From 96ba15cf1a6f8725f70f429695a5a9661f706eb0 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 18:17:14 +0000 Subject: strict: a manifest serves one remake, at its base Review 2, N1: a strict manifest wasn't bound to its base. Any member could propose an old, legitimately signed one again at the current heads; nodes would verify it and vote, and every value at a signed place changed or added since (a ban, a new user, a rotated key, a changed userSigned or sealed declaration) would be deleted, nothing after the base being left to replay. The manifest now names the epoch and the heads it was made at, and a node takes it (proposing or voting) only for a remake of that epoch with exactly that base. GET /admin/strict-manifest makes it so; continuum-signed strict proposes at those heads already. --- docs/access.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 657ab94..d7e05ab 100644 --- a/docs/access.md +++ b/docs/access.md @@ -427,7 +427,8 @@ continuum-signed strict ``` shows the values it would keep (`GET /admin/strict-manifest`: every value at a signed -place now, by its digest, and the policy with `"values": "signed"`), signs the +place now, by its digest, and the policy with `"values": "signed"`, for this epoch at +the heads it is at, so it serves one remake, at those heads, and no other), signs the manifest once confirmed (`ssh-keygen -Y sign -n continuum-strict`, with a key of `--strict-keys`), and proposes the remake at the heads it was made at (`{"kind": "strict", "spec": {"manifest": "\n"}, "baseHeads": […]}`). To -- cgit v1.3.1