@fedify/fedify 1.3.0-dev.575 → 1.3.0-dev.577

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@fedify/fedify",
-    "version": "1.3.0-dev.575+9cfc4531",
+    "version": "1.3.0-dev.577+bda6d57e",
     "license": "MIT",
     "exports": {
         ".": "./mod.ts",

package/esm/federation/handler.js

@@ -1,6 +1,6 @@
 import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
-import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { context, propagation, SpanKind, SpanStatusCode, trace, } from "@opentelemetry/api";
 import { accepts } from "../deps/jsr.io/@std/http/1.0.11/negotiation.js";
 import metadata from "../deno.js";
 import { verifyRequest } from "../sig/http.js";
@@ -231,21 +231,55 @@ function filterCollectionItems(items, collectionName, filterPredicate) {
     }
     return result;
 }
-export async function handleInbox(request, { recipient, context, inboxContextFactory, kv, kvPrefixes, queue, actorDispatcher, inboxListeners, inboxErrorHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, tracerProvider, }) {
+export async function handleInbox(request, options) {
+    const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+    const tracer = tracerProvider.getTracer(metadata.name, metadata.version);
+    return await tracer.startActiveSpan("activitypub.inbox", {
+        kind: options.queue == null ? SpanKind.SERVER : SpanKind.PRODUCER,
+        attributes: { "activitypub.shared_inbox": options.recipient == null },
+    }, async (span) => {
+        if (options.recipient != null) {
+            span.setAttribute("fedify.inbox.recipient", options.recipient);
+        }
+        try {
+            return await handleInboxInternal(request, options, span);
+        }
+        catch (e) {
+            span.setStatus({ code: SpanStatusCode.ERROR, message: String(e) });
+            throw e;
+        }
+        finally {
+            span.end();
+        }
+    });
+}
+async function handleInboxInternal(request, { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, queue, actorDispatcher, inboxListeners, inboxErrorHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, tracerProvider, }, span) {
     const logger = getLogger(["fedify", "federation", "inbox"]);
     if (actorDispatcher == null) {
         logger.error("Actor dispatcher is not set.", { recipient });
+        span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: "Actor dispatcher is not set.",
+        });
         return await onNotFound(request);
     }
     else if (recipient != null) {
-        const actor = await actorDispatcher(context, recipient);
+        const actor = await actorDispatcher(ctx, recipient);
         if (actor == null) {
             logger.error("Actor {recipient} not found.", { recipient });
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: `Actor ${recipient} not found.`,
+            });
             return await onNotFound(request);
         }
     }
     if (request.bodyUsed) {
         logger.error("Request body has already been read.", { recipient });
+        span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: "Request body has already been read.",
+        });
         return new Response("Internal server error.", {
             status: 500,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
@@ -253,6 +287,10 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
     }
     else if (request.body?.locked) {
         logger.error("Request body is locked.", { recipient });
+        span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: "Request body is locked.",
+        });
         return new Response("Internal server error.", {
             status: 500,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
@@ -265,11 +303,15 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
     catch (error) {
         logger.error("Failed to parse JSON:\n{error}", { recipient, error });
         try {
-            await inboxErrorHandler?.(context, error);
+            await inboxErrorHandler?.(ctx, error);
         }
         catch (error) {
             logger.error("An unexpected error occurred in inbox error handler:\n{error}", { error, activity: json, recipient });
         }
+        span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: `Failed to parse JSON:\n${error}`,
+        });
         return new Response("Invalid JSON.", {
             status: 400,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
@@ -288,7 +330,7 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
                 return undefined;
             let object;
             try {
-                object = await Object.fromJsonLd(serialized, context);
+                object = await Object.fromJsonLd(serialized, ctx);
             }
             catch {
                 await kv.delete([...kvPrefixes.publicKey, keyId.href]);
@@ -307,13 +349,13 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
                 return;
             }
             this.nullKeys.delete(keyId.href);
-            const serialized = await key.toJsonLd(context);
+            const serialized = await key.toJsonLd(ctx);
             await kv.set([...kvPrefixes.publicKey, keyId.href], serialized);
         },
     };
     const ldSigVerified = await verifyJsonLd(json, {
-        contextLoader: context.contextLoader,
