[PATCH proxmox 04/17] client: ignore certificate trust store validation result on fp option

[Shannon Sterz <s.sterz@proxmox.com>]

when a fingerprint is provided, the assumption is, that it acts like a
pinned certificate [1]. by short-circuiting if the certificate is
trusted by the system's trust store (meaning, returning `true` if the
`valid` parameter to the verify callback is `true`), this assumption
is broken. any certificate, whether the fingerprint matches or not,
that is trusted by the system's trust store is considered valid.

[1]: https://cheatsheetseries.owasp.org/cheatsheets/Pinning_Cheat_Sheet.html#what-is-pinning

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 proxmox-client/src/client.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/proxmox-client/src/client.rs b/proxmox-client/src/client.rs
index 26913dbb..7617fee2 100644
--- a/proxmox-client/src/client.rs
+++ b/proxmox-client/src/client.rs
@@ -109,10 +109,7 @@ impl Client {
             TlsOptions::Verify => (),
             TlsOptions::Insecure => connector.set_verify(SslVerifyMode::NONE),
             TlsOptions::Fingerprint(expected_fingerprint) => {
-                connector.set_verify_callback(SslVerifyMode::PEER, move |valid, chain| {
-                    if valid {
-                        return true;
-                    }
+                connector.set_verify_callback(SslVerifyMode::PEER, move |_valid, chain| {
                     verify_fingerprint(chain, &expected_fingerprint)
                 });
             }
-- 
2.47.3