From a3eadeeeff9f4ae8ce91251e51d8312a6ffbc2ca Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 21:49:45 +0000 Subject: roots: a joiner takes a root once its seeds named it Review 3, R2: the root pin was set by the first HELLO_REPLY, and the first sync, a round trip later, took that root; a peer naming another afterwards was refused as another history. So the seed that answered first decided, not "none while they disagree", and a malicious seed makes itself fastest. A node joining with an empty document of the first epoch now takes no root (RootPin::Awaiting, roots left for later) until each of its seeds named one, or ROOT_WAIT (10 s) passed since the first did; then the one they name, none while they differ, as before. With --genesis-root it takes that one alone, at once. access.md, the option's help and example.toml say so; switching roots later, while the joiner holds nothing of its own, is postponed. --- docs/access.md | 6 ++++-- docs/example.toml | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) (limited to 'docs') diff --git a/docs/access.md b/docs/access.md index 2f36ecd..46758b0 100644 --- a/docs/access.md +++ b/docs/access.md @@ -329,8 +329,10 @@ node whose document starts from another root of the same epoch refuses the hands (another history under the swarm's ID: a forged root, or a genesis started again). A node joining with an empty document takes as its root only the one it was given (`--genesis-root`), or else the one its peers name, and none while they name different -ones. So one peer hands a joiner another root only if it is all the joiner hears, or -never, with `--genesis-root`. +ones; and none before each of its seeds named one, or ten seconds passed since the +first did. So without `--genesis-root`, the root is the one the seeds that answer within +that wait agree on: one peer hands a joiner another root only if it is all the joiner +hears by then; with `--genesis-root`, never. What it doesn't do yet: diff --git a/docs/example.toml b/docs/example.toml index c152b8b..010968a 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -112,8 +112,8 @@ htpasswd = "/etc/continuum/htpasswd" # The hash of the swarm's genesis change (hex, as its genesis node logs it and GET # /admin/epochs shows it): joining with an empty document, the only root this node -# takes. Without, the one its peers name, none while they name different ones -# (docs/access.md). +# takes. Without, the one its peers name once each seed named one or ten seconds +# passed since the first did, none while they name different ones (docs/access.md). # genesis-root = "…" # SSH keys, as authorized_keys lines (ssh-ed25519 [comment]), whose signature -- cgit v1.3.1