From 3d7230d952aa4a71a1aeb64fee9841d16b70ed91 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:21 +0100 Subject: access: signatures required "signatures": "required": a change counts only once a signature by its committer vouches for it, and waits until then; every node then signs every change it makes. Auth plan M6. --- docs/access.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index df8ad53..ba9caf1 100644 --- a/docs/access.md +++ b/docs/access.md @@ -192,6 +192,12 @@ revocation since refuses nothing it allowed then, and every node judges alike. * Everything else, protocol data or not, by a user the registry lets write there. * A node that isn't a member may only register itself. +With `"signatures": "required"`, a change also needs a signature by the node it names +([`api.md`](api.md), Signed changes): every node then signs every change it makes, and +one no signature vouches for yet waits, with whatever builds on it, until one does +(they come with the changes, or within a second on their own). A member can then no +longer write as another member; the user a change names is still its node's word. + In a swarm without a registry, whatever a user would need, any member may. A refused change stays out, and so does whatever builds on it; the node logs it (`Refused a change`) and lists the last thousand (`GET /admin/refused`). A change whose @@ -199,9 +205,8 @@ dependencies haven't come yet waits for them. What it doesn't do yet: -* **Prove who wrote it.** A change is its claimed node's and user's: a member could - claim another member, or a user its node doesn't have. Changes are signed - ([`api.md`](api.md), Signed changes), but the policy doesn't require it yet. +* **Prove the user.** A change is its node's (with signatures required, proven) and its + claimed user's: a member could claim a user its operator doesn't have. * **Judge a joining node's first sync.** An empty document has no policy: what it gets from the node it joins through is taken as it is, as that node judged it. * **Agree at once.** The policy applies as each node gets it: a change received between -- cgit v1.3.1