- signed_config.py root drafts a later root in docs/root-signing/proposals/,
where wallets never look, and keeps the current targets key by default.
- docs/root-signing/: a page for the Pezkuwi Wallet DApp browser that shows
the proposal and its fingerprint, has the holder's wallet sign
<Bytes>payload</Bytes>, checks every signature as the wallet will, collects
signature codes and offers root.N.json once two current and two new holders
have signed. Crypto bundles are served beside it.
- scripts/root/verify_root.mjs checks every published signed/root.N.json the
way installed wallets do; Code Quality runs it. Wallet 1.3.0 accepts sr25519
only under the substrate signing context, and a root it cannot verify stops
its config refresh, so such a root must never reach master.
- Draft root 2: three new holder accounts, threshold 2, five years.
* feat(config): sign the served config files
signed/targets.json gives the sha256 of every JSON file the wallet may
fetch, signed with an Ed25519 targets key. signed/root.json names that
key and three sr25519 root keys (wallet accounts), two of which can
replace it; the wallet will ship this first root.
scripts/signed_config.py writes the root, signs the targets list and
checks it. Code Quality now refuses a tree whose served files do not
match the signed list, and runs weekly so an expiring signature shows a
month ahead.
* fix(config): sign the test fixtures and follow published roots
The wallet refuses any JSON file from this repository that the signed
list does not give, and its instrumented tests read tests/, so those
files are signed too.
A root after the first is written to signed/root.N.json, where the
wallet looks for it; sign and check use the newest published root.
SatoshiQaziMuhammed