{"action":"created","comment":{"url":"https://api.github.com/repos/corda/corda/pulls/comments/225613300","pull_request_review_id":165246544,"id":225613300,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIyNTYxMzMwMA==","diff_hunk":"@@ -36,22 +42,121 @@ UNRELEASED\n \n <<< Fill this in >>>\n \n-* Database upgrade - Change the type of the ``checkpoint_value``.\n-This will address the issue that the `vacuum` function is unable to clean up deleted checkpoints as they are still referenced from the ``pg_shdepend`` table.\n+FinalityFlow\n+^^^^^^^^^^^^\n+\n+The previous ``FinalityFlow`` API is insecure. It requires a handler flow in the counterparty node which accepts any and\n+all signed transactions that are sent to it, without checks. It is **highly** recommended that existing CorDapps migrate\n+away to the new API.\n+\n+Let's take a very simple flow that finalises a transaction without the involvement of a counterpart flow:\n+\n+.. container:: codeset\n+\n+    .. literalinclude:: example-code/src/main/kotlin/net/corda/docs/kotlin/FinalityFlowMigration.kt\n+        :language: kotlin\n+        :start-after: DOCSTART SimpleFlowUsingOldApi\n+        :end-before: DOCEND SimpleFlowUsingOldApi\n+\n+    .. literalinclude:: example-code/src/main/java/net/corda/docs/java/FinalityFlowMigration.java\n+        :language: java\n+        :start-after: DOCSTART SimpleFlowUsingOldApi\n+        :end-before: DOCEND SimpleFlowUsingOldApi\n+        :dedent: 4\n+\n+This needs to be annotated with ``InitiatingFlow`` and a ``FlowSession`` to the participant of the transaction must be\n+passed to ``FinalityFlow`` :\n+\n+.. container:: codeset\n+\n+    .. literalinclude:: example-code/src/main/kotlin/net/corda/docs/kotlin/FinalityFlowMigration.kt\n+        :language: kotlin\n+        :start-after: DOCSTART SimpleFlowUsingNewApi\n+        :end-before: DOCEND SimpleFlowUsingNewApi\n+\n+    .. literalinclude:: example-code/src/main/java/net/corda/docs/java/FinalityFlowMigration.java\n+        :language: java\n+        :start-after: DOCSTART SimpleFlowUsingNewApi\n+        :end-before: DOCEND SimpleFlowUsingNewApi\n+        :dedent: 4\n+\n+If there are more than one transaction participants then a session to each one must be initiated, excluding the local party\n+and the notary.\n+\n+The responder flow, which will automically run on the other participants' nodes, just has to call ``ReceiveFinalityFlow``\n+to record the finalised transaction:\n+\n+.. container:: codeset\n+\n+    .. literalinclude:: example-code/src/main/kotlin/net/corda/docs/kotlin/FinalityFlowMigration.kt\n+        :language: kotlin\n+        :start-after: DOCSTART SimpleNewResponderFlow\n+        :end-before: DOCEND SimpleNewResponderFlow\n+\n+    .. literalinclude:: example-code/src/main/java/net/corda/docs/java/FinalityFlowMigration.java\n+        :language: java\n+        :start-after: DOCSTART SimpleNewResponderFlow\n+        :end-before: DOCEND SimpleNewResponderFlow\n+        :dedent: 4\n+\n+For flows which are already initiating counterpart flows then it's a simple matter of using the exising flow session.\n+Note however, the new ``FinalityFlow`` is inlined and so the sequence of sends and receives between the two flows will\n+change and will be incompatible with your current flows. You can use the flow version API to write your flows in a\n+backwards compatible way.