mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v1.7.0 2025-03-04T19:45:18Z 2025-03-04T19:45:18Z Nick Mathewson nickm@torproject.org 2025-02-26T22:02:48Z urn:sha1:ede6d75567c1ee81812478e6137032dd568ddb91 The x509-signature crate is archived, and won't see any more releases. Using it is tying us to ring 0.16 internally, which means we depend on two ring versions. Fortunately, rustls-webpki relaxes some of the earlier restrictions from the vanilla webpki crate, which means that its certificate parser now accepts C tor's oddball x509 certificates as valid. With this change, we can delegate to rustls's built-in signature-checking code, and we only have to override its certificate validation. (We still override it with a pile of comments about how we don't validate link certificates much.) I've had to include a few certificates: two are for tests, but one is needed as a placeholder, since we can't construct a rustls certificate validator without a root cert, even if we'll never use it. Closes #1824. Closes #1854.