jcoffey-dev
a33580cec7
An update of any inbuxa:Relay with replaceLinkCa, sent on its own, acts on the link CA every relay shares: start makes the next CA, finish makes it the link CA, cancel drops it. Every relay shows linkCaReplacing and its own linkCa (current, both, or old: it needs a new join). While one is under way, each node pushes the next CA's pin as nextLinkCaPin, and the relay trusts both, listing them in status.linkCaPins. Once every enabled, joined relay says both, the link service finishes it (relay.link-ca-replaced, event 659): each node takes a certificate from the new CA and links again. Its push of nextLinkCaPin: null, from a link on the next CA, makes that CA the relay's only one: saved in its identity, every link on the old CA ended, and relay.link-ca-replaced recorded. From the current CA, null is a cancel; a link on the next CA can't name another. The link service now sends settings it has cleared as null: the relay merges a push, so one left out stayed as it was. That also fixes a certificate removed here staying on the relay. A join whose token named a CA since replaced shows linkCa old. Tested: the relay's end to end test (both CAs trusted, the refusals, the promotion, the old CA's link cut and refused), the server's relay link test against the real relay binary (start, finished by itself, the relay's identity on the new CA, still joined), relay_tests, and a unit test of the linkCa states.