update dependency `rack`

commit d01e407
Author: Claire <claire.github-309c@sitedethib.com>
Date:   Mon Mar 10 15:27:43 2025 +0100

    Fix Stoplight errors when using `REDIS_NAMESPACE` (mastodon#34126)
noellabo pushed a commit to fedibird/mastodon that referenced this pull request May 8, 2025
atsu1125 pushed a commit to atsu1125/mastodon that referenced this pull request May 27, 2025
@ClearlyClaire ClearlyClaire removed the to backport PR needed to be backported label Jul 1, 2025
cbl added a commit to cbl/mastodon that referenced this pull request Jul 4, 2025
* Change activity distribution error handling to skip retrying for deleted accounts (mastodon#33617)

* Fix sign-up e-mail confirmation page reloading on error or redirect (mastodon#34548)

* Fix incorrect redirect in response to unauthenticated API requests in limited federation mode (mastodon#34549)

* Add built-in context for interaction policies (mastodon#34574)

* Remove double-query for signed query strings (mastodon#34610)

* Add warning for REDIS_NAMESPACE deprecation at startup (mastodon#34581)

* Merge commit from fork

* Check scheme in account and post links

* Harden media attachments

* Client-side mitigation

* Client-side mitigation for media attachments

* Update dependency nokogiri

* Update dependency net-imap

* Bump version to v4.3.8

* Fix code style issue

* Add tests for featured tag removal (mastodon#34888)

* New Crowdin Translations for stable-4.3 (automated) (mastodon#35243)

Co-authored-by: GitHub Actions <noreply@github.com>

* Add missing autofocus on boost modal (mastodon#32953)

* Fix wrong video dimensions for some rotated videos (mastodon#33008)

* Handle rotation is not present in the video metadata (mastodon#33261)

* Fix `/share` not using server-set characters limit (mastodon#33459)

* fix: OIDC account creation fails for long display names (mastodon#34639)

* Fix admin dashboard crash on specific Elasticsearch connection errors (mastodon#34683)

* Change passthrough video processing to emit `moov` atom at start of video (mastodon#34726)

* Fix handling of inlined `featured` collections in ActivityPub actor objects (mastodon#34789)

* Fix `NoMethodError` in `ActivityPub::FetchFeaturedCollectionService` (mastodon#34811)

* Increase capybara default timeout to reduce test flakiness (mastodon#34859)

* Fix inconsistent filtering of silenced accounts for other silenced accounts (mastodon#34863)

* Fix blocked accounts not being automatically removed from trending statuses (mastodon#34891)

* Add basic support for remote attachments with multiple media types (mastodon#34996)

* Fix “Alt text” button submitting form in moderation interface (mastodon#35147)

* Fix search operators sometimes getting lost (mastodon#35190)

* Fix error when viewing statuses to deleted replies in moderation view (mastodon#32986)

* Fix `NoMethodError` in edge case of emoji cache handling (mastodon#34749)

Co-authored-by: Claire <claire.github-309c@sitedethib.com>

* Bump version to v4.3.9

---------

Co-authored-by: Claire <claire.github-309c@sitedethib.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: GitHub Actions <noreply@github.com>
Co-authored-by: Jeong Arm <kjwonmail@gmail.com>
Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>
Co-authored-by: Jeremy Kescher <jeremy@kescher.at>
Co-authored-by: Marcel Hellkamp <marc@gsites.de>
Co-authored-by: Darius Kazemi <darius.kazemi@gmail.com>
cbl added a commit to cbl/mastodon that referenced this pull request Jul 8, 2025
* Change activity distribution error handling to skip retrying for deleted accounts (mastodon#33617)

* Fix sign-up e-mail confirmation page reloading on error or redirect (mastodon#34548)

* Fix incorrect redirect in response to unauthenticated API requests in limited federation mode (mastodon#34549)

* Add built-in context for interaction policies (mastodon#34574)

* Remove double-query for signed query strings (mastodon#34610)

* Add warning for REDIS_NAMESPACE deprecation at startup (mastodon#34581)

* Merge commit from fork

* Check scheme in account and post links

* Harden media attachments

* Client-side mitigation

* Client-side mitigation for media attachments

* Update dependency nokogiri

* Update dependency net-imap

* Bump version to v4.3.8

* Fix code style issue

* Add tests for featured tag removal (mastodon#34888)

* New Crowdin Translations for stable-4.3 (automated) (mastodon#35243)

Co-authored-by: GitHub Actions <noreply@github.com>

* Add missing autofocus on boost modal (mastodon#32953)

* Fix wrong video dimensions for some rotated videos (mastodon#33008)

* Handle rotation is not present in the video metadata (mastodon#33261)

* Fix `/share` not using server-set characters limit (mastodon#33459)

* fix: OIDC account creation fails for long display names (mastodon#34639)

* Fix admin dashboard crash on specific Elasticsearch connection errors (mastodon#34683)

* Change passthrough video processing to emit `moov` atom at start of video (mastodon#34726)

* Fix handling of inlined `featured` collections in ActivityPub actor objects (mastodon#34789)

* Fix `NoMethodError` in `ActivityPub::FetchFeaturedCollectionService` (mastodon#34811)

* Increase capybara default timeout to reduce test flakiness (mastodon#34859)

* Fix inconsistent filtering of silenced accounts for other silenced accounts (mastodon#34863)

* Fix blocked accounts not being automatically removed from trending statuses (mastodon#34891)

* Add basic support for remote attachments with multiple media types (mastodon#34996)

* Fix “Alt text” button submitting form in moderation interface (mastodon#35147)

* Fix search operators sometimes getting lost (mastodon#35190)

* Fix error when viewing statuses to deleted replies in moderation view (mastodon#32986)

* Fix `NoMethodError` in edge case of emoji cache handling (mastodon#34749)

Co-authored-by: Claire <claire.github-309c@sitedethib.com>

* Bump version to v4.3.9

---------

Co-authored-by: Claire <claire.github-309c@sitedethib.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: GitHub Actions <noreply@github.com>
Co-authored-by: Jeong Arm <kjwonmail@gmail.com>
Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>
Co-authored-by: Jeremy Kescher <jeremy@kescher.at>
Co-authored-by: Marcel Hellkamp <marc@gsites.de>
Co-authored-by: Darius Kazemi <darius.kazemi@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants