How this was published

The pipeline

The source directory was walked deterministically: no timestamps, no inode order, no locale-sensitive sorting, so the same files always produce the same manifest. Each file was hashed. The built site was scanned and refused if any page reached for a third-party script, stylesheet or font, because every external request a published page makes is both a censorship lever and a record of who read it.

The blobs were fanned out to several blob servers in parallel. The manifest was then constructed, signed, and broadcast to a set of relays; the publisher confirmed which relays actually hold it before reporting success.

What failure looks like

Every stage fails closed. If too few providers accept the content, the publish stops and says so rather than reporting success over one replica. If the relay set is not diverse enough, it refuses to deploy at all. Nothing is signed until everything before it has succeeded.

Keeping it alive

Blob servers prune. Relays prune. Neither announces it. A site can decay quietly to one copy in one place while still looking healthy to whoever published it, so there is a daemon that audits every file against every provider, re-uploads what has fallen below the replication policy, and rebroadcasts the manifest to relays that dropped it. It holds no key: the manifest is already signed, so keeping a site alive never requires the signing key to come back online.

Back