Chio/Docs
LOGIN · JOIN

Revocation Checkpoints

Look up the fields, publication rules, and refusals of the signed checkpoint that carries revocation into a verifier's trust bundle.

Reference chio@5f63e6e

On this page

A revocation checkpoint is the revocation authority's signed list of revoked key fingerprints as of one epoch, and the authority's input to a verifier trust bundle.

Each checkpoint names the epoch it follows, so a verifier holding two can order them, and publication refuses an epoch that does not advance. A buyer's verifier reads the checkpoint inside the bundle and refuses a lease whose key fingerprint it revokes.

Synopsis

chio federation authority checkpoint reads the authority profile, the publication request, and the signing keys, and writes one signed checkpoint.

Terminalbash
chio federation authority checkpoint \
  --profile profile.json --revocations revocations.json \
  --signing-keys signing-keys.json --out checkpoint.json

Publication request fields

The request is a RevocationPublicationRequest under the schema chio.federation.revocation-publication-request.v1.

schema

stringSchema id

The request schema id.

Example"chio.federation.revocation-publication-request.v1"

checkpointId

stringIdentifier

The checkpoint's identifier.

issuedAtUnixMs, expiresAtUnixMs

integerUnix milliseconds

The window the checkpoint is valid in. It lies inside the revocation authority's own validity window.

epochHeight

integerEpoch

The epoch this checkpoint publishes. It exceeds previousEpochHeight whenever that field is present.

previousEpochHeight

integerAbsent for the first checkpoint

The epoch this checkpoint follows.

revokedKeyFingerprints[]

arrayKey fingerprints

The key fingerprints revoked as of this epoch.

Signed checkpoint

The command writes a SignedChioRevocationCheckpoint under chio.federation.revocation-checkpoint.v1, signed by the profile's revocation authority. Its top-level keys are body, signature, and signerKey.

Publication rules

  • epochHeight exceeds previousEpochHeight when the latter is present. A request that repeats or lowers the epoch is refused with revocation checkpoint epoch must be monotonic.
  • The revocation authority is active, and the checkpoint's window lies inside the authority's validity window. Either failure is refused as Issuance.
  • The revocation seed derives the profile's declared revocation key.

Examples

Both runs use the authority inputs from the federation guide project; the second request repeats the epoch of the first.

Publish the checkpoint with the CLI

Terminalbash
chio federation authority checkpoint --profile authority-inputs/profile.json --revocations authority-inputs/revocations.json --signing-keys authority-inputs/signing-keys.json --out authority-inputs/cli-checkpoint.json
jq 'keys' authority-inputs/cli-checkpoint.json
Output · exit 0
[
  "body",
  "signature",
  "signerKey"
]

Refuse a checkpoint whose epoch does not advance

Terminalbash
chio federation authority checkpoint --profile authority-inputs/profile.json --revocations authority-inputs/revocations-stalled.json --signing-keys authority-inputs/signing-keys.json --out authority-inputs/never-written.json
Output · exit 1

error[CHIO-DELEGATION-REVOCATION-EPOCH-NOT-MONOTONIC]: revocation checkpoint publication failed: the epoch is not greater than the last published epoch
  help: publish a checkpoint whose epoch is greater than the last published one
  code: urn:chio:error:delegation:revocation-epoch-not-monotonic
  docs: https://chio.computer/docs/reference/errors#error-delegation-revocation-epoch-not-monotonic

Exit 1 is the expected refusal. A shell running with set -e stops at this command, so run it on its own.

Trust bundle input

The signed checkpoint is one of the five inputs to trust-bundle assemble, beside the authority profile, the peer pins, the workflow intersection, and the disclosure policy (Peer Pins & Trust Bundles). A verifier holding the bundle refuses a lease whose key fingerprint the checkpoint revokes. Assemble the bundle from the checkpoint the first example wrote:

Assemble the verifier trust bundle with the CLI

Terminalbash
chio federation authority trust-bundle assemble --profile authority-inputs/profile.json --peer-pins authority-inputs/peer-pins.json --workflow-intersection authority-inputs/workflow-intersection.json --disclosure-policy authority-inputs/disclosure-policy.json --checkpoint authority-inputs/cli-checkpoint.json --out authority-inputs/cli-trust-bundle.json
jq '.schema' authority-inputs/cli-trust-bundle.json
Output · exit 0
"chio.federation.verifier-trust-bundle.v1"
Source file

The checkpoint type and its publication checks are in crates/trust/chio-attest-buyer-core/src/revocation.rs.

Next: follow a revocation between operators

Revocation oracleCarry signed revocation roots to a partner's kernel and refuse at its door.Revocation propagationSpread a revocation across the nodes of one operator.Revocation storeRead how a node keeps and checks revoked capabilities.
PreviousRevocation OracleNextShare Evidence with a Partner