A transparency log: append-only, witnessed, so the hub cannot show different histories issue #238 open andymccall opened this · 3 comments
andymccall set labels security ·
Design proposed in docs/transparency.md (2026-10-17, overnight): the log (C2SP tlog-tiles, signed checkpoints, witnesses) and, from it, integrated time for issue #240. Three decisions for Andy at the end of it; nothing built yet.
andymccall referenced by change 6e006eaf1da4 on main ·
Andy, 2026-10-17: docs/transparency.md accepted as recommended: one log for everything, hubs witnessing each other plus an oxy witness on a third machine, warn for a release then refuse.
referenced by 3 changes on 17 Oct 2026
referenced by 2 changes on 18 Oct 2026
Board tidy (2026-10-19): steps 1-4 of docs/transparency.md are built and live: the log (entries, tree, tiles, signed checkpoints), verification in oxy (inclusion and consistency on fetch), witnesses (oxy witness serve on plex and narvi cosign oxygenhub.io's checkpoints; GET /log/witnesses), and trusted time (issue #240: integrated time, witness pinning). Left: step 5, monitoring (oxy log watch and notifications when a watched hub's log changes unexpectedly); step 6 later (RFC 3161, a public log listing). Moving to Backlog until step 5 is picked up.
Compared with Sigstore (Rekor), 2026-10-16: our signatures cannot be forged, but a malicious or compromised hub could withhold attestations or roll a bookmark back for one client (freeze / split-view) and nothing outside it would notice.
The hub keeps an append-only Merkle log (RFC 9162 style) of every ref attestation, seal, receipt and approval it accepts, publishes signed checkpoints (tree size, root, timestamp), and serves inclusion and consistency proofs. Clients (
oxy,oh, the extension) remember the last checkpoint per hub and check consistency on every fetch;oxy verifychecks inclusion. Independent witnesses (other hubs, a cron on Earth, optionally a public log such as Rekor or a witness network) cosign checkpoints, so equivocation needs every witness's collusion. Self-hosted first (the sovereignty story); anchoring optional. Gives trusted timestamps too (#B). First: spec (Oxygen spec 14), then the hub log and proofs, then client checks.