diff --git a/activitypub.py b/activitypub.py
index 1cd048c..88ff84b 100644
--- a/activitypub.py
+++ b/activitypub.py
@@ -719,12 +719,13 @@ class Update(BaseActivity):
         # TODO(tsileo): implements _should_purge_cache if it's a reply of a published activity (i.e. in the outbox)
 
     def _post_to_outbox(self, obj_id: str, activity: ObjectType, recipients: List[str]) -> None:
-        obj = self.get_object()
+        print('UPDATE')
+        obj = self._data['object']
 
         update_prefix = 'activity.object.'
         update: Dict[str, Any] = {'$set': dict(), '$unset': dict()}
         update['$set'][f'{update_prefix}updated'] = datetime.utcnow().replace(microsecond=0).isoformat() + 'Z'
-        for k, v in obj._data.items():
+        for k, v in obj.items():
             if k in ['id', 'type']:
                 continue
             if v is None:
@@ -735,7 +736,9 @@ class Update(BaseActivity):
         if len(update['$unset']) == 0:
             del(update['$unset'])
 
-        DB.outbox.update_one({'remote_id': obj.id.replace('/activity', '')}, update)
+        print(f'updating note from outbox {obj!r} {update}')
+        logger.info(f'updating note from outbox {obj!r} {update}')
+        DB.outbox.update_one({'activity.object.id': obj['id']}, update)
         # FIXME(tsileo): should send an Update (but not a partial one, to all the note's recipients
         # (create a new Update with the result of the update, and send it without saving it?)
 
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index bf6b0ee..980264e 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -1,7 +1,7 @@
 version: '2'
 services:
   celery:
-    build: .
+    image: microblogpub:latest
     links:
      - mongo
      - rabbitmq
diff --git a/utils/httpsig.py b/utils/httpsig.py
index f63c12c..8437784 100644
--- a/utils/httpsig.py
+++ b/utils/httpsig.py
@@ -5,7 +5,7 @@ Mastodon instances won't accept requests that are not signed using this scheme.
 """
 from datetime import datetime
 from urllib.parse import urlparse
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 import base64
 import hashlib
 import logging
@@ -31,7 +31,9 @@ def _build_signed_string(signed_headers: str, method: str, path: str, headers: A
     return '\n'.join(out)
 
 
-def _parse_sig_header(val: str) -> Dict[str, str]:
+def _parse_sig_header(val: Optional[str]) -> Optional[Dict[str, str]]:
+    if not val:
+        return None
     out = {}
     for data in val.split(','):
         k, v = data.split('=', 1)
@@ -54,6 +56,9 @@ def _body_digest() -> str:
 
 def verify_request(actor_service) -> bool:
     hsig = _parse_sig_header(request.headers.get('Signature'))
+    if not hsig:
+        logger.debug('no signature in header')
+        return False
     logger.debug(f'hsig={hsig}')
     signed_string = _build_signed_string(hsig['headers'], request.method, request.path, request.headers, _body_digest())
     _, rk = actor_service.get_public_key(hsig['keyId'])