From 4865d3698df10ad3a045490b9b5ad29f6068d370 Mon Sep 17 00:00:00 2001 From: yuyr Date: Thu, 16 Jul 2026 22:54:59 +0800 Subject: [PATCH] =?UTF-8?q?20260716=20=E6=BE=84=E6=B8=85CA=E9=AA=8C?= =?UTF-8?q?=E8=AF=81=E4=B8=8A=E4=B8=8B=E6=96=87=E6=91=98=E8=A6=81=E5=91=BD?= =?UTF-8?q?=E5=90=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/storage.rs | 22 +++++----- src/storage/tests.rs | 4 +- src/validation/objects.rs | 65 +++++++++++++++-------------- src/validation/tree_parallel.rs | 2 +- src/validation/tree_runner.rs | 42 +++++++++++-------- src/validation/tree_runner/tests.rs | 14 +++---- 6 files changed, 79 insertions(+), 70 deletions(-) diff --git a/src/storage.rs b/src/storage.rs index 9ad4e75..cd42805 100644 --- a/src/storage.rs +++ b/src/storage.rs @@ -603,7 +603,7 @@ pub struct VcirFailedFetchReuseIdentity { pub ta_context_digest: [u8; 32], #[serde(rename = "p")] #[serde(with = "serde_bytes_32")] - pub parent_context_digest: [u8; 32], + pub ca_validation_context_digest: [u8; 32], #[serde(rename = "f")] #[serde(with = "serde_bytes_32")] pub policy_fingerprint: [u8; 32], @@ -1125,7 +1125,7 @@ pub struct RoaCacheObjectMeta { #[derive(Clone, Debug, PartialEq, Eq)] pub struct RoaCacheProjectionContext { - pub parent_context_digest: [u8; 32], + pub ca_validation_context_digest: [u8; 32], pub policy_fingerprint: [u8; 32], pub object_meta: Vec, } @@ -1266,7 +1266,7 @@ pub struct RoaCacheProjection { pub issuer_ca_sha256_hex: Option, #[serde(rename = "p", default, skip_serializing_if = "Option::is_none")] #[serde(with = "serde_optional_bytes_32")] - pub parent_context_digest: Option<[u8; 32]>, + pub ca_validation_context_digest: Option<[u8; 32]>, #[serde(rename = "f", default, skip_serializing_if = "Option::is_none")] #[serde(with = "serde_optional_bytes_32")] pub policy_fingerprint: Option<[u8; 32]>, @@ -1408,7 +1408,7 @@ pub struct ChildCertificateCacheProjection { pub issuer_crl_sha256_hex: String, #[serde(rename = "pc")] #[serde(with = "serde_bytes_32")] - pub parent_context_digest: [u8; 32], + pub ca_validation_context_digest: [u8; 32], #[serde(rename = "pf")] #[serde(with = "serde_bytes_32")] pub validation_policy_fingerprint: [u8; 32], @@ -1715,7 +1715,7 @@ pub struct PublicationPointCacheProjection { pub ta_context_digest: [u8; 32], #[serde(rename = "pc")] #[serde(with = "serde_bytes_32")] - pub parent_context_digest: [u8; 32], + pub ca_validation_context_digest: [u8; 32], #[serde(rename = "pf")] #[serde(with = "serde_bytes_32")] pub validation_policy_fingerprint: [u8; 32], @@ -1751,7 +1751,7 @@ impl PublicationPointCacheProjection { ca_cert_sha256: [u8; 32], manifest_sha256: [u8; 32], ta_context_digest: [u8; 32], - parent_context_digest: [u8; 32], + ca_validation_context_digest: [u8; 32], validation_policy_fingerprint: [u8; 32], ) -> StorageResult { let projection = Self { @@ -1764,7 +1764,7 @@ impl PublicationPointCacheProjection { manifest_sha256, tal_id: vcir.tal_id.clone(), ta_context_digest, - parent_context_digest, + ca_validation_context_digest, validation_policy_fingerprint, instance_effective_not_before: vcir.last_successful_validation_time.clone(), instance_effective_until: vcir.instance_gate.instance_effective_until.clone(), @@ -1819,7 +1819,7 @@ impl PublicationPointCacheProjection { tal_id: self.tal_id.clone(), ca_subject_name: String::from("publication-point-cache"), ca_ski: hex::encode(self.ca_cert_sha256), - issuer_ski: