mirrors/arti.git/crates/tor-keymgr/src/arti_path.rs, branch arti-v2.2.0

keymgr: Do not elide leading empty denotator groups

2026-03-05T16:54:30Z

Addresses https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3754#note_3361904

keymgr: Replace literal value with constant

2026-03-05T16:41:29Z

keymgr: Add test for paths with empty denotator groups (fmt)

2026-03-05T11:53:19Z

keymgr: Add test for paths with empty denotator groups

2026-03-05T11:53:19Z

keymgr: Add more tests for cert ArtiPath construction (fmt)

2026-03-05T11:53:19Z

keymgr: Add more tests for cert ArtiPath construction

2026-03-05T11:53:19Z

This commit is intentionally misindented to make reviewing the diff a bit easier.

keymgr: Update cert ArtiPath building to use denotator groups

2026-03-05T11:53:19Z

In a certificate's `ArtiPath`, the `ArtiPath` of the subject key is now separated from the certificate denotators by `@`. This will enable us to derive the subject key `ArtiPath` from the `ArtiPath` of its certificate. In practice, this change is a no-op for the relay implementation, because none of our certificates have certificate denotators. For instance, the `ArtiPath` of the for the `KP_relaysign_ed` certificate (`KP_relaysign_ed` signed with `KS_relayid_ed`) is of the form `relay/relaysign_ed+` (the only denotators here are the denotators of the subject key). It's important to note that the certifying key is not encoded in the `ArtiPath` of the certificate. The implication is that if we'll ever need to have multiple certs for the same subject key, signed with different with different certifying keys, those certificates will be distinguished by their certificate denotator group. So if we ever need a second certificate for `KP_relaysign_ed`, certified with something other than `KP_relaysign_ed`, it will need to be of the form `relay/relaysign_ed+@`, where `` is a list of `+`-separated certificate denotators. Closes #2377

keymgr: Support having multiple denotator groups within an ArtiPath

2026-03-05T11:53:19Z

This will enable us to parse certificate paths that consist of the `ArtiPath` of the subject key, followed by the denotator group of the certificate.

keymgr: Move denotator group validation to a separate function

2026-03-05T11:47:58Z

keymgr: Update ArtiPath docs with the new denotator rules

2026-03-05T11:47:58Z

This introduces the concept of a "denotator group", and new syntax for separating denotator groups within an ArtiPath. The implementation will follow in a separate commit.