An update of any inbuxa:Relay with replaceLinkCa, sent on its own, acts
on the link CA every relay shares: start makes the next CA, finish makes
it the link CA, cancel drops it. Every relay shows linkCaReplacing and
its own linkCa (current, both, or old: it needs a new join).
While one is under way, each node pushes the next CA's pin as
nextLinkCaPin, and the relay trusts both, listing them in
status.linkCaPins. Once every enabled, joined relay says both, the link
service finishes it (relay.link-ca-replaced, event 659): each node takes
a certificate from the new CA and links again. Its push of
nextLinkCaPin: null, from a link on the next CA, makes that CA the
relay's only one: saved in its identity, every link on the old CA ended,
and relay.link-ca-replaced recorded. From the current CA, null is a
cancel; a link on the next CA can't name another.
The link service now sends settings it has cleared as null: the relay
merges a push, so one left out stayed as it was. That also fixes a
certificate removed here staying on the relay.
A join whose token named a CA since replaced shows linkCa old.
Tested: the relay's end to end test (both CAs trusted, the refusals,
the promotion, the old CA's link cut and refused), the server's relay
link test against the real relay binary (start, finished by itself,
the relay's identity on the new CA, still joined), relay_tests, and a
unit test of the linkCa states.
jcoffey-dev