diff options
| author | tv <tv@krebsco.de> | 2026-11-08 17:07:03 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 19:28:22 +0100 |
| commit | f91604095e6f0978c61f66d0b937e36271637e6b (patch) | |
| tree | e05cd2a21dd4122c3a8a3a450b3605b5a094416b /docs/access.md | |
| parent | 5f69ecf6284a8061a2b8fae5b8f98d67a67dad5f (diff) | |
remake: no --follow-strict-remakes; a strict remake failing says who
A strict remake takes a majority of members whose --strict-keys take
its manifest's signer: no node votes for one without, so
--follow-strict-remakes (1173) goes. A node that doesn't vote still
switches once the others commit, as with any remake.
So that an operator can tell why one fails: a strict remake aborted
for want of a majority (the voting period over, or a majority out of
reach) says in its reason (GET /admin/remakes/{id}, and the
coordinator's log) which members didn't vote, and that a member votes
for one only with its manifest signed by a key of its --strict-keys.
Each of those logs why itself (`Not voting for a strict remake`).
The sim a_strict_remake_too_few_take: only a takes the manifest; the
remake aborts, naming b and c.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/docs/access.md b/docs/access.md index 9bd99cc..458c2dd 100644 --- a/docs/access.md +++ b/docs/access.md @@ -411,11 +411,12 @@ before, plain or signed by a key its planter put there itself, is gone unless th operator kept it. Every node is given the keys whose signature it takes on such a remake, out of the -document (`--strict-keys`, `authorized_keys` lines): one an operator holds. A node -votes for a strict remake only with its manifest signed by one of them; without any, -it votes for none (logged, `Not voting for a strict remake`), unless -`--follow-strict-remakes`. Once a majority commits one, every node switches, as with -any remake. +document (`--strict-keys`, `authorized_keys` lines): one an operator holds, the same +on a majority of the members at least. A node votes for a strict remake only with its +manifest signed by one of them; without any, for none (logged, `Not voting for a +strict remake`). Once a majority commits one, every node switches, as with any +remake. One that gets no majority aborts, its reason naming the members that didn't +vote: those whose `--strict-keys` don't take the manifest's signer, or that were away. ```sh continuum-signed strict |