From d56b3b069782585a6edcc9c608236361c2644a51 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:18:33 +0000 Subject: envelope: a signed value names its swarm Review 3.1, part of finding 12: a signed value's payload bound path, user, time and prev, but not the swarm. A user with the same name and key in two swarms could have an envelope replayed from one into the other, wherever the path holds no envelope yet (prev ""). The payload now names the swarm (`swarm`), and a node takes an envelope only for its own. /auth/whoami says the swarm, and continuum-signed and the example in api.md sign it. Wire version 44: nodes before this refuse such envelopes, and those after refuse the old ones. --- docs/api.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'docs/api.md') diff --git a/docs/api.md b/docs/api.md index 019f9cf..cf05046 100644 --- a/docs/api.md +++ b/docs/api.md @@ -281,18 +281,20 @@ their users), a user writes one by signing it with its SSH key: the payload, one of JSON, then the signature, as `application/continuum-signed`. ```sh -# The envelope there, if any, and what replaces it names: its SHA-256 (none: ""). +# The swarm it is for; the envelope there, if any, and what replaces it names: its +# SHA-256 (none: ""). +swarm=$(curl -sf -u alice localhost:3000/auth/whoami | jq -r .swarm) read=$(curl -sf -u alice -H 'Accept: text/plain' 'localhost:3000/store/config?raw=true') prev=${read:+$(printf %s "$read" | sha256sum | cut -d' ' -f1)} -printf '{"path":["config"],"value":{"mode":"fast"},"user":"alice","at":%s,"prev":"%s"}' \ - "$(date +%s000)" "$prev" > payload +printf '{"swarm":"%s","path":["config"],"value":{"mode":"fast"},"user":"alice","at":%s,"prev":"%s"}' \ + "$swarm" "$(date +%s000)" "$prev" > payload ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n continuum-value payload { cat payload; echo; cat payload.sig; } | curl -X PUT localhost:3000/store/config \ -u alice -H 'Content-Type: application/continuum-signed' --data-binary @- ``` The node writes it as its envelope if the authenticated user signed it (`403` if not), -for this path, with one of its keys, may write there (`403`), and it replaces what is +for this swarm and this path, with one of its keys, may write there (`403`), and it replaces what is there (`prev`, the SHA-256 of the envelope it replaces; `409` if it names another: read again and sign anew), and only where values are signed (`409` elsewhere). It answers with the value, as a `PUT` does; a signed `null` deletes, with `204`. Under -- cgit v1.3.1