signed-seed-list

A signed, versioned bootstrap seed-list format for P2P node discovery, meant to be carried identically over any distribution rung: a manually-entered setting, a raw HTTP/GitHub file, a DNS TXT record, a QR code, or a default embedded in the binary.

import seeds "forgejo.jiggl.in/libraries/signed-seed-list"

What it does

• List is the signed payload: a sequence number, an expiry, and a set of address strings (e.g. libp2p multiaddrs — the format doesn't care what the address strings mean to your application).
• Sign / Verify wrap the payload in an ed25519 signature. Verify checks the signature, rejects expired lists, and rejects lists whose sequence number isn't strictly newer than the last one you accepted (so a forged or replayed old list can't roll a node backward).
• HTTPSource and DNSSource implement Source, fetching a raw payload from an HTTP URL or a DNS TXT record respectively. FetchBest takes any number of Sources, fetches and verifies each, and returns the highest valid sequence number found across all of them.
• Embedded / VerifiedEmbedded read a go:embed-baked default list from defaults/seeds.json, for the case where every other source is unreachable. The file shipped in this repo is an inert placeholder (expired, unsigned) — replace it with your own signed list before relying on it.

Trust model

A seed list only tells a new node where to start looking for peers. Whatever protocol runs after discovery is responsible for verifying peers/data on its own merits — this library's job is narrower: keep a compromised carrier (a hijacked GitHub repo, a hijacked DNS zone) from silently steering nodes to an attacker-controlled address, and keep an old, revoked, or rolled-back list from being replayed. Signing is ed25519 with the verify key embedded in your own binary (minisign-style, not GPG); there's no key distribution or trust-chain machinery here.

Extracted from

This library started as kreeader-server's components/distributed/seeds package and was pulled out once it proved genuinely reusable — no kreeader-specific coupling in the extracted code.