\n+\n+Here's what an upgraded initiating flow may look like:\n+\n+.. container:: codeset\n+\n+    .. literalinclude:: example-code/src/main/kotlin/net/corda/docs/kotlin/FinalityFlowMigration.kt\n+        :language: kotlin\n+        :start-after: DOCSTART ExistingInitiatingFlow","path":"docs/source/upgrade-notes.rst","position":84,"original_position":84,"commit_id":"d69d78bd331ddc9dcfffaf533daeb2cb44dfc20e","original_commit_id":"d69d78bd331ddc9dcfffaf533daeb2cb44dfc20e","user":{"login":"josecoll","id":23558646,"node_id":"MDQ6VXNlcjIzNTU4NjQ2","avatar_url":"https://avatars0.githubusercontent.com/u/23558646?v=4","gravatar_id":"","url":"https://api.github.com/users/josecoll","html_url":"https://github.com/josecoll","followers_url":"https://api.github.com/users/josecoll/followers","following_url":"https://api.github.com/users/josecoll/following{/other_user}","gists_url":"https://api.github.com/users/josecoll/gists{/gist_id}","starred_url":"https://api.github.com/users/josecoll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josecoll/subscriptions","organizations_url":"https://api.github.com/users/josecoll/orgs","repos_url":"https://api.github.com/users/josecoll/repos","events_url":"https://api.github.com/users/josecoll/events{/privacy}","received_events_url":"https://api.github.com/users/josecoll/received_events","type":"User","site_admin":false},"body":"I would call this the `NewInitiatingFlow` and `NewResponderFlow` (but I guess it depends how you look at it ;-)","created_at":"2018-10-16T16:23:41Z","updated_at":"2018-10-16T16:39:49Z","html_url":"https://github.com/corda/corda/pull/4050#discussion_r225613300","pull_request_url":"https://api.github.com/repos/corda/corda/pulls/4050","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/corda/corda/pulls/comments/225613300"},"html":{"href":"https://github.com/corda/corda/pull/4050#discussion_r225613300"},"pull_request":{"href":"https://api.github.com/repos/corda/corda/pulls/4050"}}},"pull_request":{"url":"https://api.github.com/repos/corda/corda/pulls/4050","id":221376756,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIxMzc2NzU2","html_url":"https://github.com/corda/corda/pull/4050","diff_url":"https://github.com/corda/corda/pull/4050.diff","patch_url":"https://github.com/corda/corda/pull/4050.patch","issue_url":"https://api.github.com/repos/corda/corda/issues/4050","number":4050,"state":"open","locked":false,"title":"CORDA-2005: FinalityFlow has been made into an inlined flow to resolve issue with FinalityHandler","user":{"login":"shamsasari","id":3883563,"node_id":"MDQ6VXNlcjM4ODM1NjM=","avatar_url":"https://avatars3.githubusercontent.com/u/3883563?v=4","gravatar_id":"","url":"https://api.github.com/users/shamsasari","html_url":"https://github.com/shamsasari","followers_url":"https://api.github.com/users/shamsasari/followers","following_url":"https://api.github.com/users/shamsasari/following{/other_user}","gists_url":"https://api.github.com/users/shamsasari/gists{/gist_id}","starred_url":"https://api.github.com/users/shamsasari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shamsasari/subscriptions","organizations_url":"https://api.github.com/users/shamsasari/orgs","repos_url":"https://api.github.com/users/shamsasari/repos","events_url":"https://api.github.com/users/shamsasari/events{/privacy}","received_events_url":"https://api.github.com/users/shamsasari/received_events","type":"User","site_admin":false},"body":"FinalityHandler is insecure in that it is open to receive any transaction from any party.\r\n\r\nAny CorDapp targeting platform version 4 or above is required use the new c'tors which take in FlowSession objects to the counterpart flow. This flow must subcall ReceiveFinalityFlow to receive and record the finalised transaction.\r\n\r\nOld CorDapps (with target platform version < 4) will continue to work as previously. However if there are no old CorDapps loaded then the node will disable FinalityHandler.\r\n","created_at":"2018-10-09T09:57:14Z","updated_at":"2018-10-16T16:39:49Z","closed_at":null,"merged_at":null,"merge_commit_sha":"da12c1da53eb5677964489dbf2218ed654f8eaa1","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/corda/corda/pulls/4050/commits","review_comments_url":"https://api.github.com/repos/corda/corda/pulls/4050/comments","review_comment_url":"https://api.github.com/repos/corda/corda/pulls/comments{/number}","comments_url":"https://api.github.com/repos/corda/corda/issues/4050/comments","statuses_url":"https://api.github.com/repos/corda/corda/statuses/d69d78bd331ddc9dcfffaf533