Skip to content

net: re-countersigning supersedes a party's own earlier signatures #926

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samlown merged 1 commit into from
Aug 11, 2026
Merged

net: re-countersigning supersedes a party's own earlier signatures #926

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p

## [Unreleased]

### Changed

- `net`: spec §5.3 — a party re-countersigning an envelope MUST replace its own earlier countersignatures (supersession); removing another party's signatures remains forbidden. In steady state an endorsed identity carries exactly three signatures: the subject's, the Authority's, and the verifier's.

### Added

- `net`: sandbox support: `SandboxAuthorities` (default `lookup.sandbox.gobl.org`) and the `WithSandbox` client option. The live and sandbox trust lists are disjoint.
Expand Down
7 changes: 6 additions & 1 deletion net/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,7 +378,12 @@ require verification reject with `ErrNotVerified`
valid bare address is treated as absent. Adding or revoking
verification is the registration Authority's act: it re-countersigns
the envelope with the pointer added or removed, which makes the
registry the single source of truth for verification state. The
registry the single source of truth for verification state. A party
re-countersigning an envelope MUST replace its own earlier
countersignatures rather than accumulate copies: supersession is
what makes the latest statement authoritative — a lingering older
signature could assert a verifier the Authority has since revoked.
No party may remove another party's signatures. The
coordination when verification completes is an ordinary delivery
with no new endpoints: the subject sends its registered envelope to
the verifier's inbox, the verifier countersigns that exact envelope
Expand Down
Loading