-        documentLoader: context.documentLoader,
+        contextLoader: ctx.contextLoader,
+        documentLoader: ctx.documentLoader,
         keyCache,
         tracerProvider,
     });
@@ -321,14 +363,14 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
     let activity = null;
     if (ldSigVerified) {
         logger.debug("Linked Data Signatures are verified.", { recipient, json });
-        activity = await Activity.fromJsonLd(jsonWithoutSig, context);
+        activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
     }
     else {
         logger.debug("Linked Data Signatures are not verified.", { recipient, json });
         try {
             activity = await verifyObject(Activity, jsonWithoutSig, {
-                contextLoader: context.contextLoader,
-                documentLoader: context.documentLoader,
+                contextLoader: ctx.contextLoader,
+                documentLoader: ctx.documentLoader,
                 keyCache,
                 tracerProvider,
             });
@@ -340,11 +382,15 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
                 error,
             });
             try {
-                await inboxErrorHandler?.(context, error);
+                await inboxErrorHandler?.(ctx, error);
             }
             catch (error) {
                 logger.error("An unexpected error occurred in inbox error handler:\n{error}", { error, activity: json, recipient });
             }
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: `Failed to parse activity:\n${error}`,
+            });
             return new Response("Invalid activity.", {
                 status: 400,
                 headers: { "Content-Type": "text/plain; charset=utf-8" },
@@ -361,14 +407,18 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
     if (activity == null) {
         if (!skipSignatureVerification) {
             const key = await verifyRequest(request, {
-                contextLoader: context.contextLoader,
-                documentLoader: context.documentLoader,
+                contextLoader: ctx.contextLoader,
+                documentLoader: ctx.documentLoader,
                 timeWindow: signatureTimeWindow,
                 keyCache,
                 tracerProvider,
             });
             if (key == null) {
                 logger.error("Failed to verify the request's HTTP Signatures.", { recipient });
+                span.setStatus({
+                    code: SpanStatusCode.ERROR,
+                    message: `Failed to verify the request's HTTP Signatures.`,
+                });
                 const response = new Response("Failed to verify the request signature.", {
                     status: 401,
                     headers: { "Content-Type": "text/plain; charset=utf-8" },
@@ -380,8 +430,12 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
             }
             httpSigKey = key;
         }
-        activity = await Activity.fromJsonLd(jsonWithoutSig, context);
+        activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
+    }
+    if (activity.id != null) {
+        span.setAttribute("activitypub.activity.id", activity.id.href);
     }
+    span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
     const cacheKey = activity.id == null
         ? null
         : [...kvPrefixes.activityIdempotence, activity.id.href];
@@ -393,6 +447,10 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
                 activity: json,
                 recipient,
             });
+            span.setStatus({
+                code: SpanStatusCode.UNSET,
+                message: `Activity ${activity.id?.href} has already been processed.`,
+            });
             return new Response(`Activity <${activity.id}> has already been processed.`, {
                 status: 202,
                 headers: { "Content-Type": "text/plain; charset=utf-8" },
@@ -401,83 +459,120 @@ export async function handleInbox(request, { recipient, context, inboxContextFac
     }
     if (activity.actorId == null) {
         logger.error("Missing actor.", { activity: json });
-        const response = new Response("Missing actor.", {
+        span.setStatus({ code: SpanStatusCode.ERROR, message: "Missing actor." });
+        return new Response("Missing actor.", {
             status: 400,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
         });
-        return response;
     }
-    if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, context)) {
+    span.setAttribute("activitypub.actor.id", activity.actorId.href);
+    if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
         logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
             activity: json,
             recipient,
             keyId: httpSigKey.id?.href,
             actorId: activity.actorId.href,
         });
-        const response = new Response("The signer and the actor do not match.", {
+        span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: `The signer (${httpSigKey.id?.href}) and ` +
+                `the actor (${activity.actorId.href}) do not match.`,
+        });
+        return new Response("The signer and the actor do not match.", {
             status: 401,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
         });
-        return response;
     }
     if (queue != null) {
