diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:21 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:21 +0100 |
| commit | 5471e5285e94ce7576e6c86f260fea15ed9503d1 (patch) | |
| tree | 310be18d26611d6aaf6d8b02a118ba2fb6ef4aa1 /docs | |
| parent | c3fde0fdd410902125f006f0a7d77ca030cb9061 (diff) | |
signatures: verified changes
GET /admin/changes shows whether a signature by its node vouches for
each change.
Auth plan M5.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/api.md | 3 | ||||
| -rw-r--r-- | docs/openapi.yaml | 10 | ||||
| -rw-r--r-- | docs/trust.md | 8 |
3 files changed, 16 insertions, 5 deletions
diff --git a/docs/api.md b/docs/api.md index a02d3d5..89da7ba 100644 --- a/docs/api.md +++ b/docs/api.md @@ -237,7 +237,8 @@ signs it, so a member could name another. In a swarm without a registry, user na are each node's own (`--htpasswd`, or its proxy's): `alice` on two nodes is one person only where their operators make it so, which nothing checks. `GET /admin/changes` lists them, -newest first, with the paths each touched; `GET /admin/changes/settings` those that +newest first, with the paths each touched and whether a signature by its node vouches +for it (`verified`, Signed changes); `GET /admin/changes/settings` those that touched what is at `settings`. Every node holds every change, so user names are known to the whole swarm, and so is who wrote what, until a remake drops the history ([`remakes.md`](remakes.md)). diff --git a/docs/openapi.yaml b/docs/openapi.yaml index 7aba2fe..d067f4f 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -601,7 +601,7 @@ paths: type: array items: type: object - required: [hash, at, paths] + required: [hash, at, verified, paths] properties: hash: type: string @@ -611,6 +611,9 @@ paths: type: string user: type: string + verified: + type: boolean + description: A signature by its node vouches for it, as far as this node has the signatures (`api.md`, Signed changes). paths: type: array items: @@ -652,7 +655,7 @@ paths: type: array items: type: object - required: [hash, at, paths] + required: [hash, at, verified, paths] properties: hash: type: string @@ -662,6 +665,9 @@ paths: type: string user: type: string + verified: + type: boolean + description: A signature by its node vouches for it, as far as this node has the signatures (`api.md`, Signed changes). paths: type: array items: diff --git a/docs/trust.md b/docs/trust.md index 8b0f72a..70369e2 100644 --- a/docs/trust.md +++ b/docs/trust.md @@ -61,8 +61,12 @@ node acts on what the document says: * **User data**: any member can write or delete any path. * **Who wrote what** (`GET /admin/changes`): each change names its node and API user - as the writing node says; nothing signs that, so a member can name another. The - names of the users who write are in the document, and so on every node. + as the writing node says. Nodes sign their changes ([`api.md`](api.md), Signed + changes), so a change a signature vouches for shows `verified`: its node made it. + One that shows unverified may yet be vouched for by its node's next signature, or + may be another member's claiming that node; nothing is refused for it yet. The user a + change names is its node's claim, signed or not. The names of the users who write + are in the document, and so on every node. * **The member registry**: each node writes its own entry, but nothing stops a member from writing others'. The registry decides the topology and, through the alive stamps, the electorate of a remake. |