From fe758bd5ca61394c7789a86d62211b2b32b7bf60 Mon Sep 17 00:00:00 2001
From: Lars Erik Wik <lars.erik.wik@northern.tech>
Date: Sat, 20 Jun 2026 15:31:04 +0200
Subject: [PATCH] Serve leech2 patches from cf-testd via the enterprise hook

cf-testd now handles GETPATCH through the enterprise ServeLeech2Patch()
function, the same code path as cf-serverd, instead of replying with a
hardcoded empty patch. In a pure core build the stub refuses; with the
enterprise plugin loaded a real patch is served from the state
directory.

Ticket: ENT-14105
Signed-off-by: Lars Erik Wik <lars.erik.wik@northern.tech>
---
 cf-testd/cf-testd.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/cf-testd/cf-testd.c b/cf-testd/cf-testd.c
index f6f64c47ef..b796b2bff7 100644
--- a/cf-testd/cf-testd.c
+++ b/cf-testd/cf-testd.c
@@ -40,7 +40,6 @@
 #include <mutex.h>              // ThreadLock
 #include <net.h>
 #include <openssl/err.h>        // ERR_get_error
-#include <patch_stream.h>       // PatchStreamServe
 #include <policy_server.h>      // PolicyServerReadFile
 #include <printsize.h>          // PRINTSIZE
 #include <server_access.h>      // acl_Free
@@ -417,15 +416,11 @@ static bool CFTestD_BusyLoop(
             break;
         }
 
-        /* cf-testd has no leech2 state; serve an empty patch so that the
-         * hub's GETPATCH request succeeds. */
-        Log(LOG_LEVEL_INFO, "Serving empty leech2 patch");
-        if (PatchStreamServe(ConnectionInfoSSL(conn->conn_info), "", 0))
-        {
-            return true;
-        }
-
-        break;
+        /* Serve the patch using the same enterprise code path as cf-serverd.
+         * In a pure core build the stub refuses; with the enterprise plugin
+         * loaded a real leech2 patch is served from the state directory.
+         * Keep the connection open on success. */
+        return ServeLeech2Patch(conn, last_hash);
     }
     case PROTOCOL_COMMAND_BAD:
     default: