diff options
| author | tv <tv@krebsco.de> | 2026-11-08 09:47:11 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 14:29:04 +0100 |
| commit | 23f0b629e5d80f880e5a0809f2e47b2d836ee2f9 (patch) | |
| tree | b1efd4f1e9a33bc9e5f21e27996ea44fd9603230 /src/remake/catchup.rs | |
| parent | e63984e99bef66cb05d7bcf781812ea5e6276fa8 (diff) | |
remake: replays judged before they go in
A switching or rejoining node replays late writes as fresh changes
naming each write's user, and nothing judged them before they left: a
replay every node would refuse (a revoked capability, a second
envelope at a signed path, readers changed) was refused everywhere,
and with it everything the node wrote after it.
Under a policy, replay_newest now judges each group it commits as
every node will (rules::judge_held, in the new epoch); one they would
refuse is taken back (forked at the heads before it, same actor) and
its paths quarantined with the reason. replay_newest takes the epoch.
Review finding 3 (remake replays).
Diffstat (limited to 'src/remake/catchup.rs')
| -rw-r--r-- | src/remake/catchup.rs | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/remake/catchup.rs b/src/remake/catchup.rs index 71f077a..9830c33 100644 --- a/src/remake/catchup.rs +++ b/src/remake/catchup.rs @@ -421,6 +421,7 @@ async fn finish<H: Host>(host: &H) { &before, &after, live, + target, &node, &translator, superseded, @@ -438,6 +439,7 @@ async fn finish<H: Host>(host: &H) { &began, &heads, live, + target, &node, &translator, superseded, |