Skip to content

Witness v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 16:57
· 166 commits to main since this release
v1.1.0
bd4e491
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Disagreements are now settled by reproduction instead of by vote. Upgrade
every witness; 1.0.x witnesses keep working alongside 1.1.0 ones but don't
take part in rechecks.

Added

  • Rechecks. When the witnesses assigned to a URL disagree, the round
    is disputed, and witnesses drawn at random from the reporters'
    countries, one per network and none of them assigned, capture the page
    again. Only versions they reproduce count: a real regional difference is
    confirmed as a split, and a made-up one is overruled. The draw uses
    drand and a fixed slot of time, so nobody can pick or retry it. New
    verdict: DISPUTED, while rechecks run or when nothing could be
    confirmed. See DESIGN.md §6.5.
  • Split alerts need repeated confirmation: 3 of the last 4 settled
    recheck rounds for the URL (quorum.split_confirmations,
    quorum.split_rounds).
  • Failed claims. A version the rechecks could have reproduced and
    didn't counts against the network address it came from; after 5 in a
    week (quorum.max_failed_claims) that network is left out of verdicts.
  • Forks of different sizes are detected. Auditors check the heads
    other auditors report for a log against the one they verified; a log
    that can't prove them consistent is excluded and alerted on.
  • Rate limit on the public API: 600 requests a minute per address
    (network.api_requests_per_minute), answered with HTTP 429 beyond that.

Changed

  • Only the witnesses assigned to a URL count in its verdict.
  • Log proofs, bundles and new tree heads cost O(log n) instead of a pass
    over the whole log, so large logs stay fast and the proof endpoints
    can't be used to exhaust a node.
  • Verdict JSON has a groups list (every version compared) and a
    rechecks count.

Known limitations

  • A difference seen only from one country is only confirmed if that
    country has at least 3 witnesses on different networks beyond the ones
    assigned. Small networks show DISPUTED where 1.0 showed SPLIT.
  • A country where one operator runs most witnesses decides what is seen
    from there, and a round whose assigned witnesses are all one operator's
    agrees on whatever they say.

Install

On a server, the installer builds from source and sets up the service:

git clone https://github.com/Aelthorim/witness.git && cd witness
sudo sh scripts/install.sh --domain witness.example.org --caddy

The binaries below are static Linux builds of the witness command
(without headless rendering). Check them against SHA256SUMS.

Assets 5
Loading