daeb2cb44dfc20e","head":{"label":"corda:shams-finality-flow-fix","ref":"shams-finality-flow-fix","sha":"d69d78bd331ddc9dcfffaf533daeb2cb44dfc20e","user":{"login":"corda","id":22600631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNjAwNjMx","avatar_url":"https://avatars1.githubusercontent.com/u/22600631?v=4","gravatar_id":"","url":"https://api.github.com/users/corda","html_url":"https://github.com/corda","followers_url":"https://api.github.com/users/corda/followers","following_url":"https://api.github.com/users/corda/following{/other_user}","gists_url":"https://api.github.com/users/corda/gists{/gist_id}","starred_url":"https://api.github.com/users/corda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/corda/subscriptions","organizations_url":"https://api.github.com/users/corda/orgs","repos_url":"https://api.github.com/users/corda/repos","events_url":"https://api.github.com/users/corda/events{/privacy}","received_events_url":"https://api.github.com/users/corda/received_events","type":"Organization","site_admin":false},"repo":{"id":70137417,"node_id":"MDEwOlJlcG9zaXRvcnk3MDEzNzQxNw==","name":"corda","full_name":"corda/corda","private":false,"owner":{"login":"corda","id":22600631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNjAwNjMx","avatar_url":"https://avatars1.githubusercontent.com/u/22600631?v=4","gravatar_id":"","url":"https://api.github.com/users/corda","html_url":"https://github.com/corda","followers_url":"https://api.github.com/users/corda/followers","following_url":"https://api.github.com/users/corda/following{/other_user}","gists_url":"https://api.github.com/users/corda/gists{/gist_id}","starred_url":"https://api.github.com/users/corda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/corda/subscriptions","organizations_url":"https://api.github.com/users/corda/orgs","repos_url":"https://api.github.com/users/corda/repos","events_url":"https://api.github.com/users/corda/events{/privacy}","received_events_url":"https://api.github.com/users/corda/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/corda/corda","description":"Corda is an open source blockchain project, designed for business from the start. Only Corda allows you to build interoperable blockchain networks that transact in strict privacy. Corda's smart contract technology allows businesses to transact directly, with value.","fork":false,"url":"https://api.github.com/repos/corda/corda","forks_url":"https://api.github.com/repos/corda/corda/forks","keys_url":"https://api.github.com/repos/corda/corda/keys{/key_id}","collaborators_url":"https://api.github.com/repos/corda/corda/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/corda/corda/teams","hooks_url":"https://api.github.com/repos/corda/corda/hooks","issue_events_url":"https://api.github.com/repos/corda/corda/issues/events{/number}","events_url":"https://api.github.com/repos/corda/corda/events","assignees_url":"https://api.github.com/repos/corda/corda/assignees{/user}","branches_url":"https://api.github.com/repos/corda/corda/branches{/branch}","tags_url":"https://api.github.com/repos/corda/corda/tags","blobs_url":"https://api.github.com/repos/corda/corda/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/corda/corda/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/corda/corda/git/refs{/sha}","trees_url":"https://api.github.com/repos/corda/corda/git/trees{/sha}","statuses_url":"https://api.github.com/repos/corda/corda/statuses/{sha}","languages_url":"https://api.github.com/repos/corda/corda/languages","stargazers_url":"https://api.github.com/repos/corda/corda/stargazers","contributors_url":"https://api.github.com/repos/corda/corda/contributors","subscribers_url":"https://api.github.com/repos/corda/corda/subscribers","subscription_url":"https://api.github.com/repos/corda/corda/subscription","commits_url":"https://api.github.com/repos/corda/corda/commits{/sha}","git_commits_url":"https://api.github.com/repos/corda/corda/git/commits{/sha}","comments_url":"https://api.github.com/repos/corda/corda/comments{/number}","issue_comment_url":"https://api.github.com/repos/corda/corda/issues/comments{/number}","contents_url":"https://api.github.com/repos/corda/corda/contents/{+path}","compare_url":"https://api.github.com/repos/corda/corda/compare/{base}...