From 36339993bc4aacd22448910ed39ec0c5fceef18d Mon Sep 17 00:00:00 2001 From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com> Date: Tue, 27 Oct 2026 14:01:16 +0100 Subject: [PATCH] [client] Mark Rosenpass as deprecated (#8372) * [client] Mark Rosenpass flags as deprecated Rosenpass support is being deprecated. Users enabling it from the CLI should learn that before they depend on it, while the feature itself keeps working. * [client] Show Rosenpass deprecation notice in the UI settings Desktop users enable Rosenpass from the settings toggle, not the CLI, so the deprecation notice needs to reach them there too. A new string key falls back to English until Crowdin translates it, instead of showing a stale translation without the notice. * [client] Keep switchOrCreateProfile doc comment attached The Rosenpass warning helper landed between switchOrCreateProfile and its doc comment, leaving the function undocumented. * [client] Use MarkDeprecated for the Rosenpass flags Follows the convention already used for --enable-lazy-connection, as asked in review. The flags drop out of --help and pflag warns on any use, so the custom helper is no longer needed. * [client] Isolate the Rosenpass flag test from upCmd's flag set Setting the shared upCmd flags left them marked Changed for any later test in the package. --- client/cmd/root.go | 6 ++-- client/cmd/up_rosenpass_test.go | 34 +++++++++++++++++++ .../src/modules/settings/SettingsSecurity.tsx | 9 ++++- client/ui/i18n/locales/en/common.json | 4 +++ 4 files changed, 50 insertions(+), 3 deletions(-) create mode 100644 client/cmd/up_rosenpass_test.go diff --git a/client/cmd/root.go b/client/cmd/root.go index f976ca895..3c49f8cca 100644 --- a/client/cmd/root.go +++ b/client/cmd/root.go @@ -220,13 +220,15 @@ func init() { `An empty string "" clears the previous configuration. `+ `E.g. --dns-resolver-address 127.0.0.1:5053 or --dns-resolver-address ""`, ) - upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.") - upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.") + upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Deprecated] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.") + upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Deprecated] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.") upCmd.PersistentFlags().BoolVar(&autoConnectDisabled, disableAutoConnectFlag, false, "Disables auto-connect feature. If enabled, then the client won't connect automatically when the service starts.") upCmd.PersistentFlags().BoolVar(&localMetricsEnabled, enableLocalMetricsFlag, false, "Enables a local Prometheus /metrics endpoint exposing connection state (peers, latency, P2P vs relay).") upCmd.PersistentFlags().StringVar(&localMetricsAddr, localMetricsAddressFlag, localmetrics.DefaultListenAddress, "Listen address of the local Prometheus /metrics endpoint.") upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "Deprecated: no longer used. Lazy connections are controlled by the server and the NB_LAZY_CONN environment variable.") _ = upCmd.PersistentFlags().MarkDeprecated(enableLazyConnectionFlag, "no longer used; lazy connections are controlled by the server and the NB_LAZY_CONN environment variable") + _ = upCmd.PersistentFlags().MarkDeprecated(enableRosenpassFlag, "Rosenpass support may be removed in a future release") + _ = upCmd.PersistentFlags().MarkDeprecated(rosenpassPermissiveFlag, "Rosenpass support may be removed in a future release") } diff --git a/client/cmd/up_rosenpass_test.go b/client/cmd/up_rosenpass_test.go new file mode 100644 index 000000000..fd36df20f --- /dev/null +++ b/client/cmd/up_rosenpass_test.go @@ -0,0 +1,34 @@ +package cmd + +import ( + "bytes" + "testing" + + "github.com/spf13/pflag" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestRosenpassFlagsWarnDeprecated(t *testing.T) { + origEnabled, origPermissive := rosenpassEnabled, rosenpassPermissive + t.Cleanup(func() { + rosenpassEnabled, rosenpassPermissive = origEnabled, origPermissive + }) + + for _, name := range []string{enableRosenpassFlag, rosenpassPermissiveFlag} { + // Copy the production flag into a private set so Set marks only the copy as + // Changed, leaving upCmd's shared flag set untouched for other tests. + prod := upCmd.PersistentFlags().Lookup(name) + require.NotNil(t, prod, "flag --%s must be registered on up", name) + flagCopy := *prod + + var out bytes.Buffer + flags := pflag.NewFlagSet("rosenpass-test", pflag.ContinueOnError) + flags.SetOutput(&out) + flags.AddFlag(&flagCopy) + + require.NoError(t, flags.Set(name, "true")) + assert.Contains(t, out.String(), "Flag --"+name+" has been deprecated", "setting --%s should print the deprecation notice", name) + assert.False(t, prod.Changed, "the shared --%s flag must stay unchanged", name) + } +} diff --git a/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx index db1ad9c8f..eacf0ebfe 100644 --- a/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx +++ b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx @@ -42,7 +42,14 @@ export function SettingsSecurity() { if (!v) setField("rosenpassPermissive", false); }} label={t("settings.security.rosenpass.label")} - helpText={t("settings.security.rosenpass.help")} + helpText={ + <> + {t("settings.security.rosenpass.help")} + + {t("settings.security.rosenpass.deprecated")} + + + } /> )} {!hideRosenpassPermissive && ( diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json index 94d741b3e..fb3af16ea 100644 --- a/client/ui/i18n/locales/en/common.json +++ b/client/ui/i18n/locales/en/common.json @@ -899,6 +899,10 @@ "message": "Add a post-quantum key exchange via Rosenpass on top of WireGuard®.", "description": "Helper text: adds a post-quantum key exchange via Rosenpass on top of WireGuard®. 'Rosenpass' and 'WireGuard®' are product names — do not translate; keep the ® symbol." }, + "settings.security.rosenpass.deprecated": { + "message": "Deprecated: Rosenpass support may be removed in a future release.", + "description": "Notice shown under the quantum-resistance toggle: the Rosenpass feature is deprecated and may be removed later. 'Rosenpass' is a product name — do not translate." + }, "settings.security.rosenpassPermissive.label": { "message": "Enable Permissive Mode", "description": "Toggle label: enable permissive mode (for quantum-resistance)."