-        await queue.enqueue({
-            type: "inbox",
-            id: dntShim.crypto.randomUUID(),
-            baseUrl: request.url,
-            activity: json,
-            identifier: recipient,
-            attempt: 0,
-            started: new Date().toISOString(),
-        });
+        const carrier = {};
+        propagation.inject(context.active(), carrier);
+        try {
+            await queue.enqueue({
+                type: "inbox",
+                id: dntShim.crypto.randomUUID(),
+                baseUrl: request.url,
+                activity: json,
+                identifier: recipient,
+                attempt: 0,
+                started: new Date().toISOString(),
+                traceContext: carrier,
+            });
+        }
+        catch (error) {
+            logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", { error, activityId: activity.id?.href, activity: json, recipient });
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: `Failed to enqueue the incoming activity ${activity.id?.href}.`,
+            });
+            throw error;
+        }
         logger.info("Activity {activityId} is enqueued.", { activityId: activity.id?.href, activity: json, recipient });
         return new Response("Activity is enqueued.", {
             status: 202,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
         });
     }
-    const listener = inboxListeners?.dispatch(activity);
-    if (listener == null) {
-        logger.error("Unsupported activity type:\n{activity}", { activity: json, recipient });
-        return new Response("", {
-            status: 202,
-            headers: { "Content-Type": "text/plain; charset=utf-8" },
-        });
-    }
-    try {
-        await listener(inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href), activity);
-    }
-    catch (error) {
+    tracerProvider = tracerProvider ?? trace.getTracerProvider();
+    const tracer = tracerProvider.getTracer(metadata.name, metadata.version);
+    const response = await tracer.startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
+        const dispatched = inboxListeners?.dispatchWithClass(activity);
+        if (dispatched == null) {
+            logger.error("Unsupported activity type:\n{activity}", { activity: json, recipient });
+            span.setStatus({
+                code: SpanStatusCode.UNSET,
+                message: `Unsupported activity type: ${getTypeId(activity).href}`,
+            });
+            span.end();
+            return new Response("", {
+                status: 202,
+                headers: { "Content-Type": "text/plain; charset=utf-8" },
+            });
+        }
+        const { class: cls, listener } = dispatched;
+        span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
         try {
-            await inboxErrorHandler?.(context, error);
+            await listener(inboxContextFactory(recipient, json, activity?.id?.href, getTypeId(activity).href), activity);
         }
         catch (error) {
-            logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+            try {
+                await inboxErrorHandler?.(ctx, error);
+            }
+            catch (error) {
+                logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+                    error,
+                    activityId: activity.id?.href,
+                    activity: json,
+                    recipient,
+                });
+            }
+            logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
                 error,
                 activityId: activity.id?.href,
                 activity: json,
                 recipient,
             });
+            span.setStatus({ code: SpanStatusCode.ERROR, message: String(error) });
+            span.end();
+            return new Response("Internal server error.", {
+                status: 500,
+                headers: { "Content-Type": "text/plain; charset=utf-8" },
+            });
         }
-        logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
-            error,
-            activityId: activity.id?.href,
-            activity: json,
-            recipient,
-        });
-        return new Response("Internal server error.", {
-            status: 500,
+        if (cacheKey != null) {
+            await kv.set(cacheKey, true, {
+                ttl: dntShim.Temporal.Duration.from({ days: 1 }),
+            });
+        }
+        logger.info("Activity {activityId} has been processed.", { activityId: activity.id?.href, activity: json, recipient });
+        span.end();
+        return new Response("", {
+            status: 202,
             headers: { "Content-Type": "text/plain; charset=utf-8" },
         });
-    }
-    if (cacheKey != null) {
-        await kv.set(cacheKey, true, { ttl: dntShim.Temporal.Duration.from({ days: 1 }) });
-    }
-    logger.info("Activity {activityId} has been processed.", { activityId: activity.id?.href, activity: json, recipient });
-    return new Response("", {
-        status: 202,
-        headers: { "Content-Type": "text/plain; charset=utf-8" },
     });
+    if (response.status >= 500)
+        span.setStatus({ code: SpanStatusCode.ERROR });
+    return response;
 }
 /**
  * Responds with the given object in JSON-LD format.

