mirrors/arti.git/crates/tor-key-forge/src/certs.rs, branch arti-v2.5.0mirror of https://gitlab.torproject.org/tpo/core/arti
http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v2.5.02026-04-08T09:19:38Zkeymgr: Fix ephemeral keystore cert encoding bug2026-04-08T09:19:38ZGabriela Moldovangabi@torproject.org2026-04-07T17:38:53Zurn:sha1:73e59eee11b80b6045aab4ed1e3a9186c00e030c
This fixes a bug that was causing the ephemeral keystore to retrieve
certs in a format that couldn't be handled by the `KeyMgr`. This caused
all certificate retrievals from `EphemeralKeystore` done via the
`KeyMgr` to fail with an internal error.
For context, the only supported cert type is `TorEd25519Cert`, which is
a pre-encoded certificate (i.e. a type wrapper over a `Vec<u8>`).
These certificates are stored as-is by the Arti native keystore (the
bytes are written to a file on disk). When retrieving a
`TorEd25519Cert`, the Arti keystore uses `parse_certificate_erased()` to
parse the cert into a `ParsedEd25519Cert` before returning it as a
type-erased `ErasedKey`. This works as intended with the `KeyMgr`
retrieval and downcasting logic, which expects the certificate to be
returned in the `ParsedCert` format specified in the `ToEncodableCert`
implementation.
Before this change, the ephemeral keystore, on the other hand, did not
play well with the `KeyMgr` when it came to cert retrieval: it would
incorrectly store the `KeystoreItem` as-is, and retrieve it as an
`ErasedKey` using the `ErasedKey::into_erased()` implementation. This
would then cause the `KeyMgr` to fail to downcast the `ErasedKey` to the
correct type (because the returned erased item was of a different type
than `ParsedCert`).
This commit also removes `KeystoreItem::into_erased()`, which was a
footgun (because certificates are not actually supposed to be retrieved
in the format returned by `CertData::into_erased()`).
tor-key-forge: Add wrappers for various cert types.2025-01-13T19:28:23ZGabriela Moldovangabi@torproject.org2024-12-12T13:58:37Zurn:sha1:e3bcf444252c248a47482f703918ce35d5a663ector-key-forge: Implement KeystoreItem::item_type.2024-12-04T16:42:06ZGabriela Moldovangabi@torproject.org2024-11-25T12:20:58Zurn:sha1:9fec1799d9ac41ac7dffa085d71a82c96cb5b076tor-key-forge: Implement EncodableItem for Tor ed25519 certs.2024-12-04T16:42:06ZGabriela Moldovangabi@torproject.org2024-11-21T18:58:36Zurn:sha1:e97f7955c20d5f291ea2dc5f61b19365c06c712d
This will enable us to store `tor_cert::EncodedEd25519Cert`s in the
keystore.
tor-key-forge: Add an encodable cert type.2024-12-04T16:40:45ZGabriela Moldovangabi@torproject.org2024-11-21T18:49:16Zurn:sha1:5640d4f6d9f64b934a389c40fca0bdbc2a23b140