[bug] Unable to interact with ktistec users

[LindsayZhou]

Describe the bug with a clear and concise description of what the bug is.

I send a follow request to a ktistec user, and he didn't receive that.

Ktistec requires (created) http signature header.

Gts' implemetation doesn't include it:

gotosocial/internal/transport/signing.go

Lines 28 to 29 in b7c629a

	getHeaders = []string{httpsig.RequestTarget, "host", "date"}
	postHeaders = []string{httpsig.RequestTarget, "host", "date", "digest"}

Mastodon attempts to use the (created) header first, fallback to the Date header if not present.

The spec draft recommends using the created signature parameter (not required)

Log

From Gts server:
timestamp="21/04/2024 20:46:22.302" func=workers.(*clientAPI).CreateFollowReq level=ERROR requestID=v9vv204f040018tk485g msg="error federating follow request: Follow: error sending activity *typefollow.ActivityStreamsFollow via outbox https://moe.reisen/users/lindsay/outbox: func1: error delivering to https://qaq.land/actors/qaq/inbox: deliver: POST request to https://qaq.land/actors/qaq/inbox failed: status=\"400 Bad Request\" body=\"{\"msg\":\"can't be verified\"}\""

From Ktistec server:

INFO - verification failed: (created) header must be signed
WARN - Ktistec::Open.open? - Does not exist [404]: https://moe.reisen/users/lindsay/follow/<signature_string>

What's your GoToSocial Version?

v0.15.0

GoToSocial Arch

x86_64 Binary

What happened?

No response

What you expected to happen?

No response

How to reproduce it?

No response

Anything else we need to know?

No response

[tsmethurst]

Thanks! I'll see if we can rejig our signature without breaking compatibility for anything else. Didn't realize (created) was recommended.