diff options
| author | tv <tv@krebsco.de> | 2026-11-08 18:17:14 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 19:29:10 +0100 |
| commit | 96ba15cf1a6f8725f70f429695a5a9661f706eb0 (patch) | |
| tree | 36feecb42a8bfa5317f27a052266f74489312dfc /docs | |
| parent | 4ce3bde36bb8283d82b914f0f73e30d89c935113 (diff) | |
strict: a manifest serves one remake, at its base
Review 2, N1: a strict manifest wasn't bound to its base. Any member
could propose an old, legitimately signed one again at the current
heads; nodes would verify it and vote, and every value at a signed
place changed or added since (a ban, a new user, a rotated key, a
changed userSigned or sealed declaration) would be deleted, nothing
after the base being left to replay.
The manifest now names the epoch and the heads it was made at, and a
node takes it (proposing or voting) only for a remake of that epoch
with exactly that base. GET /admin/strict-manifest makes it so;
continuum-signed strict proposes at those heads already.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index 657ab94..d7e05ab 100644 --- a/docs/access.md +++ b/docs/access.md @@ -427,7 +427,8 @@ continuum-signed strict ``` shows the values it would keep (`GET /admin/strict-manifest`: every value at a signed -place now, by its digest, and the policy with `"values": "signed"`), signs the +place now, by its digest, and the policy with `"values": "signed"`, for this epoch at +the heads it is at, so it serves one remake, at those heads, and no other), signs the manifest once confirmed (`ssh-keygen -Y sign -n continuum-strict`, with a key of `--strict-keys`), and proposes the remake at the heads it was made at (`{"kind": "strict", "spec": {"manifest": "<its line>\n<its signature>"}, "baseHeads": […]}`). To |