VS-16: correct stale amtsetupbin handler docstring #55

Merged

nrupard merged 1 commit from docs/amtsetupbin-docstring-vs-16 into main

2026-06-12 18:45:19 +02:00

nrupard commented

2026-06-12 18:43:28 +02:00

Owner

Summary

Documentation-only fix on the amtsetupbin control handler, plus parks the keypair half of VS-16.

The ControlIn::AmtSetupBin doc comment claimed the handler is a stub returning not-implemented. That is stale: the dispatch site (user_session.rs:3053) already builds a real v3 USB-key setup.bin that rotates the MEBx password (oldmebxpass -> newmebxpass) via meshcentral_amt::setupbin::build_password_change and replies with the base64-encoded bytes, site-admin gated. The doc now describes that behavior.

VS-16 status

VS-16's stated goal is the Intel ACS PKCS#10 keypair variant for ACM provisioning, which is a different, larger artifact than the password-change file already shipping. That part is not implemented and stays blocked on:

An unanswered design decision: vendor the Intel ACS root cert in-repo vs require the admin to supply it.
No Intel SCS test harness or known-good blob to verify the generated keypair is firmware-accepted (no AMT hardware/simulator in the customer base).

This PR records that split in the doc so the next reader knows the password-change path works and the keypair path is the remaining tracked work. No behavior change.

Verification

cargo fmt -p meshcentral-web --check and cargo check -p meshcentral-web both clean in the dev container.

🤖 Generated with Claude Code

## Summary Documentation-only fix on the `amtsetupbin` control handler, plus parks the keypair half of VS-16. The `ControlIn::AmtSetupBin` doc comment claimed the handler is a stub returning `not-implemented`. That is stale: the dispatch site (`user_session.rs:3053`) already builds a real v3 USB-key `setup.bin` that rotates the MEBx password (`oldmebxpass` -> `newmebxpass`) via `meshcentral_amt::setupbin::build_password_change` and replies with the base64-encoded bytes, site-admin gated. The doc now describes that behavior. ## VS-16 status VS-16's stated goal is the Intel ACS **PKCS#10 keypair** variant for ACM provisioning, which is a different, larger artifact than the password-change file already shipping. That part is **not** implemented and stays blocked on: - An unanswered design decision: vendor the Intel ACS root cert in-repo vs require the admin to supply it. - No Intel SCS test harness or known-good blob to verify the generated keypair is firmware-accepted (no AMT hardware/simulator in the customer base). This PR records that split in the doc so the next reader knows the password-change path works and the keypair path is the remaining tracked work. No behavior change. ## Verification `cargo fmt -p meshcentral-web --check` and `cargo check -p meshcentral-web` both clean in the dev container. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nrupard added 1 commit

2026-06-12 18:43:28 +02:00

docs(web): correct stale amtsetupbin handler docstring

Check / fmt + clippy + build + tests (pull_request) Successful in 1m38s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

5dcd7eec95

The ControlIn::AmtSetupBin doc still said the handler is a stub that returns not-implemented, but it has been wired for a while: it builds a v3 USB-key setup.bin that rotates the MEBx password via meshcentral_amt::setupbin::build_password_change and replies with the base64-encoded bytes (site-admin only). Update the doc to describe the real behavior and to record that the Intel ACS PKCS#10 keypair variant for ACM provisioning is the part still tracked by VS-16, which stays blocked on the ACS root-cert provenance decision and on a harness to validate firmware-accepted output. No behavior change.

#VS-16