bitcoinafterlife/bal-server
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

feat(contrib): add ping key revocation helper

Browse Source 
- Add make_ping_key_revocation.py: onion revocations are signed by the
  identity key, DNS TXT revocations are self-signed by the revoked key
- Document the revocation format, endpoint, helper usage, lifetime and
  no-revocation-of-identity-key limits
- Update the security audit, references and env docs for the new flow and
  the v2/onion-only scope
This commit is contained in:
svatantrya
2026-11-09 00:45:43 -04:00
parent 78e4f72255
commit 707d5b1032
11 changed files with 358 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/05_api_reference.md
View File

@@ -186,8 +186,12 @@ ping key, so the service rejects the pings until delegation is restored.
The `url` is trimmed of surrounding whitespace and trailing slashes, and the
`chain` is lowercase, matching the service-side canonicalization.
See [`10_dnssec_key_publishing.md`](10_dnssec_key_publishing.md) for the
operator guide on publishing `_welist-key.<host>` and on onion delegation.
To stop accepting a ping key, run `contrib/make_ping_key_revocation.py` and
submit the result to `{WELIST_SERVER_URL}/ping-keys/revoke`. Onion revocations
are signed by the onion identity key; DNS TXT revocations are self-signed by the
key being revoked. See [`10_dnssec_key_publishing.md`](10_dnssec_key_publishing.md)
for the operator guide on publishing `_welist-key.<host>`, onion delegation and
revocation.
### Version 1 (legacy)