Make the membership, its subject, stream, bare address and the pin public, so the route proxy leaves the controller's module (issue 1633)

go/process/conn.go

@@ -40,7 +40,7 @@ var refusedPublish = regexp.MustCompile(`(?i)Publish to "(\S+)"`)
 // other certificate), authenticated as its user and password, on the inbox prefix _INBOX.<user> and no
 // other, reconnecting without limit as the tool runner does (novox/hq issue 1192: a process outlives a
 // bus restart, never giving up the way the client library's own default of 60 attempts would). Ported
-// from mesh-controller internal/broker/jetstream.go:106-132 (DialPinned, PinnedToFingerprint) since this
+// from mesh-controller internal/broker/jetstream.go (DialPinned, PinnedToFingerprint), which now uses this one since this
 // package may not import the controller.
 //
 // An ErrorHandler among opts is chained behind this package's own, which watches every async error for a
@@ -78,7 +78,7 @@ func (c *Conn) options(opts []nats.Option) []nats.Option {
 		nats.MaxReconnects(-1),
 	}
 	if c.account.Fingerprint != "" {
-		all = append(all, nats.Secure(pinnedToFingerprint(c.account.Fingerprint)))
+		all = append(all, nats.Secure(PinnedToFingerprint(c.account.Fingerprint)))
 	}
 	all = append(all, opts...)
 	return append(all, nats.ErrorHandler(func(nc *nats.Conn, sub *nats.Subscription, err error) {
@@ -140,9 +140,11 @@ func (c *Conn) publishRefused(err error) bool {
 	return len(cancels) > 0
 }
 
-// pinnedToFingerprint accepts exactly the certificate with this SHA-256 and no other — the leaf alone, its
+// PinnedToFingerprint accepts exactly the certificate with this SHA-256 and no other — the leaf alone, its
 // name and chain deliberately not consulted, as mesh-controller's own pin does (jetstream.go:116-132).
-func pinnedToFingerprint(want string) *tls.Config {
+// PinnedToFingerprint is public so that a process dialling the bus on its own terms, and the controller,
+// share this one pin (novox/hq issue 1633).
+func PinnedToFingerprint(want string) *tls.Config {
 	return &tls.Config{
 		InsecureSkipVerify: true, //nolint:gosec // replaced by the pin below, which is stricter
 		MinVersion:         tls.VersionTLS12,