diff options
| author | David Lönnhager <david.l@mullvad.net> | 2025-03-07 09:58:37 +0100 |
|---|---|---|
| committer | David Lönnhager <david.l@mullvad.net> | 2025-03-07 14:29:44 +0100 |
| commit | a07fc0bb43115937569d37a1a75ebba02bef0de2 (patch) | |
| tree | 361661d067867ffce17d3a74b257b06770650032 | |
| parent | ff26d0e1de86df0de20c736ec5a28bd69db1f191 (diff) | |
| download | mullvadvpn-a07fc0bb43115937569d37a1a75ebba02bef0de2.tar.xz mullvadvpn-a07fc0bb43115937569d37a1a75ebba02bef0de2.zip | |
Pin TLS certificate in metadata tool
| -rw-r--r-- | mullvad-update/meta/src/platform.rs | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/mullvad-update/meta/src/platform.rs b/mullvad-update/meta/src/platform.rs index 8f8bb45cb9..a781362d76 100644 --- a/mullvad-update/meta/src/platform.rs +++ b/mullvad-update/meta/src/platform.rs @@ -10,6 +10,7 @@ use std::{ fmt, path::{Path, PathBuf}, str::FromStr, + sync::LazyLock, }; use tokio::{fs, io}; use vec1::vec1; @@ -23,6 +24,12 @@ use crate::{ /// Actual JSON files should be stored at `<base url>/<platform>.json`. const META_REPOSITORY_URL: &str = "https://releases.stagemole.eu/desktop/metadata/"; +/// TLS certificate to pin to for `meta pull`. +static PINNED_CERTIFICATE: LazyLock<reqwest::Certificate> = LazyLock::new(|| { + const CERT_BYTES: &[u8] = include_bytes!("../../../mullvad-api/le_root_cert.pem"); + reqwest::Certificate::from_pem(CERT_BYTES).expect("invalid cert") +}); + #[derive(Clone, Copy)] pub enum Platform { Windows, @@ -126,8 +133,7 @@ impl Platform { key::VerifyingKey::from_hex(crate::VERIFYING_PUBKEY).expect("Invalid pubkey"); let version_provider = HttpVersionInfoProvider { - // TODO: pin - pinned_certificate: None, + pinned_certificate: Some(PINNED_CERTIFICATE.clone()), url, verifying_keys: vec1![verifying_key], }; |