Changes between Version 13 and Version 14 of CodeSigning

Timestamp:

Aug 29, 2014, 10:10:40 AM (10 years ago)

Author:

davea

Comment:

--

CodeSigning

@@ -43 +43 @@
 you've started using an offline signing machine,
 and you don't want to force existing users to detach and reattach.
+
+If you change code-signing keys frequently,
+you can keep multiple (old key, signature) pairs,
+so that client that haven't connected in a long time will update successfully.
+If a client has a signing key that's not current, the server logic is:
+
+ * Scan the keys/ directory for files '''old_key_i''' for i = 0, 1, ...
+ * If one of these contains the key sent by the client,
+   send the client the new key with the signature in '''signature_i'''.
+
+Note that '''signature_i''' contains a signature for the newest key,
+signed by the old key i.
+You must regenerate these when you issue a new key.