From 93d167f0e8ea39505c2b3898b2587b1043d95278 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 30 Oct 2026 18:36:18 +0100 Subject: [PATCH] Say rightly which own secrets the core ask leaves out: broker-address and broker-management are no bus accounts (issue 774) The comment of c421629f named the controller's broker-address and broker-management as process accounts. They are not: no process of the controller declares a bus; broker-address is the bus's address, read by broker.FromEnvironment, and broker-management the retired AMQP management login, read by nothing. The filter never touched them; only the words were wrong. --- cmd/mesh-controller/core_box.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/cmd/mesh-controller/core_box.go b/cmd/mesh-controller/core_box.go index f165c470..d9200f02 100644 --- a/cmd/mesh-controller/core_box.go +++ b/cmd/mesh-controller/core_box.go @@ -71,10 +71,11 @@ type coreBoxes struct { // client, and one issued outside the mesh is never the vault's to seal here. // // **Nor a process's bus account nobody issued yet** (sweep 2026-10-30, issue 774). Asked with `get`, the vault holds -// none and makes a random value under the account's name: own/novox/nats/broker-nats-tools at 16:36:51, and the -// controller's own broker-address and broker-management, which the vault then finds holding no account ("not JSON") -// and owes their hashes for good. Until the controller issues the account and hands it to the vault, the machine has -// the controller's stand-in (prepareSend), as every module below the vault's contract does. +// none and makes a random value under the account's name: own/novox/nats/broker-nats-tools at 16:36:51. Until the +// controller issues the account and hands it to the vault, the machine has the controller's stand-in (prepareSend), as +// every module below the vault's contract does. (The controller's own broker-address and broker-management are no +// accounts: the bus's address, which broker.FromEnvironment reads, and the retired AMQP management login; no process +// declares them, so this leaves them asked as before.) func coreModulesOf(modules []catalogue.Manifest, handed func(catalogue.Manifest) bool, node string, minted []string) map[string][]string { out := map[string][]string{}