relays usually Announce(Create), so the Create is not from them but the announce is, and it gets processed properly. Lemmy does the correct thing: it sends Announce(...activity...), so the "topmost" activity effectively comes from the sending server and can be verified. however aode relay sends activities as-is, without wrapping. so if we receive activities from someone else, it won't match the http signature and we thus can't be sure this wasn't falsified. added an option to directly fetch such cases. it's probably not great, so defaults to OFF |
||
---|---|---|
.. | ||
src | ||
Cargo.toml | ||
README.md |