Publish IPNS names using a signature instead of private key

[dogada]

To use /api/v0/name/publish I need to import private key to node first. For scenarios like in https://github.com/ipfs-shipyard/js-did-ipid I will prefer to keep my private key in wallet and sent to HTTP API an signature as proof of ownership of this key. So the IPFS node will not have access to private key but will be able to publish IPNS names still.

[johnnymatthews]

Hi @dogada. Thanks for this comment. This sounds like a feature request for Go-IPFS, rather that a docs task. Or am I misunderstanding your comment?

[dogada]

Hi, I added it here because IMO this feature should be added to the API first and then to all implementations (go-ipfs and js-ipfs). Not sure what is the best place for it.

…

-Dima.

On Mon, Nov 8, 2021 at 7:47 PM Johnny ***@***.***> wrote: Hi @dogada <https://github.com/dogada>. Thanks for this comment. This sounds like a feature request for Go-IPFS, rather that a docs task. Or am I misunderstanding your comment? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <https://github.com/ipfs/ipfs-docs/issues/931#issuecomment-963406965>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AANUCWIJQ3SLS7KHHHWKKWLULAEJ7ANCNFSM5HORIQ7A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[Stebalien]

This is already possible by sending a request to ipfs dht put. However:

1. This won't (and can't) republish records when they expire.
2. You'll need to manually construct your IPNS record.

[dogada]

Thanks, interesting. Manually construct your IPNS record is ok. I didn't understand however why I can't republish the record? Can I manually call ipfs dht put with new timestamp every 12 hours for example?

[aschmahmann]

I didn't understand however why I can't republish the record? Can I manually call ipfs dht put

Sort of

with new timestamp every 12 hours for example?

No

---

@dogada you can do it situationally. If the reason you are republishing your record is because the DHT servers have a maximum duration they'll keep your record for (currently 36hr) then you can just call ipfs dht put with the record again. However, if you are republishing because the lifetime of the record expired then you need to create a new signed record.

While you could have a very large record lifetime there are some tradeoffs involved in that in a non-consensus network it's possible a user could end up with an older record and think it's the latest. For example, if nobody publishes your record into the DHT for a week, then someone publishes a record from last year that still has a valid lifetime new users might end up seeing the record from last year. How the tradeoffs are balanced here is pretty situational.

[dogada]

Thanks @aschmahmann, I understand the tradeoffs and the reason for the maximum lifetime of the record, but what is recommended approach to link a permanent name to the actual CID. Say, I can update my blog, stored in IPFS, once a week, and hence I need to change IPNS binding each time I obtain new blog's CID. Then I need to republish IPNS record in DHT every 36 hours? From end-user perspective it may be easy to use DNSLink and point domain to a CID directly (/ipfs/$CID) than to IPNS link (/ipns/$HASH). What do you think?

[T0admomo]

The combined limitation of both forced 36 hours renewal and requiring the original publisher be online in order to renew creates a bottleneck on the usefulness of IPNS in my opinion, and clearly creates a single point of failure. Has the possibility been considered of configuring an approved peer list of signers who can also renew the IPNS record in case the original publisher is offline? Or can this otherwise be circumvented by running ipfs-clusters?