Add wp activitypub fetch CLI command#2906
Merged
Conversation
Introduces a new WP-CLI command for fetching remote ActivityPub URLs with signed HTTP requests. Supports switching between signature modes (draft-cavage, rfc9421, none) for debugging federation issues.
- Disable maybe_double_knock when forcing rfc9421 to prevent marking hosts as unsupported. - Include error message in failure output. - Use strict null check for json_decode result.
When pre_option forced RFC 9421 and the server returned 4xx, maybe_double_knock retried with Draft Cavage, but sign_request re-signed with RFC 9421 (due to the active filter), causing an infinite loop. Fix by replacing sign_request entirely for forced rfc9421 mode and disabling maybe_double_knock during the request.
There was a problem hiding this comment.
Pull request overview
Adds a new WP-CLI subcommand to fetch remote ActivityPub URLs while optionally forcing different HTTP signature modes to aid debugging.
Changes:
- Introduces
wp activitypub fetch <url>with--signature,--raw, and--include-headersoptions. - Implements signature-mode overrides (RFC 9421 / Draft Cavage / none) via WordPress filters for request signing behavior.
- Registers the command and adds a changelog entry.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| includes/cli/class-fetch-command.php | New Fetch_Command implementation handling request + output and signature overrides. |
| includes/class-cli.php | Registers the new activitypub fetch WP-CLI command. |
| .github/changelog/2906-from-description | Documents the new CLI command in the changelog. |
Tries RFC 9421 first, falls back to Draft Cavage on 4xx via maybe_double_knock. Avoids the infinite loop by skipping re-signing when the request is already signed by the retry.
Fix error message labeling WP_Error codes as HTTP codes, use json_last_error() for reliable JSON detection, document the default signature mode, validate invalid modes with early error, and only restore filters that were actually removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes:
wp activitypub fetchCLI command for fetching remote ActivityPub URLs with signed HTTP requests.draft-cavage,rfc9421,double-knock,none) via the--signatureflag for debugging federation and HTTP Signature issues.Http::get()for request handling and uses filter overrides to force specific signature modes.Other information:
Testing instructions:
wp activitypub fetch https://mastodon.social/@Gargron— should return the actor profile as pretty-printed JSON.wp activitypub fetch https://mastodon.social/@Gargron --signature=rfc9421— should fetch using RFC 9421 signature.wp activitypub fetch https://mastodon.social/@Gargron --signature=draft-cavage— should fetch using Draft Cavage signature.wp activitypub fetch https://mastodon.social/@Gargron --signature=double-knock— should try RFC 9421 first, fall back to Draft Cavage on 4xx.wp activitypub fetch https://mastodon.social/@Gargron --signature=none— should fetch without signing.wp activitypub fetch https://mastodon.social/@Gargron --include-headers— should show response headers.wp activitypub fetch https://mastodon.social/@Gargron --raw— should output the raw response body.Changelog entry
Changelog Entry Details
Significance
Type
Message
Add
wp activitypub fetchCLI command for fetching remote URLs with signed HTTP requests.