hex::encode(self.parent_context_digest), + issuer_ski: hex::encode(self.ca_validation_context_digest), last_successful_validation_time: validation_time.clone(), current_manifest_rsync_uri: self.manifest_rsync_uri.clone(), current_crl_rsync_uri: self @@ -2050,7 +2050,7 @@ impl RoaCacheProjection { manifest_rsync_uri: vcir.manifest_rsync_uri.clone(), instance_effective_until: vcir.instance_gate.instance_effective_until.clone(), issuer_ca_sha256_hex, - parent_context_digest: Some(context.parent_context_digest), + ca_validation_context_digest: Some(context.ca_validation_context_digest), policy_fingerprint: Some(context.policy_fingerprint), crl_sha256_by_uri, entries, @@ -2071,10 +2071,10 @@ impl RoaCacheProjection { if let Some(hash) = &self.issuer_ca_sha256_hex { validate_sha256_hex("roa_cache_projection.issuer_ca_sha256_hex", hash)?; } - if self.parent_context_digest.is_some() != self.policy_fingerprint.is_some() { + if self.ca_validation_context_digest.is_some() != self.policy_fingerprint.is_some() { return Err(StorageError::InvalidData { entity: "roa_cache_projection.context", - detail: "parent_context_digest and policy_fingerprint must be both present or both absent" + detail: "ca_validation_context_digest and policy_fingerprint must be both present or both absent" .to_string(), }); } diff --git a/src/storage/tests.rs b/src/storage/tests.rs index bd18bd0..b207cc8 100644 --- a/src/storage/tests.rs +++ b/src/storage/tests.rs @@ -29,7 +29,7 @@ fn sample_child_certificate_cache_projection( issuer_ca_sha256_hex: sha256_hex(b"issuer-ca"), issuer_crl_uri: "rsync://example.test/repo/issuer.crl".to_string(), issuer_crl_sha256_hex: sha256_hex(b"issuer-crl"), - parent_context_digest: sha256_32(b"parent-context"), + ca_validation_context_digest: sha256_32(b"parent-context"), validation_policy_fingerprint: sha256_32(b"policy"), effective_not_before: pack_time(0), effective_until: pack_time(24), @@ -294,7 +294,7 @@ fn roa_cache_projection_context(vcir: &ValidatedCaInstanceResult) -> RoaCachePro }) .expect("sample VCIR has a ROA output"); RoaCacheProjectionContext { - parent_context_digest: [0x31; 32], + ca_validation_context_digest: [0x31; 32], policy_fingerprint: [0x32; 32], object_meta: vec![RoaCacheObjectMeta { source_object_uri: roa_output.source_object_uri.clone(), diff --git a/src/validation/objects.rs b/src/validation/objects.rs index ff449d7..37bfb12 100644 --- a/src/validation/objects.rs +++ b/src/validation/objects.rs @@ -180,7 +180,7 @@ pub struct RoaValidationCacheStats { pub struct RoaValidationCacheInput<'a> { enabled: bool, view: Option<&'a RoaValidationCacheView>, - parent_context_digest: Option<[u8; 32]>, + ca_validation_context_digest: Option<[u8; 32]>, policy_fingerprint: Option<[u8; 32]>, } @@ -189,7 +189,7 @@ impl<'a> RoaValidationCacheInput<'a> { Self { enabled: false, view: None, - parent_context_digest: None, + ca_validation_context_digest: None, policy_fingerprint: None, } } @@ -198,20 +198,20 @@ impl<'a> RoaValidationCacheInput<'a> { Self { enabled: true, view, - parent_context_digest: None, + ca_validation_context_digest: None, policy_fingerprint: None, } } pub fn enabled_with_context( view: Option<&'a RoaValidationCacheView>, - parent_context_digest: [u8; 32], + ca_validation_context_digest: [u8; 32], policy_fingerprint: [u8; 32], ) -> Self { Self { enabled: true, view, - parent_context_digest: