From 2aeb9ee132fac8963e943ab13588437192743d14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Cluseau?= <mikael.cluseau@gmail.com>
Date: Fri, 17 Jul 2026 14:28:50 +0200
Subject: [PATCH] chore: Release dkl version 1.2.3

---
 Cargo.lock     |  2 +-
 Cargo.toml     |  2 +-
 release.sh     |  4 ++--
 src/bin/dls.rs | 28 ++++++++++++++++++++--------
 src/dls.rs     | 10 ++++++----
 5 files changed, 30 insertions(+), 16 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4b034e1..b22c37e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -341,7 +341,7 @@ dependencies = [
 
 [[package]]
 name = "dkl"
-version = "1.2.2"
+version = "1.2.3"
 dependencies = [
  "async-compression",
  "base32",
diff --git a/Cargo.toml b/Cargo.toml
index b8e08f3..6d9676d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dkl"
-version = "1.2.2"
+version = "1.2.3"
 edition = "2024"
 
 [profile.release]
diff --git a/release.sh b/release.sh
index c769ccd..4495545 100755
--- a/release.sh
+++ b/release.sh
@@ -2,12 +2,12 @@ set -ex
 tag=$(git describe --always)
 repo=novit.tech/direktil/dkl:$tag
 
-docker build --push --platform=linux/amd64,linux/arm64 . -t $repo
-
 publish() {
     arch=$1
     pf=$2
 
+    docker build --push --platform=$pf . -t $repo
+
     for bin in dkl dls; do
     curl --user $(jq '.auths["novit.tech"].auth' ~/.docker/config.json -r |base64 -d) \
         --upload-file <(docker run --rm --platform $pf $repo cat /bin/$bin) \
diff --git a/src/bin/dls.rs b/src/bin/dls.rs
index a3b1cb9..4f8cdd8 100644
--- a/src/bin/dls.rs
+++ b/src/bin/dls.rs
@@ -84,6 +84,10 @@ enum ClusterCommand {
         #[arg(default_value = "cluster")]
         name: String,
     },
+    SetCaCert {
+        ca: String,
+        cert_path: PathBuf,
+    },
     Token {
         #[arg(default_value = "admin")]
         name: String,
@@ -138,18 +142,26 @@ async fn main() -> eyre::Result<()> {
             let dls = dls();
             let cluster = dls.cluster(cluster);
 
+            let Some(command) = command else {
+                write_json(&cluster.config().await?);
+                return Ok(());
+            };
+
             use ClusterCommand as CC;
             match command {
-                None => write_json(&cluster.config().await?),
-                Some(CC::CaCert { name }) => write_raw(&cluster.ca_cert(&name).await?),
-                Some(CC::Token { name }) => println!("{}", &cluster.token(&name).await?),
-                Some(CC::Addons) => write_raw(&cluster.addons().await?),
-                Some(CC::SshSign {
+                CC::CaCert { name } => write_raw(&cluster.ca_cert(&name).await?),
+                CC::SetCaCert { ca, cert_path } => {
+                    let cert = tokio::fs::read(cert_path).await?;
+                    cluster.set_ca_cert(&ca, cert).await?;
+                }
+                CC::Token { name } => println!("{}", &cluster.token(&name).await?),
+                CC::Addons => write_raw(&cluster.addons().await?),
+                CC::SshSign {
                     user_public_key,
                     principal,
                     validity,
                     options,
-                }) => {
+                } => {
                     let pub_key = tokio::fs::read_to_string(user_public_key).await?;
                     let cert = cluster
                         .ssh_userca_sign(&dls::SshSignReq {
@@ -161,12 +173,12 @@ async fn main() -> eyre::Result<()> {
                         .await?;
                     write_raw(&cert);
                 }
-                Some(CC::KubeSign {
+                CC::KubeSign {
                     csr,
                     user,
                     group,
                     validity,
-                }) => {
+                } => {
                     let csr = tokio::fs::read_to_string(csr).await?;
                     let cert = cluster
                         .kube_sign(&dls::KubeSignReq {
diff --git a/src/dls.rs b/src/dls.rs
index d5d21e2..63bd53d 100644
--- a/src/dls.rs
+++ b/src/dls.rs
@@ -154,12 +154,14 @@ impl<'t> Cluster<'t> {
         Ok(resp.bytes().await.map_err(Error::Read)?.to_vec())
     }
 
-    pub async fn restore_ca_cert(&self, ca: &str, cert: Vec<u8>) -> Result<()> {
+    pub async fn set_ca_cert(&self, ca: &str, cert: Vec<u8>) -> Result<()> {
         let req = self.dls.req(
-            Method::POST,
-            format!("clusters/{}/CAs/{ca}/restore", self.name),
+            Method::PUT,
+            format!("clusters/{}/CAs/{ca}/certificate", self.name),
         )?;
-        let req = req.body(cert);
+        let req = req
+            .body(cert)
+            .header("Content-Type", "application/x-x509-ca-cert");
         do_req(req, &self.dls.token).await?;
         Ok(())
     }