Update transactions.md document #553

akarabashov · 2024-03-20T08:06:56Z

No description provided.

ashcherbakov · 2024-03-20T09:07:58Z

docs/transactions.md

  - time: `optional(int64)` - proposal time (number of nanoseconds elapsed since January 1, 1970 UTC). CLI uses the current time for that field.
+  - vid: `uint16` -  Vendor ID (positive non-zero). Must be the same as Vendor account's VID. The value must be within the range of 1 to 65535.


Please mention that it must be equal to the Certificate's VID for VID scope certificates.

ashcherbakov · 2024-03-20T09:26:01Z

docs/transactions.md

@@ -903,8 +906,6 @@ The certificate is not reject until sufficient number of Trustees reject it.
 Adds an intermediate or leaf X509 certificate signed by a chain of certificates which must be
 already present on the ledger.

-The certificate is immutable. It can only be revoked by either the owner or a quorum of Trustees.
-
 - Who can send: Vendor account
  - PAA (Root certificates) are VID-scoped:


Maybe move this paragraph to Validation?
Also I think it needs to be clarified.
For example, it's not clear what does "PAA (Root certificates) are VID-scoped" mean.
I would writ something like

If parent root certificate is VID scoped:

cert must be VID scoped

vid in the subject of the root certificate must be equal to the the vid in the subject of the cert

vid in the certificate subjects must be equal to the sender Vendor account's VID

If parent root certificate is not VID scoped, but has an associated VID

cert can be either VID scoped or non-VID scoped

if cert is VID scoped, vid in the subject of the cert must be equal to the VID associated with the root certificate, as well as to the sender Vendor account's VID

If parent root certificate is non VID scoped and doesn't have an associated VID - error

ashcherbakov · 2024-03-20T09:27:27Z

docs/transactions.md

@@ -925,9 +926,10 @@ The certificate is immutable. It can only be revoked by either the owner or a qu
  - no existing certificate with the same `<Certificate's Issuer>:<Certificate's Serial Number>` combination.
  - if certificates with the same `<Certificate's Subject>:<Certificate's Subject Key ID>` combination already exist:
    - the existing certificate must not be NOC certificate
-    - the sender's VID must match the `vid` field of the existing certificates.
+    - the sender's VID must match the VID of the existing certificate's owner.
  - the signature (self-signature) and expiration date are valid.


We can't have self-signature for Intermediate/Leaf certs

ashcherbakov · 2024-03-20T09:29:59Z

docs/transactions.md

@@ -903,8 +906,6 @@ The certificate is not reject until sufficient number of Trustees reject it.
 Adds an intermediate or leaf X509 certificate signed by a chain of certificates which must be


I think it would be great to add some description to distinguish these certificates from NOC/ICA certificates.

ashcherbakov · 2024-03-20T10:01:29Z

docs/transactions.md

@@ -827,13 +827,14 @@ will be in a pending state until sufficient number of approvals is received.

 The certificate is immutable. It can only be revoked by either the owner or a quorum of Trustees.



What if we rename the commands as follows:

X509 PKI

Device Attestation Certificates (DA)

PROPOSE_ADD_PAA

APPROVE_ADD_PAA

REJECT_ADD_PAA

PROPOSE_REVOKE_PAA

APPROVE_REVOKE_PAA

ASSIGN_VID_TO_PAA

ADD_REVOCATION_DISTRIBUTION_POINT

UPDATE_REVOCATION_DISTRIBUTION_POINT

DELETE_REVOCATION_DISTRIBUTION_POINT

ADD_PAI

REVOKE_PAI

REMOVE_PAI

GET_REVOCATION_DISTRIBUTION_POINT

GET_REVOCATION_DISTRIBUTION_POINT_BY_SKID

GET_ALL_REVOCATION_DISTRIBUTION_POINT

GET_PROPOSED_PAA

GET_REJECTED_PAA

GET_PROPOSED_REVOKE_PAA

GET_ALL_PAA

GET_ALL_REVOKED_PAA

GET_ALL_PROPOSED_PAA

GET_ALL_REJECTED_PAA

GET_ALL_PROPOSED_REVOKE_PAA

E2E (NOC)

