[PATCH qemu-server v2 1/5] remote migration: drop ineffective fingerprint auto-detection

[Erik Fastermann <e.fastermann@proxmox.com>]

When no fingerprint was supplied, the code fetched the remote node
certificate and pinned its fingerprint for the migration tunnel. This
has no functional effect and is removed.

That fetch only succeeds for remotes trusted via the CA store, which
is exactly the case where pinning is unnecessary: both the API client
and the websocket tunnel fall back to CA verification on their own.
For a self-signed remote the fetch itself fails verification, so no
fingerprint is ever obtained.

The only meaningful path, an explicitly supplied fingerprint (needed to
verify self-signed remotes), is unchanged.

Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
---

 See the discussion on the RFC for more details [0].

 [0]: https://lore.proxmox.com/pve-devel/1785319378.5wn648ra0k.astroid@yuna.none/


 src/PVE/API2/Qemu.pm | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 39c725d0..56c5f08c 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -5751,26 +5751,14 @@ __PACKAGE__->register_method({
             apitoken => $remote->{apitoken},
         };
 
-        my $fp;
-        if ($fp = $remote->{fingerprint}) {
-            $conn_args->{cached_fingerprints} = { uc($fp) => 1 };
+        if ($remote->{fingerprint}) {
+            $conn_args->{cached_fingerprints} = { uc($remote->{fingerprint}) => 1 };
         }
 
         print "Establishing API connection with remote at '$remote->{host}'\n";
 
         my $api_client = PVE::APIClient::LWP->new(%$conn_args);
 
-        if (!defined($fp)) {
-            my $cert_info = $api_client->get("/nodes/localhost/certificates/info");
-            foreach my $cert (@$cert_info) {
-                my $filename = $cert->{filename};
-                next if $filename ne 'pveproxy-ssl.pem' && $filename ne 'pve-ssl.pem';
-                $fp = $cert->{fingerprint} if !$fp || $filename eq 'pveproxy-ssl.pem';
-            }
-            $conn_args->{cached_fingerprints} = { uc($fp) => 1 }
-                if defined($fp);
-        }
-
         my $repl_conf = PVE::ReplicationConfig->new();
         my $is_replicated = $repl_conf->check_for_existing_jobs($source_vmid, 1);
         die "cannot remote-migrate replicated VM\n" if $is_replicated;
-- 
2.47.3