Artifact ae07f7409a7bfc20c5b9915bef57279ea5fd7dedc08f435cb25f91078af848e2:
- File
docs/site/content/docs/concepts/signing.md
-
2026-10-24 13:16:26
— part of check-in
[451d368554]
on branch main
— feat(horizon): bind each seed to its horizon and sign seeds apart
Every seed an origin mints now carries T +horizon-seed <C> <rule> (draft-fossil-horizon-00 §5.2.1), inside the signed bytes. The card is not counted as a tag in force, Mint never derives a horizon-seed row into a seed, and Apply skips the card.
Before a clone holds a seed, signed or not, it checks the seed against its store cone (§5.2.4). The seed must carry exactly one binding card naming the store's C and rule, and its D must be no earlier than the held seed's. A seed that fails is refused as a wrongly signed one and the clone falls back to the content horizon. A deepen discards the held seed first, so the floor restarts at the new C. A held seed that is no longer bound is discarded when it is next applied.
Seeds are signed with their own horizon-seed-command and are no longer signed by clearsign and pgp-command. SSH seed signatures use the fossil-horizon-seed namespace. clearsign.Key.Verify now takes the namespace, and check-in verification keeps fossilscm.
Adds 9 conformance cases and flips HZ-5.2-8, HZ-5.2-11, HZ-5.2-12 and HZ-5.2-13 to covered. The zit interop gate moves to zit 0.7.1, whose seeds are byte-identical with ours. (user: [email protected], size: 7103) [annotate] [blame] [check-ins using]
-
2026-10-24 13:29:08
— part of check-in
[b35d577a54]
on branch main
— Merge pull request #478 from danmestas/feat/horizon-seed-binding
feat(horizon): bind each seed to its horizon and sign seeds apart (user: [email protected], size: 7103) [annotate] [blame] [check-ins using]
-
2026-10-24 13:16:26
— part of check-in
[451d368554]
on branch main
— feat(horizon): bind each seed to its horizon and sign seeds apart