eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add canonical sigchain bundle format

Browse source
This commit is contained in:
Eric Wendland 2026-07-19 03:16:14 +02:00
commit decff4b995
14 changed files with 1515 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/architecture.md
View file

@ -492,6 +492,15 @@ test-only static workflow was removed rather than migrated. Iroh keychain sync
remains the current replicated local operation-log path while explicit
SSHSIGCHAIN production and import workflows are completed.
SSHSIGCHAIN's canonical `.sscb` bundle is the portable on-disk and full-snapshot
distribution boundary. It deterministically stores signed record objects,
separate disclosures, head claims, and anchor receipts without embedding the
root key. JSONL remains inspection/interchange only. Bundle sources implement a
backend-neutral untrusted fetch interface; the static HTTP profile publishes
the same bytes below `/.well-known/sshsigchain/v1/<chain-id>/chain.sscb`.
Fetching never grants trust or selects a head. Geth may use Iroh rather than
HTTP operationally without changing the format or verification path.
New devices can use the node enrollment flow instead of hand-editing keychain
state. `geth node enroll join` explicitly imports an owner admin public key as
the new node's trust anchor, imports the signed peer card only as untrusted