From d4f469133690393a568242f1da8dceff82c035a9 Mon Sep 17 00:00:00 2001 From: iris Date: Sun, 20 Sep 2026 13:25:43 +0200 Subject: [PATCH] docs: clear write-good.Passive hits in docs/swarm/ca.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 4 genuine passive-voice rewrites (actor named — you, the swarm, nix); 3 false positives left untouched — a design-constraint description with no single correct actor across both provisioning modes ('is issued with pathlen:1'), a governance/definitional statement ('who is allowed to decide'), and the already-established predicate-adjective classification ('is misconfigured'). --- docs/swarm/ca.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md index 2f3239ec..ec21ec5d 100644 --- a/docs/swarm/ca.md +++ b/docs/swarm/ca.md @@ -52,8 +52,8 @@ and every client sees a name mismatch. It's deliberately not an assertion: this module can see what _it_ is able to issue, but not an operator-installed sub-CA in `swarm.ca.stateDir`, an external ACME setup, or a certificate delivered -by any other means. If you have arranged one, the warning is expected -and can be ignored. Otherwise either install the sub-CA, or pin the +by any other means. If you have arranged one, expect the warning and +ignore it. Otherwise either install the sub-CA, or pin the names back under the hive domain — a supported migration, since the sub-CA carries a name constraint on the _configured_ names and the swarm root carries no name constraints at all. @@ -62,8 +62,8 @@ swarm root carries no name constraints at all. The root's private key never reaches the nix store: the store is world-readable and content-addressed, so a key committed to a flake is a -key published to everyone who builds it. Only certificates are -distributed. +key published to everyone who builds it. The swarm distributes only +certificates. Each hive CA is **name-constrained** (X.509 `nameConstraints`) to that hive's own domain, so a hive CA that leaks can only mint names inside @@ -161,7 +161,7 @@ The root **certificate** is a runtime file as a _consequence_ — it lives beside the key under `swarm.ca.stateDir` — and that has a cost worth naming, because it's subtle and it bites at a distance: -> **Nothing whose trust store is assembled at build time can reference +> **Nothing whose trust store nix assembles at build time can reference > the swarm root.** The derivation reads `security.pki.certificateFiles` > inside itself; the root doesn't exist there.