| 744 | } |
| 745 | |
| 746 | fn import_local_package_mtls_bundle(name: &str) -> Result<Option<PathBuf>> { |
| 747 | for dir in package_managed_tls_dirs() { |
| 748 | let ca = dir.join("ca.crt"); |
| 749 | let cert = dir.join("client/tls.crt"); |
| 750 | let key = dir.join("client/tls.key"); |
| 751 | if !(ca.is_file() && cert.is_file() && key.is_file()) { |
| 752 | continue; |
| 753 | } |
| 754 | |
| 755 | let bundle = openshell_bootstrap::pki::PkiBundle { |
| 756 | ca_cert_pem: std::fs::read_to_string(&ca) |
| 757 | .into_diagnostic() |
| 758 | .wrap_err_with(|| format!("failed to read {}", ca.display()))?, |
| 759 | ca_key_pem: String::new(), |
| 760 | server_cert_pem: String::new(), |
| 761 | server_key_pem: String::new(), |
| 762 | client_cert_pem: std::fs::read_to_string(&cert) |
| 763 | .into_diagnostic() |
| 764 | .wrap_err_with(|| format!("failed to read {}", cert.display()))?, |
| 765 | client_key_pem: std::fs::read_to_string(&key) |
| 766 | .into_diagnostic() |
| 767 | .wrap_err_with(|| format!("failed to read {}", key.display()))?, |
| 768 | // CLI never holds the gateway's JWT signing material — only the |
| 769 | // gateway needs it. Fill the JWT fields with placeholders. |
| 770 | jwt_signing_key_pem: String::new(), |
| 771 | jwt_public_key_pem: String::new(), |
| 772 | jwt_key_id: String::new(), |
| 773 | }; |
| 774 | openshell_bootstrap::mtls::store_pki_bundle(name, &bundle) |
| 775 | .wrap_err_with(|| format!("failed to store mTLS bundle for gateway '{name}'"))?; |
| 776 | |
| 777 | return Ok(Some(dir)); |
| 778 | } |
| 779 | |
| 780 | Ok(None) |
| 781 | } |
| 782 | |
| 783 | fn plaintext_gateway_is_remote(endpoint: &str, remote: Option<&str>, local: bool) -> bool { |
| 784 | if local { |