From 3727c7c67b2f64724bc4960bb61140b25dfd371f Mon Sep 17 00:00:00 2001 From: iris <2+iris@noreply.localhost> Date: Mon, 7 Sep 2026 16:34:46 -0400 Subject: [PATCH] wg-app-link: follow the enrollment link's new optional CA parameter The shared enrollment_uri/print_enrollment now take the CA the link should carry, for ai-app's iris client -- an APK cross-compiled somewhere other than the machine its server runs on, which therefore cannot pin at build time. This app is built on the machine it talks to, so it passes None and its QR is unchanged; the reason is written at the call site. Co-Authored-By: Claude Fable 5.1 --- server/src/auth.rs | 8 +++++++- vendor/wg-app-link | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/server/src/auth.rs b/server/src/auth.rs index 06eb5f2..ec1a3b6 100644 --- a/server/src/auth.rs +++ b/server/src/auth.rs @@ -47,8 +47,14 @@ pub use wg_app_link::enroll::{generate_token, token_hash_hex}; /// where to connect and the bearer token. The CA stays embedded in the APK, /// so this carries no trust material -- photographing the terminal leaks /// only the token, which is rotatable (`--rotate-token`). +/// +/// `None` for the shared function's optional CA, deliberately: this app is +/// built on the machine it talks to and pins that build's certificate, so +/// carrying the CA here would only cost the QR the extra 48 columns +/// `enroll::ca_param` documents. ai-app passes one because its iris client +/// is cross-compiled elsewhere. pub fn print_enrollment(host: IpAddr, port: u16, token: &str) -> anyhow::Result<()> { - wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token) + wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token, None) } pub async fn require_token( diff --git a/vendor/wg-app-link b/vendor/wg-app-link index f95bc77..22ec18f 160000 --- a/vendor/wg-app-link +++ b/vendor/wg-app-link @@ -1 +1 @@ -Subproject commit f95bc77f7bf55a57ba6c051b06f11d30ac68c55e +Subproject commit 22ec18fcf27789f504f71e4c8ff449c554ee076d