[pmg-devel] [PATCH pmg-api] use fingerprint-sha256 option for fingerprints

[Fabian Grünbichler]

On October 22, 2025 2:06 pm, Maximiliano Sandoval wrote:
> The previous parameter had a regex expression that allowed letters [A-Z]
> instead of [A-F] and it was uppercase-only.
> 
> Tested via:
> 
> ```
> pmgcm join $HOST --fingerprint $FINGERPRINT
> pmgcm status
> ```
> 
> Additionally it was tested that 'pmgcm status' worked after changing the
> fingerprints at /etc/pmg/cluster.conf to lowercase.
> 
> Here $FINGERPRINT was modified so it contained both upper-and-lowercase
> characters.

Isn't this basically a v4 of an older series of yours, with
suggestions/diffs by Stoiko folded in?

https://lore.proxmox.com/pmg-devel/20241111132057.0ea5b2c2@rosa.proxmox.com/

> Signed-off-by: Maximiliano Sandoval <m.sandoval at proxmox.com>
> ---
>  src/PMG/API2/Cluster.pm  |  9 ++++-----
>  src/PMG/CLI/pmgcm.pm     | 12 ++++++------
>  src/PMG/ClusterConfig.pm | 12 +++++++-----
>  3 files changed, 17 insertions(+), 16 deletions(-)
> 
> diff --git a/src/PMG/API2/Cluster.pm b/src/PMG/API2/Cluster.pm
> index fbfbcfc2..69096df6 100644
> --- a/src/PMG/API2/Cluster.pm
> +++ b/src/PMG/API2/Cluster.pm
> @@ -421,11 +421,7 @@ __PACKAGE__->register_method({
>                  type => 'string',
>                  format => 'ip',
>              },
> -            fingerprint => {
> -                description => "SSL certificate fingerprint.",
> -                type => 'string',
> -                pattern => '^(:?[A-Z0-9][A-Z0-9]:){31}[A-Z0-9][A-Z0-9]$',
> -            },
> +            fingerprint => get_standard_option('fingerprint-sha256'),
>              password => {
>                  description => "Superuser password.",
>                  type => 'string',
> @@ -439,6 +435,9 @@ __PACKAGE__->register_method({
>  
>          my $rpcenv = PMG::RESTEnvironment->get();
>          my $authuser = $rpcenv->get_user();
> +        if (my $fp = $param->{fingerprint}) {
> +            $param->{fingerprint} = uc($fp);
> +        }
>  
>          my $realcmd = sub {
>              my $cinfo = PMG::ClusterConfig->new();
> diff --git a/src/PMG/CLI/pmgcm.pm b/src/PMG/CLI/pmgcm.pm
> index 401f6801..07ea0741 100644
> --- a/src/PMG/CLI/pmgcm.pm
> +++ b/src/PMG/CLI/pmgcm.pm
> @@ -6,6 +6,7 @@ use Data::Dumper;
>  use POSIX qw(strftime);
>  use JSON;
>  
> +use PVE::JSONSchema qw(get_standard_option);
>  use PVE::SafeSyslog;
>  use PVE::Tools qw(extract_param);
>  use PVE::INotify;
> @@ -171,18 +172,17 @@ __PACKAGE__->register_method({
>                  type => 'string',
>                  format => 'ip',
>              },
> -            fingerprint => {
> -                description => "SSL certificate fingerprint.",
> -                type => 'string',
> -                pattern => '^(:?[A-Z0-9][A-Z0-9]:){31}[A-Z0-9][A-Z0-9]$',
> -                optional => 1,
> -            },
> +            fingerprint => get_standard_option('fingerprint-sha256'),
>          },
>      },
>      returns => { type => 'null' },
>      code => sub {
>          my ($param) = @_;
>  
> +        if (my $fp = $param->{fingerprint}) {
> +            $param->{fingerprint} = uc($fp);
> +        }
> +
>          my $code = sub {
>              my $cinfo = PMG::ClusterConfig->new();
>  
> diff --git a/src/PMG/ClusterConfig.pm b/src/PMG/ClusterConfig.pm
> index bf8405c0..eeab326b 100644
> --- a/src/PMG/ClusterConfig.pm
> +++ b/src/PMG/ClusterConfig.pm
> @@ -75,11 +75,7 @@ sub properties {
>              type => 'string',
>              pattern => valid_ssh_pubkey_regex(),
>          },
> -        fingerprint => {
> -            description => "SSL certificate fingerprint.",
> -            type => 'string',
> -            pattern => '^(:?[A-Z0-9][A-Z0-9]:){31}[A-Z0-9][A-Z0-9]$',
> -        },
> +        fingerprint => PVE::JSONSchema::get_standard_option('fingerprint-sha256'),
>      };
>  }
>  
> @@ -203,6 +199,8 @@ sub read_cluster_conf {
>          $maxcid = $d->{maxcid} if defined($d->{maxcid}) && $d->{maxcid} > $maxcid;
>          $cinfo->{master} = $d if $d->{type} eq 'master';
>          $cinfo->{'local'} = $d if $d->{name} eq $localname;
> +
> +        $d->{fingerprint} = uc($d->{fingerprint});
>      }
>  
>      if ($maxcid) {
> @@ -224,6 +222,10 @@ sub read_cluster_conf {
>  sub write_cluster_conf {
>      my ($filename, $fh, $cfg) = @_;
>  
> +    foreach my $entry (values %{ $cfg->{ids} }) {
> +        $entry->{fingerprint} = uc($entry->{fingerprint});
> +    }

this should not be needed, since the reader above already mangles it..

> +
>      my $raw = PMG::ClusterConfig::Base->write_config($filename, $cfg);
>  
>      PVE::Tools::safe_print($filename, $fh, $raw);
> -- 
> 2.47.3
> 
> 
> 
> _______________________________________________
> pmg-devel mailing list
> pmg-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel
> 
> 
>