(remove_fingerprint: &str)
| 70 | } |
| 71 | |
| 72 | pub fn finalize(remove_fingerprint: &str) -> Result<(), String> { |
| 73 | // Decode the hex fingerprint — accept both the short 8-byte form |
| 74 | // (16 hex chars) produced by `ca_fingerprint_hex` and the full |
| 75 | // 32-byte form (64 hex chars) so operators copy-pasting either |
| 76 | // variant succeed. |
| 77 | let fp_bytes = parse_fingerprint(remove_fingerprint)?; |
| 78 | println!("prepared finalize proposal:"); |
| 79 | println!( |
| 80 | " CaTrustChange {{ remove_ca_fingerprint: {} }}", |
| 81 | ca_fingerprint_hex(&fp_bytes) |
| 82 | ); |
| 83 | println!(); |
| 84 | println!( |
| 85 | "next step: feed this fingerprint to the cluster admin endpoint to commit the removal." |
| 86 | ); |
| 87 | println!( |
| 88 | " every node's applier deletes tls/ca.d/<fp>.crt on commit and rebuilds rustls trust." |
| 89 | ); |
| 90 | Ok(()) |
| 91 | } |
| 92 | |
| 93 | fn parse_fingerprint(s: &str) -> Result<[u8; 32], String> { |
| 94 | let trimmed = s.trim(); |
no test coverage detected