{head}","merges_url":"https://api.github.com/repos/corda/corda/merges","archive_url":"https://api.github.com/repos/corda/corda/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/corda/corda/downloads","issues_url":"https://api.github.com/repos/corda/corda/issues{/number}","pulls_url":"https://api.github.com/repos/corda/corda/pulls{/number}","milestones_url":"https://api.github.com/repos/corda/corda/milestones{/number}","notifications_url":"https://api.github.com/repos/corda/corda/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/corda/corda/labels{/name}","releases_url":"https://api.github.com/repos/corda/corda/releases{/id}","deployments_url":"https://api.github.com/repos/corda/corda/deployments","created_at":"2016-10-06T08:46:29Z","updated_at":"2018-10-16T15:53:01Z","pushed_at":"2018-10-16T15:41:15Z","git_url":"git://github.com/corda/corda.git","ssh_url":"git@github.com:corda/corda.git","clone_url":"https://github.com/corda/corda.git","svn_url":"https://github.com/corda/corda","homepage":"https://www.corda.net","size":164486,"stargazers_count":2367,"watchers_count":2367,"language":"Kotlin","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":614,"mirror_url":null,"archived":false,"open_issues_count":94,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":614,"open_issues":94,"watchers":2367,"default_branch":"master"}},"base":{"label":"corda:master","ref":"master","sha":"380a942954f0b632bad4aa20e933cf468f56f6e5","user":{"login":"corda","id":22600631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNjAwNjMx","avatar_url":"https://avatars1.githubusercontent.com/u/22600631?v=4","gravatar_id":"","url":"https://api.github.com/users/corda","html_url":"https://github.com/corda","followers_url":"https://api.github.com/users/corda/followers","following_url":"https://api.github.com/users/corda/following{/other_user}","gists_url":"https://api.github.com/users/corda/gists{/gist_id}","starred_url":"https://api.github.com/users/corda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/corda/subscriptions","organizations_url":"https://api.github.com/users/corda/orgs","repos_url":"https://api.github.com/users/corda/repos","events_url":"https://api.github.com/users/corda/events{/privacy}","received_events_url":"https://api.github.com/users/corda/received_events","type":"Organization","site_admin":false},"repo":{"id":70137417,"node_id":"MDEwOlJlcG9zaXRvcnk3MDEzNzQxNw==","name":"corda","full_name":"corda/corda","private":false,"owner":{"login":"corda","id":22600631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNjAwNjMx","avatar_url":"https://avatars1.githubusercontent.com/u/22600631?v=4","gravatar_id":"","url":"https://api.github.com/users/corda","html_url":"https://github.com/corda","followers_url":"https://api.github.com/users/corda/followers","following_url":"https://api.github.com/users/corda/following{/other_user}","gists_url":"https://api.github.com/users/corda/gists{/gist_id}","starred_url":"https://api.github.com/users/corda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/corda/subscriptions","organizations_url":"https://api.github.com/users/corda/orgs","repos_url":"https://api.github.com/users/corda/repos","events_url":"https://api.github.com/users/corda/events{/privacy}","received_events_url":"https://api.github.com/users/corda/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/corda/corda","description":"Corda is an open source blockchain project, designed for business from the start. Only Corda allows you to build interoperable blockchain networks that transact in strict privacy. Corda's smart contract technology allows businesses to transact directly, with