The node trusts the vault's key beside the controller's until the lease is handed away, says what it trusts in its record, asks the vault for its own certificate, composes the vault's authority beside the controller's, and reads the kept declaration no more once every placed module has a have (issue 774, ADR 0550 §2)

internal/selfcompose/selfcompose_test.go

@@ -3,6 +3,7 @@ package selfcompose
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -1219,6 +1220,32 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		}
 	}
 	b.mu.Unlock()
+
+	// L3 s7 (ADR 0550 §2): the node asks the vault for its own certificate only when a module placed here asks for one
+	// and its record holds none from an authority it trusts; once per serving key.
+	certBus := newFakeBus()
+	certAsks := 0
+	certEnv := certBus.env()
+	certEnv.Certify = func(context.Context) error { certAsks++; return nil }
+	certEnv.VaultAuthority = func() string { return "" }
+	cc := New(certEnv)
+	withCert := `{"module":"web","version":"1","certificate":{"into":"/etc/web/tls.crt"}}`
+	cdigest := delivery.ManifestDigest([]byte(withCert))
+	cc.manifests[digest] = []byte(lemurs)
+	cc.manifests[cdigest] = []byte(withCert)
+	cc.modules = map[string]delivery.Module{"lemurs": {Manifest: digest}, "web": {Manifest: cdigest}}
+	cc.records["n1"] = delivery.NodeRecord{Node: "n1", ServingKey: base64.StdEncoding.EncodeToString(make([]byte, 32))}
+	onlyLemurs := delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "lemurs"}}}
+	cc.certifyIfWanted(context.Background(), reader{c: cc}, onlyLemurs)
+	if certAsks != 0 {
+		t.Errorf("no module asks for a certificate, and the vault was asked %d times", certAsks)
+	}
+	withWeb := delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "lemurs"}, {Module: "web"}}}
+	cc.certifyIfWanted(context.Background(), reader{c: cc}, withWeb)
+	cc.certifyIfWanted(context.Background(), reader{c: cc}, withWeb)
+	if certAsks != 1 {
+		t.Errorf("a module asks for a certificate: the vault was asked %d times, want once", certAsks)
+	}
 }
 
 // patternBus is a bus whose every watch gets the updates of its bucket matching its pattern, as the bus's own watches