mirrors/arti.git/crates/tor-key-forge/src/certs.rs, branch main

tor-checkable: TimeBound: Make wrapped type an associated type

2026-07-23T10:13:34Z

It wouldn't make much sense for one concrete type to be unwrappable variously as different inner types.

tor-checkable: TimeBound: Make is_valid_at a provided method

2026-07-23T10:13:34Z

Now that we have `bounds()`, we can centralise this implementation and delete the implementations. I don't think it's necessary to provide an engineered safeguard against downstreams overriding this method. Any existing implementors of this trait will break because they must provide `.bounds()` now, which is an opportunity to notice that the `is_valid_at` can be deleted. But, if it is not deleted, nothing goes wrong.

tor-checkable: TimeBound: remove Error associated type

2026-07-23T10:13:34Z

This was always TimeValidityError. And we want to rely on that so we can do the validity checking more centrally.

tor-checkable: TimeBound: Add bounds accessor

2026-07-23T10:13:34Z

This makes a `TimeBound` much more convenient to work with, will allow more centralisation. This replaces temporary `bound` inherent method on `TimeRangeBound`.

Use new TimeBound name throughout the tree

2026-07-16T15:47:50Z

keymgr: Fix ephemeral keystore cert encoding bug

2026-04-08T09:19:38Z

This fixes a bug that was causing the ephemeral keystore to retrieve certs in a format that couldn't be handled by the `KeyMgr`. This caused all certificate retrievals from `EphemeralKeystore` done via the `KeyMgr` to fail with an internal error. For context, the only supported cert type is `TorEd25519Cert`, which is a pre-encoded certificate (i.e. a type wrapper over a `Vec`). These certificates are stored as-is by the Arti native keystore (the bytes are written to a file on disk). When retrieving a `TorEd25519Cert`, the Arti keystore uses `parse_certificate_erased()` to parse the cert into a `ParsedEd25519Cert` before returning it as a type-erased `ErasedKey`. This works as intended with the `KeyMgr` retrieval and downcasting logic, which expects the certificate to be returned in the `ParsedCert` format specified in the `ToEncodableCert` implementation. Before this change, the ephemeral keystore, on the other hand, did not play well with the `KeyMgr` when it came to cert retrieval: it would incorrectly store the `KeystoreItem` as-is, and retrieve it as an `ErasedKey` using the `ErasedKey::into_erased()` implementation. This would then cause the `KeyMgr` to fail to downcast the `ErasedKey` to the correct type (because the returned erased item was of a different type than `ParsedCert`). This commit also removes `KeystoreItem::into_erased()`, which was a footgun (because certificates are not actually supposed to be retrieved in the format returned by `CertData::into_erased()`).

tor-key-forge: Add wrappers for various cert types.

2025-01-13T19:28:23Z

tor-key-forge: Implement KeystoreItem::item_type.

2024-12-04T16:42:06Z

tor-key-forge: Implement EncodableItem for Tor ed25519 certs.

2024-12-04T16:42:06Z

This will enable us to store `tor_cert::EncodedEd25519Cert`s in the keystore.

tor-key-forge: Add an encodable cert type.

2024-12-04T16:40:45Z