From 5f69ecf6284a8061a2b8fae5b8f98d67a67dad5f Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 16:27:35 +0000 Subject: remake: turning a running swarm strict, keeping what an operator signed Until a swarm is strict, the user a change names is its node's word, so any member could have planted registry entries, policy, bans or user-signed values as any user, plain or signed by a key it put there itself; writing the strict policy trusted all of it as it was. A remake of a new kind, `strict`, turns a swarm strict instead: * Its content is a manifest (access::strict): the swarm, the strict policy, and each value kept at the places values are signed, by the SHA-256 of its JSON, signed by an operator (ssh-keygen -Y sign -n continuum-strict). * Every node builds the next epoch as compaction does, keeping at the signed places only the values the manifest names, as they were at the base, and writing its policy (RemakeKind::protocol, the one kind that changes protocol data). Writes after the base reach the new epoch only by replays, judged by the strict policy. * A node votes for one only with its manifest signed by one of --strict-keys, keys given out of the document; without any, for none (logged once, `Not voting for a strict remake`), unless --follow-strict-remakes. A coordinator proposes only what it would vote for (403). Once a majority commits one, every node switches, as with any remake: refusing to switch would only cut a node off. * GET /admin/strict-manifest gives the manifest keeping everything held now, the values for review and the heads they are at; continuum-signed strict shows them, signs once confirmed and proposes at those heads. The sim a_swarm_turning_strict_through_a_remake: a member plants a registry entry as a manager; the operator's manifest leaves it out; a and b, given the key, commit; c, without, follows; the entry is gone and the policy strict everywhere. --- scripts/continuum-signed | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/continuum-signed b/scripts/continuum-signed index 1523094..21eb376 100755 --- a/scripts/continuum-signed +++ b/scripts/continuum-signed @@ -17,6 +17,9 @@ # continuum-signed key-add ID FILE adds (or replaces) key ID of the user's own, # the public key in FILE (.pub), signed # continuum-signed key-remove ID removes key ID of the user's own, signed +# continuum-signed strict turns the swarm strict through a remake: +# shows the values it keeps, signs the manifest +# once confirmed, proposes the remake # # PATH is the store's (`config/mode`), its segments without `/` or characters that need # escaping in a URL. Settings, from the environment: @@ -206,10 +209,34 @@ own_key() { write "_continuum/users/$user" "$entry" "$(jq -r '.signed // empty' "$work/own")" } +# Turns the swarm strict (docs/access.md, Turning a swarm strict): the manifest of the +# values held at signed places now, shown, signed once confirmed (with a key the nodes +# were given, --strict-keys), proposed as a strict remake at the heads it was made at. +strict() { + curl -sf -H "Authorization: Bearer $CONTINUUM_TOKEN" "$url/admin/strict-manifest" \ + >"$work/strict" || die "no manifest from $url (reading _continuum needed)" + echo "The values kept (any other at a signed place goes):" >&2 + jq -r '.values[] | " /\(.path | join("/")): \(.value | tojson)"' "$work/strict" >&2 + echo "The policy: $(jq -r '.manifest | fromjson | .policy | tojson' "$work/strict")" >&2 + printf 'Sign and propose? [y/N] ' >&2 + read -r answer "$work/manifest" + sign "$work/manifest" continuum-strict + jq -n --rawfile line "$work/manifest" --rawfile signature "$work/manifest.sig" \ + --slurpfile strict "$work/strict" \ + '{kind: "strict", spec: {manifest: ($line + "\n" + $signature)}, + baseHeads: $strict[0].heads}' | + curl -sS --fail-with-body -X POST "$url/admin/remakes" \ + -H "Authorization: Bearer $CONTINUUM_TOKEN" \ + -H 'Content-Type: application/json' --data-binary @- + echo +} + command=${1:-} [ $# -gt 0 ] && shift case $command in - put | delete | get | verify | seal | open | key-add | key-remove) + put | delete | get | verify | seal | open | key-add | key-remove | strict) # One login for all the command's requests, unless given a token. CONTINUUM_TOKEN=${CONTINUUM_TOKEN:-$(login)} [ -n "$CONTINUUM_TOKEN" ] || die "couldn't log in as $user" @@ -225,5 +252,6 @@ case $command in open) [ $# -eq 1 ] || die "open PATH"; open_sealed "$1" ;; key-add) [ $# -eq 2 ] || die "key-add ID FILE"; own_key "$1" "$2" ;; key-remove) [ $# -eq 1 ] || die "key-remove ID"; own_key "$1" ;; + strict) [ $# -eq 0 ] || die "strict takes nothing"; strict ;; *) sed -n '2,/^$/s/^# \{0,1\}//p' "$0" >&2; exit 2 ;; esac -- cgit v1.3.1