[RFC qemu-server 1/4] remote migrate: drop ineffective fingerprint auto-detection

[Erik Fastermann <e.fastermann@proxmox.com>]

When no fingerprint was supplied, the code fetched the remote node
certificate and pinned its fingerprint for the migration tunnel. This
has no functional effect and is removed.

That fetch only succeeds for remotes trusted via the CA store, which
is exactly the case where pinning is unnecessary: both the API client
and the websocket tunnel fall back to CA verification on their own.
For a self-signed remote the fetch itself fails verification, so no
fingerprint is ever obtained.

The only meaningful path, an explicitly supplied fingerprint (needed to
verify self-signed remotes), is unchanged.

Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
---
 src/PVE/API2/Qemu.pm | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 28cbb9b0..68f1800c 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -5739,26 +5739,14 @@ __PACKAGE__->register_method({
             apitoken => $remote->{apitoken},
         };
 
-        my $fp;
-        if ($fp = $remote->{fingerprint}) {
-            $conn_args->{cached_fingerprints} = { uc($fp) => 1 };
+        if ($remote->{fingerprint}) {
+            $conn_args->{cached_fingerprints} = { uc($remote->{fingerprint}) => 1 };
         }
 
         print "Establishing API connection with remote at '$remote->{host}'\n";
 
         my $api_client = PVE::APIClient::LWP->new(%$conn_args);
 
-        if (!defined($fp)) {
-            my $cert_info = $api_client->get("/nodes/localhost/certificates/info");
-            foreach my $cert (@$cert_info) {
-                my $filename = $cert->{filename};
-                next if $filename ne 'pveproxy-ssl.pem' && $filename ne 'pve-ssl.pem';
-                $fp = $cert->{fingerprint} if !$fp || $filename eq 'pveproxy-ssl.pem';
-            }
-            $conn_args->{cached_fingerprints} = { uc($fp) => 1 }
-                if defined($fp);
-        }
-
         my $repl_conf = PVE::ReplicationConfig->new();
         my $is_replicated = $repl_conf->check_for_existing_jobs($source_vmid, 1);
         die "cannot remote-migrate replicated VM\n" if $is_replicated;
-- 
2.47.3