mirrors/arti.git/crates/tor-keymgr/src/arti_path.rs, branch main

Remove now-unneeded allow(clippy::cognitive_complexity)

2026-07-15T18:05:29Z

maint: Run maint/add_warning to deny string slices

2026-06-09T15:36:01Z

This commit executes maint/add_warning with the just added change to deny string slices except in tests. I recommend auditing this by checking out the previous commit followed by running the script yourself and then verifying that the diff is identical to this commit. This commit makes cargo clippy fail. We will add exceptions in the next commit.

keymgr: Do not elide leading empty denotator groups

2026-03-05T16:54:30Z

Addresses https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3754#note_3361904

keymgr: Replace literal value with constant

2026-03-05T16:41:29Z

keymgr: Add test for paths with empty denotator groups (fmt)

2026-03-05T11:53:19Z

keymgr: Add test for paths with empty denotator groups

2026-03-05T11:53:19Z

keymgr: Add more tests for cert ArtiPath construction (fmt)

2026-03-05T11:53:19Z

keymgr: Add more tests for cert ArtiPath construction

2026-03-05T11:53:19Z

This commit is intentionally misindented to make reviewing the diff a bit easier.

keymgr: Update cert ArtiPath building to use denotator groups

2026-03-05T11:53:19Z

In a certificate's `ArtiPath`, the `ArtiPath` of the subject key is now separated from the certificate denotators by `@`. This will enable us to derive the subject key `ArtiPath` from the `ArtiPath` of its certificate. In practice, this change is a no-op for the relay implementation, because none of our certificates have certificate denotators. For instance, the `ArtiPath` of the for the `KP_relaysign_ed` certificate (`KP_relaysign_ed` signed with `KS_relayid_ed`) is of the form `relay/relaysign_ed+` (the only denotators here are the denotators of the subject key). It's important to note that the certifying key is not encoded in the `ArtiPath` of the certificate. The implication is that if we'll ever need to have multiple certs for the same subject key, signed with different with different certifying keys, those certificates will be distinguished by their certificate denotator group. So if we ever need a second certificate for `KP_relaysign_ed`, certified with something other than `KP_relaysign_ed`, it will need to be of the form `relay/relaysign_ed+@`, where `` is a list of `+`-separated certificate denotators. Closes #2377

keymgr: Support having multiple denotator groups within an ArtiPath

2026-03-05T11:53:19Z

This will enable us to parse certificate paths that consist of the `ArtiPath` of the subject key, followed by the denotator group of the certificate.