- ActivityPub (Server-to-Server)
- WebFinger
- Http Signatures
- NodeInfo
Vernissage largely follows the ActivityPub server-to-server specification but it makes uses of some non-standard extensions, some of which are required for interacting with Vernissage at all.
In Vernissage, users are identified by a username and domain pair (e.g., mczachurski@vernissage.photos).
This is used both for discovery and for unambiguously mentioning users across the fediverse.
As a result, Vernissage requires that each ActivityPub actor uniquely maps back to an acct: URI that can be resolved via WebFinger.
In order to authenticate activities, Vernissage relies on HTTP Signatures, signing every POST and GET request to other ActivityPub implementations on behalf of the user authoring an activity (for POST requests) or an actor representing the Vernissage server itself (for most GET requests).
Vernissage requires all POST requests to be signed, and MAY require GET requests to be signed, depending on the configuration of the Vernissage server.