mirrors/arti.git/crates/tor-relay-crypto/src, branch arti-v2.2.0mirror of https://gitlab.torproject.org/tpo/core/arti
http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v2.2.02026-03-26T19:20:16Ztor-relay-crypto: port to web-time-compat2026-03-26T19:20:16ZNick Mathewsonnickm@torproject.org2026-03-26T14:06:45Zurn:sha1:3dd9cb6493681f12bb1b0e9426832fae478f2174relay: Rewrite the rotation key logic in the crypto task2026-03-17T19:07:06ZDavid Gouletdgoulet@torproject.org2026-03-12T19:23:19Zurn:sha1:2ffce9efd3b3dd30a0cbfd7e7af5484dc1f7031f
This is almost a full rewrite of the crypto task which was needed in
order to support our relay signing certificate to be put in the keystore
which will be needed for the offline key feature.
Instead of having rotate_key() do all the things, we now instead do two
pass:
1. Remove all expired keys and certs.
2. Generate any missing keys.
This still results in using the minimum valid_until of all our keys for
the task sleep time.
We can know cleanup the local trait used for this gymnastic and trade it
for some more KeyMgr gymnastic.
Fixes #2404
Signed-off-by: David Goulet <dgoulet@torproject.org>
relay-crypto: Add test for cert specifier patterns2026-03-12T14:56:39ZGabriela Moldovangabi@torproject.org2026-03-05T18:50:50Zurn:sha1:daefbb9f1220ab25209db114ee03042f230a340a
For relays these are pretty basic (they have no globbing components),
because relay certs don't have specifiers (their `ArtiPath`s are
identical to the `ArtiPath` of the subject key).
relay-crypto: Use the new CertSpecifier macro2026-03-12T14:56:39ZGabriela Moldovangabi@torproject.org2026-02-26T18:34:04Zurn:sha1:4f7bed95068c60e3021ac423097273b0d8f99ccc
This enables the `experimental-api` feature in `tor-keymgr` because
`CertSpecifier` is experimental.
keymgr: Abolish KeyCertificateSpecifier::signing_key_specifier()2026-03-12T14:56:35ZGabriela Moldovangabi@torproject.org2026-02-27T16:19:34Zurn:sha1:29b8feb559114245e95a9de561b504e3e387fcd4
We need to be able to parse KeyPaths into KeyCertificateSpecifier,
and we can't do that if the signing key is part of the cert specifier
(because the signing key doesn't get encoded in the key path, unlike the
subject key, which does)
relay-crypto: Move comments above [derive] to be consistent accross codebase2026-02-23T20:17:32ZDavid Gouletdgoulet@torproject.org2026-02-23T19:43:13Zurn:sha1:ce6416f8a53a9be80110216f1876ae67cab5410a
Signed-off-by: David Goulet <dgoulet@torproject.org>
relay-crypto: Fix the gen relay signing keypair typo2026-02-23T20:17:32ZDavid Gouletdgoulet@torproject.org2026-02-18T18:39:48Zurn:sha1:4829f1a2dbffc1686c5be655eb9f44c409f0738d
Signed-off-by: David Goulet <dgoulet@torproject.org>
relay-crypto: Add gen_tls_cert() helper function2026-02-23T20:17:32ZDavid Gouletdgoulet@torproject.org2026-02-18T17:48:41Zurn:sha1:481aea524495caabae81200a9a5fd2e33f05684a
Signed-off-by: David Goulet <dgoulet@torproject.org>
relay-crypto: Add missing helper functions2026-02-23T20:17:32ZDavid Gouletdgoulet@torproject.org2026-02-17T16:56:57Zurn:sha1:74dfd50dfaaf0352599b80a528804e7f9421f67c
Signed-off-by: David Goulet <dgoulet@torproject.org>
relay-crypto: Add link signing key specifier2026-02-23T20:17:32ZDavid Gouletdgoulet@torproject.org2026-02-17T16:55:14Zurn:sha1:248df034284f5651ec21fdf8182e2a73a08880eb
Signed-off-by: David Goulet <dgoulet@torproject.org>