From 92db66514b0452f0e0131c06f898fb9e2a479b7d Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Thu, 13 Aug 2026 17:57:27 +0200
Subject: [PATCH] docs(host): the identity comments still named ring after the
 aws-lc-rs move
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #192 (79d755cd) moved rustls, quinn, rcgen and tokio-rustls to aws-lc-rs,
but two comments in identity.rs still credited ring:

  * the module doc credited the P-256 key to "ring via rcgen" — rcgen now
    selects `aws_lc_rs` (punktfunk-host/Cargo.toml:135, punktfunk-core/Cargo.toml:80);
  * the legacy-RSA fallback claimed "rustls/ring can SERVE an existing RSA cert".
    The substance still holds under aws-lc-rs; only the provider name was wrong.

4903c9d3 fixed the `generate()` doc but missed the module doc, whose phrase wraps
across two lines ("generated by" / "ring via rcgen"), so a line-based grep never
matched it.

Comment-only: every changed line is a comment, cargo fmt clean.
---
 crates/punktfunk-host/src/identity.rs | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/crates/punktfunk-host/src/identity.rs b/crates/punktfunk-host/src/identity.rs
index 8cd869ae..aa8129be 100644
--- a/crates/punktfunk-host/src/identity.rs
+++ b/crates/punktfunk-host/src/identity.rs
@@ -3,12 +3,12 @@
 //! History: ONE RSA-2048 identity (`gamestream::cert`) served every plane, because Moonlight
 //! mandates RSA and the planes grew out of the GameStream host. The native punktfunk/1 QUIC
 //! plane and the management API now share THIS identity instead: **ECDSA P-256** — generated by
-//! ring via rcgen (no `rsa` crate on the native path, so the accepted Marvin advisory
-//! RUSTSEC-2023-0071 stops applying to native-only hosts once WP19 gates the compat planes),
-//! browser-compatible (an operator opens `/api/docs` in one, and no mainstream browser accepts an
-//! Ed25519 server cert), and carrying real SANs (localhost, loopback, the machine hostname) —
-//! which the legacy cert never had. The GameStream plane keeps the RSA identity untouched:
-//! Moonlight pins it and its pairing hashes bind its X.509 signature bytes.
+//! rcgen on the workspace's aws-lc-rs backend (no `rsa` crate on the native path, so the accepted
+//! Marvin advisory RUSTSEC-2023-0071 stops applying to native-only hosts once WP19 gates the
+//! compat planes), browser-compatible (an operator opens `/api/docs` in one, and no mainstream
+//! browser accepts an Ed25519 server cert), and carrying real SANs (localhost, loopback, the
+//! machine hostname) — which the legacy cert never had. The GameStream plane keeps the RSA
+//! identity untouched: Moonlight pins it and its pairing hashes bind its X.509 signature bytes.
 //!
 //! ## Migration — the rule that keeps every pinned fingerprint valid
 //!
@@ -73,9 +73,9 @@ pub fn load_or_adopt(np: &crate::native_pairing::NativePairing) -> Result<Native
     }
     // Live native pairings pinned the legacy RSA cert — switching identities now would strand
     // every one of them (the pin is the SHA-256 of the leaf DER). Keep serving what they pinned.
-    // A pem-only read on purpose (WP19): rustls/ring can SERVE an existing RSA cert without the
-    // `rsa` crate, so the native-only build never links it — the crate exists solely behind the
-    // `gamestream` feature (generation + the pairing signer).
+    // A pem-only read on purpose (WP19): rustls/aws-lc-rs can SERVE an existing RSA cert without
+    // the `rsa` crate, so the native-only build never links it — the crate exists solely behind
+    // the `gamestream` feature (generation + the pairing signer).
     if let (Ok(c), Ok(k)) = (
         fs::read_to_string(dir.join("cert.pem")),
         fs::read_to_string(dir.join("key.pem")),