value.","fork":false,"url":"https://api.github.com/repos/corda/corda","forks_url":"https://api.github.com/repos/corda/corda/forks","keys_url":"https://api.github.com/repos/corda/corda/keys{/key_id}","collaborators_url":"https://api.github.com/repos/corda/corda/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/corda/corda/teams","hooks_url":"https://api.github.com/repos/corda/corda/hooks","issue_events_url":"https://api.github.com/repos/corda/corda/issues/events{/number}","events_url":"https://api.github.com/repos/corda/corda/events","assignees_url":"https://api.github.com/repos/corda/corda/assignees{/user}","branches_url":"https://api.github.com/repos/corda/corda/branches{/branch}","tags_url":"https://api.github.com/repos/corda/corda/tags","blobs_url":"https://api.github.com/repos/corda/corda/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/corda/corda/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/corda/corda/git/refs{/sha}","trees_url":"https://api.github.com/repos/corda/corda/git/trees{/sha}","statuses_url":"https://api.github.com/repos/corda/corda/statuses/{sha}","languages_url":"https://api.github.com/repos/corda/corda/languages","stargazers_url":"https://api.github.com/repos/corda/corda/stargazers","contributors_url":"https://api.github.com/repos/corda/corda/contributors","subscribers_url":"https://api.github.com/repos/corda/corda/subscribers","subscription_url":"https://api.github.com/repos/corda/corda/subscription","commits_url":"https://api.github.com/repos/corda/corda/commits{/sha}","git_commits_url":"https://api.github.com/repos/corda/corda/git/commits{/sha}","comments_url":"https://api.github.com/repos/corda/corda/comments{/number}","issue_comment_url":"https://api.github.com/repos/corda/corda/issues/comments{/number}","contents_url":"https://api.github.com/repos/corda/corda/contents/{+path}","compare_url":"https://api.github.com/repos/corda/corda/compare/{base}...{head}","merges_url":"https://api.github.com/repos/corda/corda/merges","archive_url":"https://api.github.com/repos/corda/corda/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/corda/corda/downloads","issues_url":"https://api.github.com/repos/corda/corda/issues{/number}","pulls_url":"https://api.github.com/repos/corda/corda/pulls{/number}","milestones_url":"https://api.github.com/repos/corda/corda/milestones{/number}","notifications_url":"https://api.github.com/repos/corda/corda/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/corda/corda/labels{/name}","releases_url":"https://api.github.com/repos/corda/corda/releases{/id}","deployments_url":"https://api.github.com/repos/corda/corda/deployments","created_at":"2016-10-06T08:46:29Z","updated_at":"2018-10-16T15:53:01Z","pushed_at":"2018-10-16T15:41:15Z","git_url":"git://github.com/corda/corda.git","ssh_url":"git@github.com:corda/corda.git","clone_url":"https://github.com/corda/corda.git","svn_url":"https://github.com/corda/corda","homepage":"https://www.corda.net","size":164486,"stargazers_count":2367,"watchers_count":2367,"language":"Kotlin","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":614,"mirror_url":null,"archived":false,"open_issues_count":94,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":614,"open_issues":94,"watchers":2367,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/corda/corda/pulls/4050"},"html":{"href":"https://github.com/corda/corda/pull/4050"},"issue":{"href":"https://api.github.com/repos/corda/corda/issues/4050"},"comments":{"href":"https://api.github.com/repos/corda/corda/issues/4050/comments"},"review_comments":{"href":"https://api.github.com/repos/corda/corda/pulls/4050/comments"},"review_comment":{"href":"https://api.github.com/repos/corda/corda/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/corda/corda/pulls/4050/commits"},"statuses":{"href":"https://api.github.com/repos/corda/corda/statuses/d69d78bd331ddc9dcfffaf533daeb2cb44dfc20e"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"josecoll"}}