|
|
The x509-signature crate is archived, and won't see any more
releases. Using it is tying us to ring 0.16 internally,
which means we depend on two ring versions.
Fortunately, rustls-webpki relaxes some of the earlier restrictions
from the vanilla webpki crate, which means that its certificate parser
now accepts C tor's oddball x509 certificates as valid.
With this change, we can delegate to rustls's built-in
signature-checking code, and we only have to override its
certificate validation. (We still override it with a pile of
comments about how we don't validate link certificates much.)
I've had to include a few certificates: two are for tests,
but one is needed as a placeholder, since we can't construct
a rustls certificate validator without a root cert,
even if we'll never use it.
Closes #1824.
Closes #1854.
|
