From 40907ae285317eaaf6449ff17d40b58a1a5df665 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 13:48:01 +0000 Subject: screen: a signature vouches for its change and what it builds on Review finding 5: vouching by (actor, seq) isn't bound to a hash. A member can make a change under another member's actor at a seq that member's signature covers. The change is then taken as vouched, and if it breaks a rule, the honest member is refused as a whole and logged as the one whose own change broke the rules. A signature now vouches for its change and the changes of its actor it builds on: in the document, as before; among received changes, those it reaches through the batch's dependencies. A received change under an actor at a seq whose change the document holds (a signature verified up to it) is a fork: refused as forged, never as its actor's node's, not told back in REFUSALS, and logged with the peer that brought it. --- docs/access.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 43cd326..f7546aa 100644 --- a/docs/access.md +++ b/docs/access.md @@ -244,8 +244,10 @@ can't cut its node off. With `"signatures": "required"`, a change also needs a signature by the node it names ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and one no signature vouches for yet waits, with whatever builds on it, until one does -(they come with the changes, or within a second on their own). A member can then no -longer write as another member; the user a change names is still its node's word. +(they come with the changes, or within a second on their own). A signature vouches for +its change and the node's changes it builds on, no others: a change made under another +node's actor is forged, refused, and logged as its sender's (`A peer brought changes +forged`). A member can then no longer write as another member; the user a change names is still its node's word. In a swarm without a registry, whatever a user would need, any member may. A refused change stays out, and so does whatever builds on it; the node logs it (`Refused a -- cgit v1.3.1