package/esm/federation/inbox.js

@@ -12,7 +12,7 @@ export class InboxListenerSet {
         }
         this.#listeners.set(type, listener);
     }
-    dispatch(activity) {
+    dispatchWithClass(activity) {
         // deno-lint-ignore no-explicit-any
         let cls = activity
             // deno-lint-ignore no-explicit-any
@@ -29,6 +29,9 @@ export class InboxListenerSet {
             cls = globalThis.Object.getPrototypeOf(cls);
         }
         const listener = inboxListeners.get(cls);
-        return listener;
+        return { class: cls, listener };
+    }
+    dispatch(activity) {
+        return this.dispatchWithClass(activity)?.listener ?? null;
     }
 }

package/esm/federation/middleware.js

@@ -158,18 +158,21 @@ export class FederationImpl {
     }
     #listenQueue(ctxData, message) {
         const tracer = this.#getTracer();
+        const extractedContext = propagation.extract(context.active(), message.traceContext);
         return withContext({ messageId: message.id }, async () => {
             if (message.type === "outbox") {
-                const extractedContext = propagation.extract(context.active(), message.traceContext);
                 await tracer.startActiveSpan("activitypub.outbox", {
                     kind: SpanKind.CONSUMER,
-                    attributes: { "activitypub.activity.type": message.activityType },
+                    attributes: {
+                        "activitypub.activity.type": message.activityType,
+                        "activitypub.activity.retries": message.attempt,
+                    },
                 }, extractedContext, async (span) => {
                     if (message.activityId != null) {
                         span.setAttribute("activitypub.activity.id", message.activityId);
                     }
                     try {
-                        await this.#listenOutboxMessage(ctxData, message);
+                        await this.#listenOutboxMessage(ctxData, message, span);
                     }
                     catch (e) {
                         span.setStatus({
@@ -184,11 +187,30 @@ export class FederationImpl {
                 });
             }
             else if (message.type === "inbox") {
-                await this.#listenInboxMessage(ctxData, message);
+                await tracer.startActiveSpan("activitypub.inbox", {
+                    kind: SpanKind.CONSUMER,
+                    attributes: {
+                        "activitypub.shared_inbox": message.identifier == null,
+                    },
+                }, extractedContext, async (span) => {
+                    try {
+                        await this.#listenInboxMessage(ctxData, message, span);
+                    }
+                    catch (e) {
+                        span.setStatus({
+                            code: SpanStatusCode.ERROR,
+                            message: String(e),
+                        });
+                        throw e;
+                    }
+                    finally {
+                        span.end();
+                    }
+                });
             }
         });
     }
-    async #listenOutboxMessage(_, message) {
+    async #listenOutboxMessage(_, message, span) {
         const logger = getLogger(["fedify", "federation", "outbox"]);
         const logData = {
             keyIds: message.keys.map((pair) => pair.keyId),
@@ -224,6 +246,7 @@ export class FederationImpl {
             });
         }
         catch (error) {
+            span.setStatus({ code: SpanStatusCode.ERROR, message: String(error) });
             const activity = await Activity.fromJsonLd(message.activity, {
                 contextLoader: this.contextLoader,
                 documentLoader: rsaKeyPair == null
@@ -261,7 +284,7 @@ export class FederationImpl {
         }
         logger.info("Successfully sent activity {activityId} to {inbox}.", { ...logData });
     }
-    async #listenInboxMessage(ctxData, message) {
+    async #listenInboxMessage(ctxData, message, span) {
         const logger = getLogger(["fedify", "federation", "inbox"]);
         const baseUrl = new URL(message.baseUrl);
         let context = this.#createContext(baseUrl, ctxData);
@@ -284,6 +307,10 @@ export class FederationImpl {
             }
         }
         const activity = await Activity.fromJsonLd(message.activity, context);
+        span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
+        if (activity.id != null) {
+            span.setAttribute("activitypub.activity.id", activity.id.href);
+        }
         const cacheKey = activity.id == null ? null : [
             ...this.kvPrefixes.activityIdempotence,
             activity.id.href,
@@ -299,74 +326,89 @@ export class FederationImpl {
                 return;
             }
         }
-        const listener = this.inboxListeners?.dispatch(activity);
-        if (listener == null) {
-            logger.error("Unsupported activity type:\n{activity}", {
-                activityId: activity.id?.href,
-                activity: message.activity,
-                recipient: message.identifier,
-                trial: message.attempt,
-            });
-            return;
-        }
-        try {
-            await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, getTypeId(activity).href), activity);
-        }
-        catch (error) {
-            try {
-                await this.inboxErrorHandler?.(context, error);
-            }
-            catch (error) {
-                logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
-                    error,
-                    trial: message.attempt,
+        await this.#getTracer().startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
+            const dispatched = this.inboxListeners?.dispatchWithClass(activity);
+            if (dispatched == null) {
+                logger.error("Unsupported activity type:\n{activity}", {
                     activityId: activity.id?.href,
                     activity: message.activity,
                     recipient: message.identifier,
