fix(pam-rdp): stable acceptor certificate

[bernie-g]

The RDP acceptor generated a fresh self-signed certificate per session, so mstsc's second connection saw a different cert than the one the user had just approved and aborted the handshake.

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-376-fix-pam-rdp-stable-acceptor-certificate

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tracing-subscriber@​0.3.23

View full report

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[greptile-apps]

Greptile Summary

This PR stabilizes the PAM RDP acceptor certificate for the lifetime of the CLI process so reconnecting RDP clients see the certificate they previously approved.

• Caches matching acceptor TLS and CredSSP public-key material in a process-global OnceLock.
• Adds Rust tracing initialization and timing diagnostics for RDP and CredSSP failures while keeping credential-bearing SSPI logs disabled by default.
• Propagates detailed Rust session errors through the C ABI to the Go bridge and logs failed sessions with session and target context.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code-triggered correctness, security, portability, or SSRF defect identified.

The cached certificate and CredSSP key remain consistent, the new FFI error path is bounded and used before handle cleanup, and logging defaults avoid enabling credential-bearing SSPI diagnostics.

Important Files Changed

Filename	Overview
packages/pam/handlers/rdp/native/src/bridge.rs	Reuses internally consistent TLS certificate and CredSSP public-key material across process-local RDP sessions and adds protocol timing diagnostics.
packages/pam/handlers/rdp/native/src/ffi.rs	Stores session failure details and exposes a bounded, UTF-8-safe C ABI accessor whose lifecycle matches the Go wait-before-free contract.
packages/pam/handlers/rdp/bridge_cgo_shared.go	Retrieves Rust failure details before freeing the bridge and adds contextual session-failure logging.
packages/pam/handlers/rdp/native/src/logging.rs	Installs an idempotent tracing subscriber and prevents ordinary LOG_LEVEL changes from enabling credential-bearing SSPI debug output.
packages/pam/handlers/rdp/native/Cargo.toml	Adds the pure-Rust tracing subscriber dependency with a restricted feature set.
packages/pam/handlers/rdp/native/include/rdp_bridge.h	Extends the bridge ABI with the bounded last-session-error retrieval contract.

_{Reviews (1): Last reviewed commit: "fix(pam-rdp): stable acceptor certificat..." | Re-trigger Greptile}