Bump webpush from 0.3 to 1.1.0

[ClearlyClaire]

WebPush changed content encoding from aesgcm to aes128gcm, so the code needs a few changes. (See zaru/webpush#75)

The encryption algorithm remain the same, and as far as I know, the content encoding for aesgcm is being deprecated in favor of aes128gcm. I've also seen reports that push notifications using aesgcm do not work on Microsoft Edge, but I haven't tried that out myself. I suppose this may break compatibility with older web push servers, so this may need some additional testing.

[Gargron]

toot-relay, PushToFCM, toot-relay-fcm, and webpush-fcm-relay are all hardcoded to the aesgcm algorithm. This would break compatibility with the official apps, Toot! on iOS, Subway Tooter, and Fedi for Pleroma and Mastodon.

[ClearlyClaire]

toot-relay, PushToFCM, toot-relay-fcm, and webpush-fcm-relay are all hardcoded to the aesgcm algorithm. This would break compatibility with the official apps, Toot! on iOS, Subway Tooter, and Fedi for Pleroma and Mastodon.

😩

aes128gcm is the standard, so it would be good if we used it, instead of the old aesgcm.

In the meantime, I guess I can try making a webpush fork with OpenSSL 3 support based on the aesgcm version…

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[github-actions]

This pull request has merge conflicts that must be resolved before it can be merged.

[ThisIsMissEm]

toot-relay, PushToFCM, toot-relay-fcm, and webpush-fcm-relay are all hardcoded to the aesgcm algorithm. This would break compatibility with the official apps, Toot! on iOS, Subway Tooter, and Fedi for Pleroma and Mastodon.

@Gargron are these still hardcoded? I just noticed that PushPad have forked the Webpush gem and have upgraded it to include the OpenSSL 3.0 changes, and more: https://github.com/pushpad/web-push

(I've opened a PR for migrating to web-push: #26496

[p1gp1g]

If it is possible, a backward compatible solution would be to use /api/v1/push/ to use the legacy protocol, and /api/v2/push for webpush (RFC)

[mjankowski]

Has there been any more thought to an upgrade path on this? Seems worth nudging things towards standards where possible ... could leave some legacy support in place basically forever, or until sufficient client support/upgrades happened.

[p1gp1g]

I plan to do it in some weeks and open a PR :)

[mjankowski]

I plan to do it in some weeks and open a PR :)

Excellent, will look for it.

[p1gp1g]

Here it is: #33528

[ClearlyClaire]

Closing in favor of #33528