38 lines
843 B
Go
38 lines
843 B
Go
|
package cursor
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"cursor/internal/certs"
|
|||
|
|
"fmt"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
// migrateCATrust verifies both sides of the migration. Removing the legacy
|
|||
|
|
// trust is necessary because its private key has already been public.
|
|||
|
|
func migrateCATrust(cert []byte, trusted func([]byte) (bool, error), migrate func() error) error {
|
|||
|
|
current, err := trusted(cert)
|
|||
|
|
if err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
legacy, err := trusted(certs.EmbeddedCACertPEM())
|
|||
|
|
if err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if current && !legacy {
|
|||
|
|
return nil
|
|||
|
|
}
|
|||
|
|
if err := migrate(); err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
current, err = trusted(cert)
|
|||
|
|
if err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
legacy, err = trusted(certs.EmbeddedCACertPEM())
|
|||
|
|
if err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if !current || legacy {
|
|||
|
|
return fmt.Errorf("证书迁移未完成：需要信任本机 CA 并移除旧共享 CA；请重试授权")
|
|||
|
|
}
|
|||
|
|
return nil
|
|||
|
|
}
|