Continuum/continuum-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix ensure_trusted(): pin by serial number, not the arbitrary id label

Browse Source 
id in printers.toml is just a label you chose for config purposes - nothing
ties it to a specific physical printer, and renaming it (or reusing it for
a different unit down the line) would silently break the pin lookup and
re-trigger trust-on-first-connect for hardware that was already trusted.
The serial number is the one thing about a printer that can't change, so
that's what a pin should be keyed by: certs/pinned/<sn>.pem instead of
certs/pinned/<id>.pem.

Verified against a real TLS server: pinned a printer under one id, renamed
it in printers.toml with the sn left unchanged, and confirmed the second
run found the existing pin silently (no re-TOFU) rather than re-pinning.
This commit is contained in:
Iwo Strzeboński
2026-08-28 21:22:16 +00:00
parent af2f20a45b
commit a77e93940f
2 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/auto_connect_bambu.rs
+3 -3
View File
@@ -4,9 +4,9 @@
//! fetch_bambu_cert combined: for each Bambu printer in printers.toml,
//! makes sure it has a working certificate, auto-pinning one via
//! trust-on-first-connect if the bundled CA doesn't verify. Safe to run
//! repeatedly — a printer that's already pinned (certs/pinned/<id>.pem)
//! just gets re-verified against its pin, no network trust decision is
//! made again.
//! repeatedly — a printer that's already pinned (certs/pinned/<serial
//! number>.pem) just gets re-verified against its pin, no network trust
//! decision is made again.
use continuum_proxy::fleet;
use continuum_proxy::printer::PrinterHandle;