Skip to content
NOQTIS

nqdchain(3)

nqdchain — check an append-only chain of capsules

libnqd, -lnqd -lnoqtis

#include <nqd.h>

int
nqdchain(const char *const *dirs, size_t n, const nqcopt *o, uint8_t head[32], nqdrep **rep);

A chain is a log of capsules to which a link is only ever added: the first sealed in format 2, each after it sealed with the one before as its only input (nqseal2(3), ‘noqtis seal --input’), so that the seal of each signs the id of the last. () checks the n capsule folders dirs, oldest first:

  • each checks as nqchkx(3) checks it with o (its trusted key, anchors and key statements; o->only and o->lin are not used; o may be NULL);
  • each after the first lists exactly one input, the id (nqcapid(3)) of the one before it, read from its manifest and bound to its seal: the bytes the seal signs must hash to the capsule's id;
  • every link is sealed by the key of the first.

The first link's own inputs are not followed, so a chain can be checked from any link on. Unlike o->lin, which follows inputs as a tree to 64 levels, a chain is checked one link at a time, at any length.

The report has a ‘link’ row per link and per failure, a ‘key’ row and, when every row passed, a ‘head’ row with the last link's id in hex, which head then holds; otherwise head is zeros.

NQOK when every row passed, NQEVRFY otherwise; *rep is set in both cases (nqdchk(3)). NQEARG for n 0 or a NULL argument; NQEMEM.

noqtis-chain(1), noqtis-seal(1), nqchkx(3), nqseal2(3), noqtis-capsule(5)