The node keeps the mesh's own certificate it applies, from its kept declaration at start, for its record; one agent test folded to hold the count (issue 1126, ADR 0555 §3)

2026-10-26 19:24:36 +01:00
parent 1e38c42646
commit f8afaefba0
8 changed files with 97 additions and 3 deletions
@@ -21,6 +21,8 @@ type RecordKeys struct {
 	SealingKey  string
 	ServingKey  string
 	Certificate string
+	// Authority is the mesh's own certificate as this machine last applied it (public).
+	Authority string
 }

 // recordOf is the node's record from one facts report and its keys; nil for a report that carries no profile (one that
@@ -43,7 +45,7 @@ func recordOf(node string, r Report, keys RecordKeys) *delivery.NodeRecord {
 		return nil
 	}
 	rec := &delivery.NodeRecord{V: delivery.Version, Node: node, TunnelKey: keys.TunnelKey, SealingKey: keys.SealingKey,
-		ServingKey: keys.ServingKey, Certificate: keys.Certificate}
+		ServingKey: keys.ServingKey, Certificate: keys.Certificate, Authority: keys.Authority}
 	for _, c := range p.Capabilities {
 		if c.Present && c.Name != "" {
 			rec.Capabilities = append(rec.Capabilities, c.Name)