ADD_NOC_ROOT

REVOKE_NOC_ROOT

ADD_NOC_ICA

GET_NOC_ROOT_BY_VID

GET_NOC_ICA_BY_VID

GET_REVOKED_NOC_ROOT

GET_ALL_NOC_ROOT

GET_ALL_NOC_ICA

GET_ALL_REVOKED_NOC_ROOT

Common

GET_CERT

GET_REVOKED_CERT

GET_CERTS_BY_SKID

GET_CERTS_BY_SUBJECT

GET_CHILD_CERTS

GET_ALL_CERTS

GET_ALL_REVOKED_CERTS

ashcherbakov · 2024-03-20T10:02:34Z

docs/transactions.md

-  - `pki/NOCCertificates/value/<VID>`
-  - `pki/ChildCertificates/value/<Certificate's Subject>/<Certificate's Subject Key ID>`
- CLI Command:
-  - `dcld tx pki add-noc-x509-cert --certificate=<string-or-path> --from=<account>`



Please rename NOC to NOC_ROOT and non-root NOC to NOC_ICA (in doc, code, state, CLI command).

This will be implemented in a separate pull request.

# Conflicts: # docs/transactions.md

ashcherbakov · 2024-03-27T10:05:03Z

docs/transactions.md


 **Status: Implemented**

-Proposes a new self-signed root certificate.
+Proposes a new PAA certificate.


Please clarify that a PAA is a root self-signed certificate.

ashcherbakov · 2024-03-27T10:08:34Z

docs/transactions.md

-### REVOKE_NOC_X509_ROOT_CERT
+> **_Note:_**  Multiple certificates can refer to the same `<Certificate's Subject>:<Certificate's Subject Key ID>` combination.
+
+#### REVOKE_PAI


Please add a clarification how it's different from REMOVE_PAI

ashcherbakov · 2024-03-27T10:08:47Z

docs/transactions.md


-### GET_ALL_SUBJECT_X509_CERTS
+#### REMOVE_PAI


Please add a clarification how it's different from REVOKE_PAI

ashcherbakov · 2024-03-27T10:13:21Z

docs/transactions.md


-### GET_PKI_REVOCATION_DISTRIBUTION_POINTS_BY_SUBJECT_KEY_ID
+#### REVOKE_NOC_ROOT


Please clarify that revoke here means soft-delete (revoke certificates can be queried)

ashcherbakov · 2024-03-27T10:13:40Z

docs/transactions.md

+- CLI Command:
+  - `dcld tx pki add-noc-x509-cert --certificate=<string-or-path> --from=<account>`
+
+#### REVOKE_NOC_ICA


Please clarify that revoke here means soft-delete (revoke certificates can be queried)

ashcherbakov · 2024-03-27T10:14:54Z

docs/transactions.md

+- REST API:
+  - GET `/dcl/pki/revoked-certificates/{subject}/{subject_key_id}`
+
+#### GET_CERTS_BY_SKID


Please clarify that it works for all types of certificates (PAA, PAI, NOC_ROOT, NOC_ICA).

ashcherbakov · 2024-03-27T10:15:05Z

docs/transactions.md

+- REST API:
+  - GET `/dcl/pki/certificates?subjectKeyId={subjectKeyId}`
+
+#### GET_CERTS_BY_SUBJECT


Please clarify that it works for all types of certificates (PAA, PAI, NOC_ROOT, NOC_ICA).

ashcherbakov · 2024-03-27T10:15:09Z

docs/transactions.md

+- REST API:
+  - GET `/dcl/pki/certificates/{subject}`
+
+#### GET_CHILD_CERTS


Please clarify that it works for all types of certificates (PAA, PAI, NOC_ROOT, NOC_ICA).

ashcherbakov · 2024-03-27T10:15:21Z

docs/transactions.md

+- REST API:
+  - GET `/dcl/pki/child-certificates/{subject}/{subject_key_id}`
+
+#### GET_ALL_CERTS


Please clarify that it returns all certificates (PAA, PAI, NOC_ROOT, NOC_ICA).

ashcherbakov · 2024-03-27T10:15:42Z

docs/transactions.md

+- REST API:
+  - GET `/dcl/pki/certificates`
+
+#### GET_ALL_REVOKED_CERTS


Please clarify that it returns all revoked certificates (PAA, PAI, NOC_ROOT, NOC_ICA).

akarabashov added 2 commits March 19, 2024 19:13

Update transactions specification

e2cf9a4

Merge branch 'master' into improve_transaction_document

d034128

akarabashov requested a review from ashcherbakov March 20, 2024 08:07

ashcherbakov reviewed Mar 20, 2024

View reviewed changes

This comment was marked as off-topic.

