ENG-5: the bootstrap makes a one-off push credential for the holders' first images, writes it for the store's holder and forgets it when its run ends (design 51, issue 1966)

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
2026-11-04 12:07:34 +01:00
parent 2a71a8ff76
commit 18c1735f7c
4 changed files with 98 additions and 5 deletions
@@ -188,7 +188,9 @@ func parseArgs(args []string) (string, bootstrap.Options, bool, error) {
 		Out:      defaultOut,
 		State:    store.DefaultPath,
 		Registry: defaultRegistry,
-		Host:     defaultHost,
+		// Where the store's holder reads the one-off credential the holders' first images are pushed with (design 51, ENG-5).
+		PushCredentialFile: "/var/lib/mesh/registry/bootstrap-push",
+		Host:               defaultHost,
 		// The machine's own name, because that is what a person already calls it and an installer
 		// inventing a different one would leave the mesh naming a machine nobody recognises. It is
 		// read here rather than inside the bootstrap so that --node overrides a fact rather than a