Some(parent_context_digest), + ca_validation_context_digest: Some(ca_validation_context_digest), policy_fingerprint: Some(policy_fingerprint), } } @@ -495,7 +495,7 @@ fn evaluate_roa_cache_crl_gate( pub struct RoaValidationCacheView { entries_by_uri: HashMap, issuer_ca_sha256_hex: Option, - parent_context_digest: Option<[u8; 32]>, + ca_validation_context_digest: Option<[u8; 32]>, policy_fingerprint: Option<[u8; 32]>, crl_sha256_by_uri: HashMap, blocked: bool, @@ -519,7 +519,7 @@ impl RoaValidationCacheView { let mut entries_by_uri: HashMap = HashMap::with_capacity(projection.entries.len()); let issuer_ca_sha256_hex = projection.issuer_ca_sha256_hex.clone(); - let parent_context_digest = projection.parent_context_digest; + let ca_validation_context_digest = projection.ca_validation_context_digest; let policy_fingerprint = projection.policy_fingerprint; let crl_sha256_by_uri = projection .crl_sha256_by_uri @@ -536,7 +536,7 @@ impl RoaValidationCacheView { return Self { entries_by_uri, issuer_ca_sha256_hex, - parent_context_digest, + ca_validation_context_digest, policy_fingerprint, crl_sha256_by_uri, blocked, @@ -580,7 +580,7 @@ impl RoaValidationCacheView { Self { entries_by_uri, issuer_ca_sha256_hex, - parent_context_digest, + ca_validation_context_digest, policy_fingerprint, crl_sha256_by_uri, blocked, @@ -590,7 +590,7 @@ impl RoaValidationCacheView { fn matches_current_context( &self, issuer_ca_der: &[u8], - parent_context_digest: Option<[u8; 32]>, + ca_validation_context_digest: Option<[u8; 32]>, policy_fingerprint: Option<[u8; 32]>, ) -> bool { if self.blocked { @@ -604,8 +604,8 @@ impl RoaValidationCacheView { return false; } - if let Some(expected_parent_context) = self.parent_context_digest { - if Some(expected_parent_context) != parent_context_digest { + if let Some(expected_ca_validation_context) = self.ca_validation_context_digest { + if Some(expected_ca_validation_context) != ca_validation_context_digest { return false; } } else { @@ -797,7 +797,7 @@ fn active_roa_cache_view<'a>( let gate_started = Instant::now(); if view.matches_current_context( issuer_ca_der, - roa_cache.parent_context_digest, + roa_cache.ca_validation_context_digest, roa_cache.policy_fingerprint, ) { stats.context_gate_nanos = stats @@ -3914,7 +3914,7 @@ mod tests { OffsetDateTime::parse(value, &Rfc3339).expect("parse fixed test time") } - const TEST_PARENT_CONTEXT: [u8; 32] = [0x70; 32]; + const TEST_CA_VALIDATION_CONTEXT: [u8; 32] = [0x70; 32]; const TEST_POLICY_FINGERPRINT: [u8; 32] = [0x71; 32]; const TEST_CRL_URI: &str = "rsync://example.test/repo/current.crl"; const TEST_ROA_URI: &str = "rsync://example.test/repo/a.roa"; @@ -3933,7 +3933,7 @@ mod tests { RoaCacheProjection::from_vcir_with_context( vcir, Some(&RoaCacheProjectionContext { - parent_context_digest: TEST_PARENT_CONTEXT, + ca_validation_context_digest: TEST_CA_VALIDATION_CONTEXT, policy_fingerprint: TEST_POLICY_FINGERPRINT, object_meta: vec![RoaCacheObjectMeta { source_object_uri: TEST_ROA_URI.to_string(), @@ -4071,7 +4071,7 @@ mod tests { assert!(view.matches_current_context( issuer_der, - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); let hit = view.lookup(&file, &mut crl_cache, issuer_der, validation_time); @@ -4202,7 +4202,10 @@ mod tests { fixed_time("2026-06-08T00:00:00Z"), ); let projection = sample_roa_cache_projection(&vcir, roa_hash); - assert_eq!(projection.parent_context_digest, Some(TEST_PARENT_CONTEXT)); + assert_eq!