From b83bd5bdd9548b0e7ca7b1c9068dd47cdb5246d9 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 17:32:08 +0000 Subject: signatures: a transfer carries one signature per writer in it Under a policy requiring signatures, a node takes a change only once a signature vouches for it: one of the change itself, or of a later change of the same writer. A writer is a node's run, each start, rejoin or drop making a fresh actor, so an epoch gathers writers for as long as it lasts, and a transfer of its whole history (a joiner pulling the document, a delta) must carry a signature for each of them, or the joiner waits for the rest for good. A message's signatures are now chosen by what it carries: * changes, up to 256 signed among them: each one's signature; * more (a whole document pulled): each writer's latest signed change among them, found by the document's change metadata (`Signatures::for_changes`), vouching for the rest; * a delta: each writer with changes in it (`get_changes_meta(from)`), its latest verified signature (`for_delta`). A message carries up to 65536 (6 MiB), and as many wait at the receiver for their changes (a delta's come after it). So a transfer leaves writers unvouched only in an epoch with more than 65536 runs writing since it began; a remake starts the count again. Wire version 48. --- docs/api.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'docs/api.md') diff --git a/docs/api.md b/docs/api.md index 3fb99be..a4b76b0 100644 --- a/docs/api.md +++ b/docs/api.md @@ -291,15 +291,18 @@ peer was sent before, so changes sent again (a message lost on the way) arrive vouched for as the first time; and a node checks one it receives once it holds the change (a signature costs about 30 µs to check, and one vouches for its node's changes before it). A message carrying no changes carries no signatures; one carrying more -than 4096 signed changes (a whole document pulled), and a delta, carry each node run's -latest instead. A node signs the latest change of each of its runs that nothing vouches -for as it starts, before anything leaves, and whenever its document is swapped (a drop, -a switch, a rejoin): changes it kept unsigned, never sent. +than 256 signed changes (a whole document pulled) carries each writer's latest among +them instead, and a delta each writer's latest with changes in it. A writer is a node's +run: each start, rejoin or drop makes a fresh one. A node signs the latest change of +each of its runs that nothing vouches for as it starts, before anything leaves, and +whenever its document is swapped (a drop, a switch, a rejoin): changes it kept +unsigned, never sent. Two cases still arrive unvouched, and wait under a policy requiring signatures: a change vouched for only by a later change of its node that the rules refused (nodes take it, -then can't pass the proof on, [`future-work.md`](future-work.md)); and, in one transfer, -the changes of an epoch with more than 4096 node runs writing. +then can't pass the proof on); and, in one transfer, the changes of runs past the +65536 a message carries signatures of at most, in an epoch with more runs writing than +that since it began. A remake starts the count again. The signatures a node has are kept in its document file (`--document-file`) with the document. -- cgit v1.3.1