[pfefferle]

Fixes #

Proposed changes:

• When a signature fails against a stored actor's key, the plugin now fetches that actor once from its own host and verifies again. Before, the key was always read from the stored record first, so an actor that rotated its key was rejected until the daily refresh updated the record.
• Remote_Actors::refresh_public_key() only writes when the fetched document differs from the stored one, compared the way it would be stored. It uses update() by post ID.
• Each actor is refreshed at most once every 5 minutes, with a short transient, so failing signatures cannot cause a fetch every time. The record's modified date is not touched, so the scheduler still refreshes, counts errors for and cleans up actors as before.
• The refresh runs for a failed signature and for alg_key_mismatch, so a switch to another key type is covered too.

Other information:

• Have you written new tests for your changes, if applicable?

This follows Mastodon, which refetches the key once when verification fails (keypair_refresh_key!).

The trade-off: a request with a wrong signature for a stored actor's keyId now causes one fetch to that actor's host, at most once every 5 minutes per actor. The fetch only goes to the actor's own stored id. Not covered: actors whose key comes from the proxy cache (they heal within an hour, as before), signed GETs through the router, and signatures with several RFC 9421 labels.

Testing instructions:

• Run vendor/bin/phpunit --filter 'test_refresh_public_key|refreshes_a_rotated_key'.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message