Two objects sharing the same ID inside an actor

[evanp]

When testing with Fedify, I'm seeing actors like the attached. There are two objects with the same id but different types: the publicKey property with type CryptographicKey, and the assertionMethod property's first value, with a Multikey type.

I don't think that's valid JSON-LD; it's definitely not valid ActivityPub. Each object should have a unique, dereferenceable id value.

I'm working around this by special-casing the #main-key fragment ID to always choose a publicKey if it's available, but it would be good to give these two objects separate IDs. If they're the same object (are they?), it might be better to have a separate endpoint with multiple types.

fedify-actor.json

[dahlia]

Thanks for the report!

Context.getActorKeyPairs() currently assigns the same ID (e.g., #main-key) to both the CryptographicKey and the Multikey it creates for each key pair. When an actor dispatcher adds these to publicKey and assertionMethod, the resulting JSON-LD ends up with two distinct objects sharing the same @id, which is indeed invalid.

There's a related issue too: Object Integrity Proofs are currently signed with the CryptographicKey ID as the verificationMethod, whereas they should reference the Multikey ID.

The planned fix:

• Multikey gets a distinct ID from the CryptographicKey ID (e.g., #main-key becomes #multikey-1)
• OIP signing will use the Multikey ID, done before fan-out since OIP is a content signature identical for all recipients
• HTTP Signatures and LD Signatures will continue using the CryptographicKey ID

This will go out as a patch release.

[dahlia]

Fixed in v1.9.9, v1.10.8, v2.0.12, and v2.1.5.