( + projection.ca_validation_context_digest, + Some(TEST_CA_VALIDATION_CONTEXT) + ); assert_eq!(projection.policy_fingerprint, Some(TEST_POLICY_FINGERPRINT)); assert_eq!( projection.entries[0].outputs_effective_until_unix, @@ -4245,7 +4248,7 @@ mod tests { let issuer_changed = RoaValidationCacheView::from_projection(&projection, validation_time); assert!(!issuer_changed.matches_current_context( issuer_der, - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); @@ -4258,7 +4261,7 @@ mod tests { )); assert!(!parent_changed.matches_current_context( issuer_der, - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some([0x98; 32]) )); @@ -4283,7 +4286,7 @@ mod tests { RoaValidationCacheView::from_projection(&expired_projection, validation_time); assert!(!expired_view.matches_current_context( issuer_der, - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); let mut crl_cache = sample_crl_cache(b"current-crl".to_vec()); @@ -4563,7 +4566,7 @@ mod tests { assert!(view.matches_current_context( issuer_der, - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); assert!(matches!( @@ -4595,43 +4598,43 @@ mod tests { let mut view = RoaValidationCacheView { entries_by_uri: HashMap::new(), issuer_ca_sha256_hex: None, - parent_context_digest: Some(TEST_PARENT_CONTEXT), + ca_validation_context_digest: Some(TEST_CA_VALIDATION_CONTEXT), policy_fingerprint: Some(TEST_POLICY_FINGERPRINT), crl_sha256_by_uri: HashMap::new(), blocked: false, }; assert!(!view.matches_current_context( b"issuer-ca", - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); view.issuer_ca_sha256_hex = Some("00".repeat(32)); assert!(!view.matches_current_context( b"issuer-ca", - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); view.issuer_ca_sha256_hex = Some(sha256_hex(b"issuer-ca")); assert!(view.matches_current_context( b"issuer-ca", - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); assert!(!view.matches_current_context(b"issuer-ca", None, Some(TEST_POLICY_FINGERPRINT))); - view.parent_context_digest = None; + view.ca_validation_context_digest = None; assert!(!view.matches_current_context( b"issuer-ca", - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); - view.parent_context_digest = Some(TEST_PARENT_CONTEXT); + view.ca_validation_context_digest = Some(TEST_CA_VALIDATION_CONTEXT); view.policy_fingerprint = None; assert!(!view.matches_current_context( b"issuer-ca", - Some(TEST_PARENT_CONTEXT), + Some(TEST_CA_VALIDATION_CONTEXT), Some(TEST_POLICY_FINGERPRINT) )); } @@ -4661,7 +4664,7 @@ mod tests { let mut view = RoaValidationCacheView { entries_by_uri: HashMap::new(), issuer_ca_sha256_hex: Some(sha256_hex(issuer_der)), - parent_context_digest: Some(TEST_PARENT_CONTEXT), + ca_validation_context_digest: Some(TEST_CA_VALIDATION_CONTEXT), policy_fingerprint: Some(TEST_POLICY_FINGERPRINT), crl_sha256_by_uri: HashMap::from([(TEST_CRL_URI.to_string(), crl_hash_hex.clone())]), blocked: false, @@ -4849,7 +4852,7 @@ mod tests { false, RoaValidationCacheInput::enabled_with_context( Some(&view), - TEST_PARENT_CONTEXT, + TEST_CA_VALIDATION_CONTEXT, TEST_POLICY_FINGERPRINT, ), ) { diff --git a/src/validation/tree_parallel.rs b/src/validation/tree_parallel.rs index dfd5081..ba6eea2 100644 --- a/src/validation/tree_parallel.rs +++ b/src/validation/tree_parallel.rs @@ -1178,7 +1178,7 @@ fn stage_ready_publication_point( let roa_cache = if runner.enable_roa_validation_cache && has_roa { RoaValidationCacheInput::enabled_with_context( roa_cache_view.as_ref(), - crate::validation::tree_runner::parent_context_digest_for_ca(&ready.node.handle), + crate::validation::tree_runner::ca_validation_context_digest_for_ca(&ready.node.handle), crate::validation::tree_runner::publication_point_cache_policy_fingerprint( runner.policy, ), diff --git a/src/validation/tree_runner.rs b/src/validation/tree_runner.rs index 7b5f40f..d8821a0 100644 --- a/src/validation/tree_runner.rs +++ b/src/validation/tree_runner.rs @@ -304,7 +304,8 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> { self.finish_publication_point_cache_miss(ca, "ta_context_mismatch", lookup_started); return None; } - if projection.parent_context_digest != current_identity.parent_context_digest { + if projection.ca_validation_context_digest != current_identity.ca_validation_context_digest + { self.finish_publication_point_cache_miss(ca, "parent_context_mismatch", lookup_started); return None; } @@ -505,7 +506,7 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> { ca_cert_sha256, manifest_sha256, ta_context_digest: ta_context_digest_for_ca(ca), - parent_context_digest: parent_context_digest_for_ca(ca), + ca_validation_context_digest: ca_validation_context_digest_for_ca(ca), policy_fingerprint: publication_point_cache_policy_fingerprint(self.policy), }) } @@ -938,7 +939,7 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> { Some(ChildCertificateValidationCacheContext { store: self.store, issuer_ca_sha256: sha256_digest_32(issuer_ca_der.as_ref()), - parent_context_digest: parent_context_digest_for_ca(ca), + ca_validation_context_digest: ca_validation_context_digest_for_ca(ca), policy_fingerprint: publication_point_cache_policy_fingerprint(self.policy), }) } else { @@ -1530,7 +1531,7 @@ impl<'a> PublicationPointRunner for Rpkiv1PublicationPointRunner<'a> { let roa_cache = if self.enable_roa_validation_cache && has_roa { RoaValidationCacheInput::enabled_with_context( roa_cache_view.as_ref(), - parent_context_digest_for_ca(ca), + ca_validation_context_digest_for_ca(ca), publication_point_cache_policy_fingerprint(self.policy), ) } else { @@ -1946,7 +1947,7 @@ struct PublicationPointCacheIdentity { ca_cert_sha256: [u8; 32], manifest_sha256: [u8; 32], ta_context_digest: [u8; 32], - parent_context_digest: [u8; 32], + ca_validation_context_digest: [u8; 32], policy_fingerprint: [u8; 32], } @@ -1982,7 +1983,7 @@ fn ta_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] { ]) } -pub(crate) fn parent_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] { +pub(crate) fn ca_validation_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] { hash_serialized_parts(&[ ( "version", @@ -2058,7 +2059,7 @@ fn pack_time_window_contains( struct ChildCertificateValidationCacheContext<'a> { store: &'a RocksStore, issuer_ca_sha256: [u8; 32], - parent_context_digest: [u8; 32], + ca_validation_context_digest: [u8; 32], policy_fingerprint: [u8; 32], } @@ -2066,7 +2067,7 @@ fn child_certificate_cache_key_sha256_hex( child_cert_uri: &str, child_cert_sha256: &[u8; 32], issuer_ca_sha256: &[u8; 32], - parent_context_digest: &[u8; 32], + ca_validation_context_digest: &[u8; 32], policy_fingerprint: &[u8; 32], ) -> String { let digest = hash_serialized_parts(&[ @@ -2074,7 +2075,11 @@ fn