+                    trial: message.attempt,
+                });
+                span.setStatus({
+                    code: SpanStatusCode.ERROR,
+                    message: `Unsupported activity type: ${getTypeId(activity).href}`,
                 });
+                span.end();
+                return;
             }
-            const delay = this.inboxRetryPolicy({
-                elapsedTime: dntShim.Temporal.Instant.from(message.started).until(dntShim.Temporal.Now.instant()),
-                attempts: message.attempt,
-            });
-            if (delay != null) {
-                logger.error("Failed to process the incoming activity {activityId} (attempt " +
-                    "#{attempt}); retry...:\n{error}", {
-                    error,
-                    attempt: message.attempt,
-                    activityId: activity.id?.href,
-                    activity: message.activity,
-                    recipient: message.identifier,
+            const { class: cls, listener } = dispatched;
+            span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
+            try {
+                await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, getTypeId(activity).href), activity);
+            }
+            catch (error) {
+                try {
+                    await this.inboxErrorHandler?.(context, error);
+                }
+                catch (error) {
+                    logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+                        error,
+                        trial: message.attempt,
+                        activityId: activity.id?.href,
+                        activity: message.activity,
+                        recipient: message.identifier,
+                    });
+                }
+                const delay = this.inboxRetryPolicy({
+                    elapsedTime: dntShim.Temporal.Instant.from(message.started).until(dntShim.Temporal.Now.instant()),
+                    attempts: message.attempt,
                 });
-                await this.inboxQueue?.enqueue({
-                    ...message,
-                    attempt: message.attempt + 1,
-                }, {
-                    delay: dntShim.Temporal.Duration.compare(delay, { seconds: 0 }) < 0
-                        ? dntShim.Temporal.Duration.from({ seconds: 0 })
-                        : delay,
+                if (delay != null) {
+                    logger.error("Failed to process the incoming activity {activityId} (attempt " +
+                        "#{attempt}); retry...:\n{error}", {
+                        error,
+                        attempt: message.attempt,
+                        activityId: activity.id?.href,
+                        activity: message.activity,
+                        recipient: message.identifier,
+                    });
+                    await this.inboxQueue?.enqueue({
+                        ...message,
+                        attempt: message.attempt + 1,
+                    }, {
+                        delay: dntShim.Temporal.Duration.compare(delay, { seconds: 0 }) < 0
+                            ? dntShim.Temporal.Duration.from({ seconds: 0 })
+                            : delay,
+                    });
+                }
+                else {
+                    logger.error("Failed to process the incoming activity {activityId} after " +
+                        "{trial} attempts; giving up:\n{error}", {
+                        error,
+                        activityId: activity.id?.href,
+                        activity: message.activity,
+                        recipient: message.identifier,
+                    });
+                }
+                span.setStatus({
+                    code: SpanStatusCode.ERROR,
+                    message: String(error),
                 });
+                span.end();
+                return;
             }
-            else {
-                logger.error("Failed to process the incoming activity {activityId} after " +
-                    "{trial} attempts; giving up:\n{error}", {
-                    error,
-                    activityId: activity.id?.href,
-                    activity: message.activity,
-                    recipient: message.identifier,
+            if (cacheKey != null) {
+                await this.kv.set(cacheKey, true, {
+                    ttl: dntShim.Temporal.Duration.from({ days: 1 }),
                 });
             }
-            return;
-        }
-        if (cacheKey != null) {
-            await this.kv.set(cacheKey, true, {
-                ttl: dntShim.Temporal.Duration.from({ days: 1 }),
+            logger.info("Activity {activityId} has been processed.", {
+                activityId: activity.id?.href,
+                activity: message.activity,
+                recipient: message.identifier,
             });
-        }
-        logger.info("Activity {activityId} has been processed.", {
-            activityId: activity.id?.href,
-            activity: message.activity,
-            recipient: message.identifier,
+            span.end();
         });
     }
     startQueue(contextData, options = {}) {

package/esm/sig/http.js

@@ -236,7 +236,6 @@ async function verifyRequestInternal(request, span, { documentLoader, contextLoa
     }
     const { keyId, headers, signature } = sigValues;
     span?.setAttribute("http_signatures.key_id", keyId);
-    span?.setAttribute("http_signatures.signature", signature);
     if ("algorithm" in sigValues) {
         span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
     }
@@ -266,6 +265,7 @@ async function verifyRequestInternal(request, span, { documentLoader, contextLoa
                 ? request.headers.get("host") ?? new URL(request.url).host
                 : request.headers.get(name))).join("\n");
     const sig = decodeBase64(signature);
+    span?.setAttribute("http_signatures.signature", encodeHex(sig));
     // TODO: support other than RSASSA-PKCS1-v1_5:
     const verified = await dntShim.crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
     if (!verified) {