We ensure that a `rad/root` ref is included in the signed refs file
under `rad/sigrefs` for all remotes. This prevents a certain kind of
"grafting" attack where signed refs can be copied between repositories,
by having the peer sign over the identity root together with the data refs.
When verifying signed refs, we ensure that the ref is present and points
to an identity branch root that matches the repository identity containing
the signed refs.
Alternatives: lots of alternatives were considered, but this one doesn't
introduce any changes to the signing. The `rad/id/root` name was
considered but is invalid due to `rad/id`.
If the local peer does not have any `rad/sigrefs` then there is no
risk of any data corruption. In this case the repository can be
removed entirely.
Signed-off-by: Fintan Halpenny <fintan.halpenny@gmail.com>
X-Clacks-Overhead: GNU Terry Pratchett
Removing a repository completely can result in data corruption for
users, since a user's `rad/sigrefs` are the ground truth of their
state, and any fork of them results in errors in the protocol.
Instead of `rad rm`, we replace it with `rad clean` that removes all
remotes other than the local peer's namespace and the delegates'. The
delegates are also necessary to keep, since the repository's identity
is dependent on them.
Note that the remotes that were cleaned will be populated again upon
fetching, as long as they are tracked.
Signed-off-by: Fintan Halpenny <fintan.halpenny@gmail.com>
X-Clacks-Overhead: GNU Terry Pratchett
cloudhead
Fintan Halpenny