[PATCH datacenter-manager 07/17] client: allow users to update a changed fingerprint interactively

[Shannon Sterz <s.sterz@proxmox.com>]

if the client is operating in interactive mode and we notice that the
certificate of a remote has changed, the client now asks the user
whether the certificate should be updated.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 cli/client/src/env/fingerprint_cache.rs | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/cli/client/src/env/fingerprint_cache.rs b/cli/client/src/env/fingerprint_cache.rs
index af48c353..a4766ae9 100644
--- a/cli/client/src/env/fingerprint_cache.rs
+++ b/cli/client/src/env/fingerprint_cache.rs
@@ -137,16 +137,19 @@ impl FingerprintCache {
         };
 
         if let Some(stored_fp) = self.entries.read().unwrap().get(hostname) {
-            return Ok(VerifyResult::unmodified(**stored_fp == *fp));
+            if self.interactive && **stored_fp != *fp {
+                println!("Certificate fingerprint has changed!");
+                println!("Old certificate SHA256 fingerprint: {stored_fp}");
+            } else {
+                return Ok(VerifyResult::unmodified(**stored_fp == *fp));
+            }
+        } else if !self.interactive || valid {
+            return Ok(VerifyResult::unmodified(valid));
         }
 
         let fp = Fingerprint::try_from(&*fp)
             .map_err(|_| format_err!("unexpected fingerprint length"))?;
 
-        if !self.interactive || valid {
-            return Ok(VerifyResult::unmodified(valid));
-        }
-
         println!("Certificate SHA256 fingerprint: {fp}");
 
         let mut stdout = std::io::stdout();
-- 
2.47.3