mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 09:06:14 +00:00
Tobias GesellchenandClaude Opus 4.7
c90fdf234f
The Subject==Issuer heuristic for "this is AfterTouch's self-signed cert" misses the common case: AfterTouch's internal CA has CN="SoundTouch Local Root CA" while leaves it issues have CN="soundtouch" — different Subject and Issuer strings, so the classifier was falling through to "foreign chain" and suggesting openssl s_client when install-ca was actually the right fix. Replace the heuristic with a definitive check: load AfterTouch's own CA leaf via setup.Manager.Crypto.GetCACertPath() and call x509.Certificate.CheckSignatureFrom(ca). When that succeeds we *know* the leaf came from our own CA. The Subject==Issuer heuristic stays as a fallback for environments where the CA isn't loadable (with a clarifying note in the hint). Server.loadOwnCACert caches the parsed CA via sync.Once so repeated Health polls don't re-read the PEM. Fixes the case shown in soundtouch.fritz.box deployments where Subject=CN=soundtouch,O=AfterTouch and Issuer=CN=SoundTouch Local Root CA,O=SoundTouch Local Service confused the classifier. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>