attic-init: replace the stored public key with the one the cache reports

a re-created cache signs with a new key; the fact was only created once, so
every hive then rejected the swarm's closures. the cache's grant gains update
on that one leaf, and a store that refuses it leaves the key as it was.

Closes #6181

nix/host-modules/lib/attic-init.nix

@@ -1,7 +1,8 @@
 # The shell for the in-swarm cache's first start: what its two host units run
 # after they log in to the secret store under the cache's own certificate.
 # Each secret is created only while the store holds none, so a second run reads
-# what the first one stored and mints nothing.
+# what the first one stored and mints nothing. The cache's public key is the
+# exception: the store is brought to the key the cache reports.
 #
 # Pure function — NOT a NixOS module. Call it from a module's `let`:
 #
@@ -21,9 +22,10 @@
   jwtPath,
   pullPath,
   pushPath,
-  # The cache's public facts, created only while absent: the server's address
-  # (scheme included), the cache's name, and the key its narinfo are signed
-  # with. Hives pull with them.
+  # The cache's public facts: the server's address (scheme included), the
+  # cache's name, and the key its narinfo are signed with. Hives pull with
+  # them. The address and the name are created only while absent; the key is
+  # replaced whenever the cache reports another.
   urlPath,
   cachePath,
   publicKeyPath,
@@ -187,6 +189,31 @@ in
     }
     ensure_secret ${q urlPath} mint_url >/dev/null || exit 1
     ensure_secret ${q cachePath} mint_cache >/dev/null || exit 1
-    ensure_secret ${q publicKeyPath} mint_public_key >/dev/null || exit 1
+    stored_key="$(ensure_secret ${q publicKeyPath} mint_public_key)" || exit 1
+
+    # A cache created again has a new signing key, so the stored key is
+    # replaced by the one the cache reports. Only the cache's own grant on this
+    # path allows an update; a store whose policy lacks it refuses, and the
+    # stored key stays.
+    live_key="$(mint_public_key)"
+    if [ -z "$live_key" ]; then
+      echo "the cache ${cache} reported no public key." >&2
+      exit 1
+    fi
+    if [ "$stored_key" != "$live_key" ]; then
+      if printf '%s' "$live_key" | bao kv put ${q publicKeyPath} value=- >/dev/null 2>"$err"; then
+        echo "replaced the stored public key with the one the cache ${cache} reports."
+      else
+        case "$(cat "$err")" in
+          *"permission denied"*)
+            echo "the store refuses to update ${publicKeyPath}; the stored key is not the cache's." >&2
+            ;;
+          *)
+            cat "$err" >&2
+            exit 1
+            ;;
+        esac
+      fi
+    fi
   '';
 }