Sign in to view

akarabashov added 6 commits March 24, 2024 16:04

Update transactions.md according to PR feedback

a623c1a

Merge branch 'master' into improve_transaction_document

287a31f

# Conflicts: # docs/transactions.md

Format transactions.md document

2ba0371

Remove typo

bbf7ab8

Merge branch 'master' into improve_transaction_document

91ce7e8

Clarify approve transactions

76704c0

ashcherbakov reviewed Mar 27, 2024

View reviewed changes

Clarify transactions and queries

9703e38

ashcherbakov approved these changes Apr 3, 2024

View reviewed changes

akarabashov merged commit 17e3203 into master Apr 3, 2024
8 checks passed

akarabashov deleted the improve_transaction_document branch April 11, 2024 06:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update transactions.md document #553

Update transactions.md document #553

akarabashov commented Mar 20, 2024

ashcherbakov Mar 20, 2024

akarabashov Mar 26, 2024

ashcherbakov Mar 20, 2024

akarabashov Mar 26, 2024

ashcherbakov Mar 20, 2024

akarabashov Mar 26, 2024

ashcherbakov Mar 20, 2024

ashcherbakov Mar 20, 2024 •

edited

Loading

akarabashov Mar 26, 2024

ashcherbakov Mar 20, 2024 •

edited

Loading

akarabashov Mar 26, 2024

This comment was marked as off-topic.

ashcherbakov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

akarabashov Mar 27, 2024

ashcherbakov Mar 27, 2024

		- time: `optional(int64)` - proposal time (number of nanoseconds elapsed since January 1, 1970 UTC). CLI uses the current time for that field.
		- vid: `uint16` - Vendor ID (positive non-zero). Must be the same as Vendor account's VID. The value must be within the range of 1 to 65535.

		@@ -903,8 +906,6 @@ The certificate is not reject until sufficient number of Trustees reject it.
		Adds an intermediate or leaf X509 certificate signed by a chain of certificates which must be

		@@ -827,13 +827,14 @@ will be in a pending state until sufficient number of approvals is received.

		The certificate is immutable. It can only be revoked by either the owner or a quorum of Trustees.


		### GET_PKI_REVOCATION_DISTRIBUTION_POINTS_BY_SUBJECT_KEY_ID
		#### REVOKE_NOC_ROOT

Update transactions.md document #553

Update transactions.md document #553

Conversation

akarabashov commented Mar 20, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ashcherbakov Mar 20, 2024 • edited Loading

Choose a reason for hiding this comment

X509 PKI

Device Attestation Certificates (DA)

PROPOSE_ADD_PAA

APPROVE_ADD_PAA

REJECT_ADD_PAA

PROPOSE_REVOKE_PAA

APPROVE_REVOKE_PAA

ASSIGN_VID_TO_PAA

ADD_REVOCATION_DISTRIBUTION_POINT

UPDATE_REVOCATION_DISTRIBUTION_POINT

DELETE_REVOCATION_DISTRIBUTION_POINT

ADD_PAI

REVOKE_PAI

REMOVE_PAI

GET_REVOCATION_DISTRIBUTION_POINT

GET_REVOCATION_DISTRIBUTION_POINT_BY_SKID

GET_ALL_REVOCATION_DISTRIBUTION_POINT

GET_PROPOSED_PAA

GET_REJECTED_PAA

GET_PROPOSED_REVOKE_PAA

GET_ALL_PAA

GET_ALL_REVOKED_PAA

GET_ALL_PROPOSED_PAA

GET_ALL_REJECTED_PAA

GET_ALL_PROPOSED_REVOKE_PAA

E2E (NOC)

ADD_NOC_ROOT

REVOKE_NOC_ROOT

ADD_NOC_ICA

GET_NOC_ROOT_BY_VID

GET_NOC_ICA_BY_VID

GET_REVOKED_NOC_ROOT

GET_ALL_NOC_ROOT

GET_ALL_NOC_ICA

GET_ALL_REVOKED_NOC_ROOT

Common

GET_CERT

GET_REVOKED_CERT

GET_CERTS_BY_SKID

GET_CERTS_BY_SUBJECT

GET_CHILD_CERTS

GET_ALL_CERTS

GET_ALL_REVOKED_CERTS

Choose a reason for hiding this comment

ashcherbakov Mar 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

This comment was marked as off-topic.

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ashcherbakov Mar 20, 2024 •

edited

Loading

ashcherbakov Mar 20, 2024 •

edited

Loading