child_certificate_cache_key_sha256_hex( ("child_cert_uri", child_cert_uri.as_bytes().to_vec()), ("child_cert_sha256", child_cert_sha256.to_vec()), ("issuer_ca_sha256", issuer_ca_sha256.to_vec()), - ("parent_context_digest", parent_context_digest.to_vec()), + // Keep the persisted cache-key label stable; this change only renames Rust identifiers. + ( + "parent_context_digest", + ca_validation_context_digest.to_vec(), + ), ("policy_fingerprint", policy_fingerprint.to_vec()), ]); sha256_hex_from_32(&digest) @@ -2469,7 +2474,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der< &f.rsync_uri, &f.sha256, &cache.issuer_ca_sha256, - &cache.parent_context_digest, + &cache.ca_validation_context_digest, &cache.policy_fingerprint, )); } @@ -3022,7 +3027,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der< &f.rsync_uri, &f.sha256, &cache.issuer_ca_sha256, - &cache.parent_context_digest, + &cache.ca_validation_context_digest, &cache.policy_fingerprint, ); let projection = ChildCertificateCacheProjection { @@ -3040,7 +3045,8 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der< ), issuer_crl_uri: issuer_crl_uri.clone(), issuer_crl_sha256_hex: verified_crl.sha256_hex.clone(), - parent_context_digest: cache.parent_context_digest, + ca_validation_context_digest: cache + .ca_validation_context_digest, validation_policy_fingerprint: cache.policy_fingerprint, effective_not_before, effective_until, @@ -3239,7 +3245,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der< &f.rsync_uri, &f.sha256, &cache.issuer_ca_sha256, - &cache.parent_context_digest, + &cache.ca_validation_context_digest, &cache.policy_fingerprint, ); let projection = ChildCertificateCacheProjection { @@ -3255,7 +3261,7 @@ fn discover_children_from_fresh_snapshot_with_audit_cached_with_issuer_der< issuer_ca_sha256_hex: sha256_hex_from_32(&cache.issuer_ca_sha256), issuer_crl_uri: issuer_crl_uri.clone(), issuer_crl_sha256_hex: verified_crl.sha256_hex.clone(), - parent_context_digest: cache.parent_context_digest, + ca_validation_context_digest: cache.ca_validation_context_digest, validation_policy_fingerprint: cache.policy_fingerprint, effective_not_before, effective_until, @@ -4395,7 +4401,7 @@ fn failed_fetch_reuse_identity_for_fresh_result( let identity = VcirFailedFetchReuseIdentity { current_ca_sha256, ta_context_digest: ta_context_digest_for_ca(ca), - parent_context_digest: parent_context_digest_for_ca(ca), + ca_validation_context_digest: ca_validation_context_digest_for_ca(ca), policy_fingerprint: publication_point_cache_policy_fingerprint(policy), effective_not_before: PackTime::from_utc_offset_datetime(validation_time), effective_until, @@ -4418,7 +4424,7 @@ fn failed_fetch_reuse_identity_matches_current( }; cached.current_ca_sha256 == current_ca_sha256 && cached.ta_context_digest == ta_context_digest_for_ca(ca) - && cached.parent_context_digest == parent_context_digest_for_ca(ca) + && cached.ca_validation_context_digest == ca_validation_context_digest_for_ca(ca) && cached.policy_fingerprint == publication_point_cache_policy_fingerprint(policy) && cached.effective_until == vcir.instance_gate.instance_effective_until && cached.contains_validation_time(validation_time) @@ -5347,7 +5353,7 @@ fn persist_vcir_for_fresh_result_with_timing( .replace_vcir_manifest_replay_meta_and_projection_action_with_failed_fetch_reuse_identity( &vcir, Some(&RoaCacheProjectionContext { - parent_context_digest: parent_context_digest_for_ca(ca), + ca_validation_context_digest: