Skip to content

Discard consensus if certificates can't be found.

If we try many times to find the certificates for a given consensus, and everybody tells us 404, then it's possible we've been lied to about the signing keys. But currently arti will just keep looking for the certificates forever.

Two answers here are:

  • remember where we got the consensus from, and ask that same source for the certificates we don't have. Mark it as very naughty if it can't tell us, and drop the consensus.
  • if we try a lot of times to get the certificates for a consensus, and everybody tells us "no cert with that signing key", then discard the consensus or try to get a new one.