octoturge
af2f20a45b
The manual fetch_bambu_cert workflow works but needs two commands and a printers.toml edit. ensure_trusted() collapses that into one call, using the same trust model SSH uses for host keys: - a pin already on disk (certs/pinned/<id>.pem) is used directly, no new trust decision is made on every run - no pin yet + bundled CA verifies fine (current-gen printers): nothing to do - no pin yet + bundled CA fails (P1P, etc.): auto-pins via trust-on-first-connect, same as fetch_bambu_cert, but automatic - an *explicit* pin (you set ca_cert_path yourself) never gets silently auto-pinned over — a failure there is a real error examples/auto_connect_bambu.rs demonstrates the one-command flow. Verified all three states against local test servers, not just compiled: first run with no pin auto-pins and connects; second run against the same server is silent (no re-TOFU message) and just verifies against the pin; third run after swapping the server's certificate correctly FAILS instead of silently re-pinning — confirms the security property survives the smoother UX.
35 lines
1.1 KiB
Rust
35 lines
1.1 KiB
Rust
//! Run with: cargo run --example auto_connect_bambu
|
|
//!
|
|
//! The "smooth, no manual steps" version of test_bambu_certs +
|
|
//! fetch_bambu_cert combined: for each Bambu printer in printers.toml,
|
|
//! makes sure it has a working certificate, auto-pinning one via
|
|
//! trust-on-first-connect if the bundled CA doesn't verify. Safe to run
|
|
//! repeatedly — a printer that's already pinned (certs/pinned/<id>.pem)
|
|
//! just gets re-verified against its pin, no network trust decision is
|
|
//! made again.
|
|
|
|
use continuum_proxy::fleet;
|
|
use continuum_proxy::printer::PrinterHandle;
|
|
|
|
fn main() -> anyhow::Result<()> {
|
|
let mut printers = fleet::load(std::path::Path::new("printers.toml"))?;
|
|
let cert_dir = std::path::Path::new("certs/pinned");
|
|
|
|
for printer in &mut printers {
|
|
match printer {
|
|
PrinterHandle::BambuV1(bambu) => report(&bambu.ensure_trusted(cert_dir)),
|
|
PrinterHandle::BambuV2(bambu) => report(&bambu.ensure_trusted(cert_dir)),
|
|
_ => {}
|
|
}
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
fn report(result: &anyhow::Result<()>) {
|
|
match result {
|
|
Ok(()) => println!("connected"),
|
|
Err(err) => println!("failed: {err}"),
|
|
}
|
|
}
|