vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs: clear write-good.Passive hits in docs/swarm/ca.md

Browse source 
4 genuine passive-voice rewrites (actor named — you, the swarm, nix);
3 false positives left untouched — a design-constraint description
with no single correct actor across both provisioning modes ('is
issued with pathlen:1'), a governance/definitional statement ('who is
allowed to decide'), and the already-established predicate-adjective
classification ('is misconfigured').
This commit is contained in:
iris 2026-09-20 13:25:43 +02:00 • committed by mara
commit d4f4691336
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/swarm/ca.md
View file

@ -52,8 +52,8 @@ and every client sees a name mismatch.
It's deliberately not an assertion: this module can see what _it_ is It's deliberately not an assertion: this module can see what _it_ is
able to issue, but not an operator-installed sub-CA in able to issue, but not an operator-installed sub-CA in
`swarm.ca.stateDir`, an external ACME setup, or a certificate delivered `swarm.ca.stateDir`, an external ACME setup, or a certificate delivered
by any other means. If you have arranged one, the warning is expected by any other means. If you have arranged one, expect the warning and
and can be ignored. Otherwise either install the sub-CA, or pin the ignore it. Otherwise either install the sub-CA, or pin the
names back under the hive domain — a supported migration, since the names back under the hive domain — a supported migration, since the
sub-CA carries a name constraint on the _configured_ names and the sub-CA carries a name constraint on the _configured_ names and the
swarm root carries no name constraints at all. swarm root carries no name constraints at all.
@ -62,8 +62,8 @@ swarm root carries no name constraints at all.
The root's private key never reaches the nix store: the store is The root's private key never reaches the nix store: the store is
world-readable and content-addressed, so a key committed to a flake is a world-readable and content-addressed, so a key committed to a flake is a
key published to everyone who builds it. Only certificates are key published to everyone who builds it. The swarm distributes only
distributed. certificates.
Each hive CA is **name-constrained** (X.509 `nameConstraints`) to that Each hive CA is **name-constrained** (X.509 `nameConstraints`) to that
hive's own domain, so a hive CA that leaks can only mint names inside hive's own domain, so a hive CA that leaks can only mint names inside
@ -161,7 +161,7 @@ The root **certificate** is a runtime file as a _consequence_ — it lives
beside the key under `swarm.ca.stateDir` — and that has a cost worth beside the key under `swarm.ca.stateDir` — and that has a cost worth
naming, because it's subtle and it bites at a distance: naming, because it's subtle and it bites at a distance:
> **Nothing whose trust store is assembled at build time can reference > **Nothing whose trust store nix assembles at build time can reference
> the swarm root.** The derivation reads `security.pki.certificateFiles` > the swarm root.** The derivation reads `security.pki.certificateFiles`
> inside itself; the root doesn't exist there. > inside itself; the root doesn't exist there.