A build machine gets its own credential, scoped to build work

The builder was documented as holding its own broker credential and
nothing else, and nothing issued one — so in practice it used whatever it
was handed, which was the broker's administrative account. A program
documented as holding its own credential and given somebody else's is
worse than one with no story at all.

`builder issue <name>` creates an account that may read the build queue
and write to the mesh exchange. Not a node account: a build machine is
not a node, and a node's queue carries its declarations.

Two faults found by running it, both about the answer path:

- the reply queue was left for the broker to name, and the account was
  scoped to `amq.gen-*` — one broker's convention. The builder built,
  could not answer, and the connection closed. Reply queues are named
  here now, deterministically.
- the answer then went via the DEFAULT exchange, where permission is
  granted per exchange rather than per queue. A builder allowed to use it
  could publish into any node's queue, which is the privilege a build
  machine most obviously should not have. Answers go through the mesh
  exchange, which it already may use, and an asker binds its reply queue
  to the same key and filters by correlation.

Verified against a real broker: a builder cannot consume a node's queue
and cannot publish to the default exchange. That check nearly reported
the opposite — an unconfirmed publish is asynchronous, so the refusal
arrives as a channel close afterwards and a naive test sees success. With
publisher confirms it is immediate. A negative security assertion made
against an asynchronous call is not an assertion.

Redelivery was observed working while fixing this: builders that died
before answering left their work on the queue, and the next builder did
all of it.

Also: the queue and exchange names exist in both `broker` and `link`,
because `link` imports `broker`. A test in an external package keeps them
agreeing — a builder scoped to a queue nothing publishes to takes no work
and says nothing about why.

cmd/mesh-builder/main.go

@@ -184,24 +184,21 @@ func answer(ctx context.Context, channel *amqp.Channel, publisher builder.Publis
 		return
 	}
 
-	replyTo := delivery.ReplyTo
-	if replyTo == "" {
-		// Nobody is waiting. Still reported, to the exchange, so a control plane that records
-		// builds hears about it — a build whose outcome exists nowhere is one nobody can audit.
-		if err := channel.PublishWithContext(ctx, link.Exchange, link.KeyBuilt, false, false,
-			amqp.Publishing{ContentType: "application/json", Body: body}); err != nil {
-			fmt.Fprintf(os.Stderr, "cannot publish a build result: %v\n", err)
-		}
-		_ = delivery.Ack(false)
-		return
-	}
+	// Always through the exchange, whether or not somebody is waiting.
+	//
+	// **Never the default exchange.** Permission there is granted per exchange rather than per
+	// queue, so a builder allowed to use it could publish into any node's queue — the privilege a
+	// build machine most obviously should not have. An asker binds its own reply queue to this
+	// key and filters by correlation; a control plane that records builds is bound to it too, so
+	// a result nobody asked for is still kept rather than reported into the void.
 	publishCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
 	defer cancel()
-	if err := channel.PublishWithContext(publishCtx, "", replyTo, false, false, amqp.Publishing{
-		ContentType:   "application/json",
-		CorrelationId: result.ID,
-		Body:          body,
-	}); err != nil {
+	if err := channel.PublishWithContext(publishCtx, link.Exchange, link.KeyBuilt, false, false,
+		amqp.Publishing{
+			ContentType:   "application/json",
+			CorrelationId: result.ID,
+			Body:          body,
+		}); err != nil {
 		fmt.Fprintf(os.Stderr, "cannot answer a build request: %v\n", err)
 	}
 	// Acknowledged only once the answer is away, so a builder that dies before answering leaves

cmd/mesh-control/main.go

@@ -8,6 +8,8 @@ package main
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"flag"
@@ -65,6 +67,8 @@ func run() error {
 	switch args[0] {
 	case "build":
 		return buildCommand(ctx, args[1:])
+	case "builder":
+		return builderCommand(ctx, args[1:])
 	case "builds":
 		return buildsCommand(ctx, args[1:])
 	case "pin":
@@ -137,6 +141,7 @@ func usage() {
   settings clear <module> [--node <n>]      take a layer away
   build <repository> [--ref R]   have a build machine build it, and record what came out
   builds [<module>]              what has been built lately, and what came of it
+  builder issue <name>           a broker account for a build machine, scoped to build work
   pin <node> <provision> <from>  which node this one gets a provision from
   unpin <node> <provision>       put that question back
   plan <node> [--files|--json]     what that node would run, and why
@@ -1875,3 +1880,54 @@ type builds struct{ inv *inventory.Inventory }
 func (b builds) Built(ctx context.Context, result link.BuildResult) error {
 	return b.inv.RecordBuild(ctx, buildFrom(result))
 }
+
+// builderCommand issues a build machine its own broker credential.
+//
+// **A build machine is not a node**, and giving it a node's account would let it read another
+// machine's declarations. This is narrower and different: read the build queue, write the
+// exchange and an asker's reply queue, and nothing else.
+//
+// Issued rather than assumed, because until this the builder used whatever credential it was
+// handed — which in practice meant the broker's own administrative one. A program documented as
+// holding its own credential and given somebody else's is worse than one with no story at all.
+func builderCommand(ctx context.Context, args []string) error {
+	if len(args) != 2 || args[0] != "issue" {
+		return errors.New("builder issue <name>")
+	}
+	name := args[1]
+
+	management, err := broker.ManagementFromEnvironment()
+	if err != nil {
+		return err
+	}
+
+	// The same shape of secret a token carries: enough entropy that guessing is not a strategy,
+	// and safe to put in a URL because that is where it goes.
+	raw := make([]byte, 32)
+	if _, err := rand.Read(raw); err != nil {
+		return err
+	}
+	password := base64.RawURLEncoding.EncodeToString(raw)
+	if err := management.CreateBuilderAccount(ctx, name, password); err != nil {
+		return err
+	}
+
+	fmt.Printf("broker account %s created, scoped to the %s queue and the %s exchange\n\n",
+		name, link.BuildQueue, link.Exchange)
+
+	// The whole line only when the address is known. A URL with a placeholder where the host
+	// should be is a URL somebody pastes and then debugs, and the placeholder is the last thing
+	// they look at.
+	if known, err := broker.FromEnvironment(); err == nil {
+		fmt.Printf("  MESH_BROKER_AMQP=amqps://%s:%s@%s/\n\n", name, password, known.Address)
+	} else {
+		fmt.Printf("  the password is %s\n\n", password)
+		fmt.Printf("  This control plane has no %s, so it cannot say where the broker is.\n"+
+			"  Put the password in MESH_BROKER_AMQP on the build machine.\n\n",
+			broker.AddressVar)
+	}
+	// Shown once, like a token, and for the same reason: what is stored is the broker's own hash
+	// of it, and a control plane that could show it back would be a control plane that holds it.
+	fmt.Println("This is the only time it is shown.")
+	return nil
+}