From a3eadeeeff9f4ae8ce91251e51d8312a6ffbc2ca Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 21:49:45 +0000 Subject: roots: a joiner takes a root once its seeds named it Review 3, R2: the root pin was set by the first HELLO_REPLY, and the first sync, a round trip later, took that root; a peer naming another afterwards was refused as another history. So the seed that answered first decided, not "none while they disagree", and a malicious seed makes itself fastest. A node joining with an empty document of the first epoch now takes no root (RootPin::Awaiting, roots left for later) until each of its seeds named one, or ROOT_WAIT (10 s) passed since the first did; then the one they name, none while they differ, as before. With --genesis-root it takes that one alone, at once. access.md, the option's help and example.toml say so; switching roots later, while the joiner holds nothing of its own, is postponed. --- docs/example.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'docs/example.toml') diff --git a/docs/example.toml b/docs/example.toml index c152b8b..010968a 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -112,8 +112,8 @@ htpasswd = "/etc/continuum/htpasswd" # The hash of the swarm's genesis change (hex, as its genesis node logs it and GET # /admin/epochs shows it): joining with an empty document, the only root this node -# takes. Without, the one its peers name, none while they name different ones -# (docs/access.md). +# takes. Without, the one its peers name once each seed named one or ten seconds +# passed since the first did, none while they name different ones (docs/access.md). # genesis-root = "…" # SSH keys, as authorized_keys lines (ssh-ed25519 [comment]), whose signature -- cgit v1.3.1