fd6686d81a
When a rotation signature chain reaches a certain size, remove the oldest rotation signature from the chain before wrapping it in a new rotation signature. Since all previous rotation signatures are signed by the same wrapping pubkey (node's own tailnet lock key), the node can re-construct the chain, re-signing previous rotation signatures. This will satisfy the existing certificate validation logic. Updates #13185 Signed-off-by: Anton Tolchanov <anton@tailscale.com> |
||
|---|---|---|
| .. | ||
| aum.go | ||
| aum_test.go | ||
| builder.go | ||
| builder_test.go | ||
| chaintest_test.go | ||
| deeplink.go | ||
| deeplink_test.go | ||
| key.go | ||
| key_test.go | ||
| scenario_test.go | ||
| sig.go | ||
| sig_test.go | ||
| state.go | ||
| state_test.go | ||
| sync.go | ||
| sync_test.go | ||
| tailchonk.go | ||
| tailchonk_test.go | ||
| tka.go | ||
| tka_clone.go | ||
| tka_test.go | ||