vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs: clear write-good.Passive hits in docs/swarm/ca.md

Browse source 
4 genuine passive-voice rewrites (actor named — you, the swarm, nix);
3 false positives left untouched — a design-constraint description
with no single correct actor across both provisioning modes ('is
issued with pathlen:1'), a governance/definitional statement ('who is
allowed to decide'), and the already-established predicate-adjective
classification ('is misconfigured').
This commit is contained in:
iris 2026-09-20 13:25:43 +02:00 • committed by mara
commit d4f4691336
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/swarm/ca.md
View file

@ -52,8 +52,8 @@ and every client sees a name mismatch.
It's deliberately not an assertion: this module can see what _it_ is
able to issue, but not an operator-installed sub-CA in
`swarm.ca.stateDir`, an external ACME setup, or a certificate delivered
by any other means. If you have arranged one, the warning is expected
and can be ignored. Otherwise either install the sub-CA, or pin the
by any other means. If you have arranged one, expect the warning and
ignore it. Otherwise either install the sub-CA, or pin the
names back under the hive domain — a supported migration, since the
sub-CA carries a name constraint on the _configured_ names and the
swarm root carries no name constraints at all.
@ -62,8 +62,8 @@ swarm root carries no name constraints at all.
The root's private key never reaches the nix store: the store is
world-readable and content-addressed, so a key committed to a flake is a
key published to everyone who builds it. Only certificates are
distributed.
key published to everyone who builds it. The swarm distributes only
certificates.
Each hive CA is **name-constrained** (X.509 `nameConstraints`) to that
hive's own domain, so a hive CA that leaks can only mint names inside
@ -161,7 +161,7 @@ The root **certificate** is a runtime file as a _consequence_ — it lives
beside the key under `swarm.ca.stateDir` — and that has a cost worth
naming, because it's subtle and it bites at a distance:
> **Nothing whose trust store is assembled at build time can reference
> **Nothing whose trust store nix assembles at build time can reference
> the swarm root.** The derivation reads `security.pki.certificateFiles`
> inside itself; the root doesn't exist there.