ca_validation_context_digest_for_ca(ca), policy_fingerprint: publication_point_cache_policy_fingerprint(policy), object_meta: objects.roa_cache_object_meta.clone(), }), @@ -5378,7 +5384,7 @@ fn build_publication_point_cache_projection_from_fresh( ca_cert_sha256, manifest_sha256, ta_context_digest_for_ca(ca), - parent_context_digest_for_ca(ca), + ca_validation_context_digest_for_ca(ca), publication_point_cache_policy_fingerprint(policy), ) .map_err(|e| e.to_string()) diff --git a/src/validation/tree_runner/tests.rs b/src/validation/tree_runner/tests.rs index a57b9aa..8efc568 100644 --- a/src/validation/tree_runner/tests.rs +++ b/src/validation/tree_runner/tests.rs @@ -1601,7 +1601,7 @@ fn discover_children_child_certificate_cache_reuses_successful_child_ca() { let cache_context = ChildCertificateValidationCacheContext { store: &store, issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), - parent_context_digest: parent_context_digest_for_ca(&issuer), + ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), }; let validation_time = time::OffsetDateTime::now_utc(); @@ -1625,7 +1625,7 @@ fn discover_children_child_certificate_cache_reuses_successful_child_ca() { &child_file.rsync_uri, &child_file.sha256, &cache_context.issuer_ca_sha256, - &cache_context.parent_context_digest, + &cache_context.ca_validation_context_digest, &cache_context.policy_fingerprint, ); assert!( @@ -1724,7 +1724,7 @@ fn discover_children_child_certificate_cache_rechecks_changed_valid_crl() { let cache_context = ChildCertificateValidationCacheContext { store: &store, issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), - parent_context_digest: parent_context_digest_for_ca(&issuer), + ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), }; let validation_time = time::OffsetDateTime::now_utc(); @@ -1745,7 +1745,7 @@ fn discover_children_child_certificate_cache_rechecks_changed_valid_crl() { &child_file.rsync_uri, &child_file.sha256, &cache_context.issuer_ca_sha256, - &cache_context.parent_context_digest, + &cache_context.ca_validation_context_digest, &cache_context.policy_fingerprint, ); let projection = store @@ -1832,7 +1832,7 @@ fn discover_children_child_certificate_cache_misses_when_current_crl_invalid() { let cache_context = ChildCertificateValidationCacheContext { store: &store, issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), - parent_context_digest: parent_context_digest_for_ca(&issuer), + ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), }; let validation_time = time::OffsetDateTime::now_utc(); @@ -1907,7 +1907,7 @@ fn discover_children_child_certificate_cache_misses_when_unchanged_crl_expired() let cache_context = ChildCertificateValidationCacheContext { store: &store, issuer_ca_sha256: issuer.ca_certificate_sha256_32().unwrap(), - parent_context_digest: parent_context_digest_for_ca(&issuer), + ca_validation_context_digest: ca_validation_context_digest_for_ca(&issuer), policy_fingerprint: publication_point_cache_policy_fingerprint(&policy), }; let validation_time = time::OffsetDateTime::now_utc(); @@ -2436,7 +2436,7 @@ fn seed_publication_point_cache_projection( ca.ca_certificate_sha256_32().unwrap(), sha256_32(b"manifest-bytes"), ta_context_digest_for_ca(ca), - parent_context_digest_for_ca(ca), + ca_validation_context_digest_for_ca(ca), publication_point_cache_policy_fingerprint(policy), ) .expect("build publication point projection");