yuyr/panda-rpki-oss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden first-release validation and dependency hygiene
Some checks failed
ci / rust (push) Has been cancelled
Details
ci / docker (push) Has been cancelled
Details
ci / audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
yuyr
2026-09-10 09:53:45 +08:00
parent 277cbca878
commit 591bed90a8
61 changed files with 1641 additions and 622 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
src/validation/tree_runner/fresh_pipeline.rs
View File

@@ -232,16 +232,26 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
let mut ccr_append_ms = 0;
if self.ccr_accumulator.is_some() {
let ccr_projection_build_started = std::time::Instant::now();
let subordinate_skis = discovered_children.iter().map(|child| {
if let Some(projection) = &child.child_entry_projection {
return hex::decode(&projection.child_ski).map_err(|error| error.to_string());
}
let der = child.handle.ca_certificate_der(self.store)?;
let certificate = ResourceCertificate::decode_der(der.as_ref()).map_err(|error| error.to_string())?;
certificate.tbs.extensions.subject_key_identifier.clone()
.ok_or_else(|| "child certificate missing SubjectKeyIdentifier".to_string())
}).collect::<Result<Vec<_>, String>>()?;
let ccr_manifest_projection = crate::ccr::projection::from_snapshot(ca, &pack, subordinate_skis)?;
let subordinate_skis = discovered_children
.iter()
.map(|child| {
if let Some(projection) = &child.child_entry_projection {
return hex::decode(&projection.child_ski)
.map_err(|error| error.to_string());
}
let der = child.handle.ca_certificate_der(self.store)?;
let certificate = ResourceCertificate::decode_der(der.as_ref())
.map_err(|error| error.to_string())?;
certificate
.tbs
.extensions
.subject_key_identifier
.clone()
.ok_or_else(|| "child certificate missing SubjectKeyIdentifier".to_string())
})
.collect::<Result<Vec<_>, String>>()?;
let ccr_manifest_projection =
crate::ccr::projection::from_snapshot(ca, &pack, subordinate_skis)?;
ccr_projection_build_ms = ccr_projection_build_started.elapsed().as_millis() as u64;
let ccr_append_started = std::time::Instant::now();
self.append_ccr_manifest_projection(&ccr_manifest_projection)?;
@@ -296,15 +306,18 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
// Commit protocol freshness only after successful publication-point
// validation/finalization, independently of optional CCR output.
self.store.put_manifest_anti_rollback_meta(
&crate::repository::storage::ManifestAntiRollbackMeta {
manifest_rsync_uri: pack.manifest_rsync_uri.clone(),
manifest_number_be: pack.manifest_number_be.clone(),
manifest_this_update: pack.this_update.clone(),
manifest_sha256: <sha2::Sha256 as sha2::Digest>::digest(&pack.manifest_bytes).to_vec(),
updated_at_validation_time: pack.verified_at.clone(),
},
).map_err(|error| format!("persist manifest freshness failed: {error}"))?;
self.store
.put_manifest_anti_rollback_meta(
&crate::repository::storage::ManifestAntiRollbackMeta {
manifest_rsync_uri: pack.manifest_rsync_uri.clone(),
manifest_number_be: pack.manifest_number_be.clone(),
manifest_this_update: pack.this_update.clone(),
manifest_sha256: <sha2::Sha256 as sha2::Digest>::digest(&pack.manifest_bytes)
.to_vec(),
updated_at_validation_time: pack.verified_at.clone(),
},
)
.map_err(|error| format!("persist manifest freshness failed: {error}"))?;
Ok(FreshPublicationPointFinalizeOutput {
result: PublicationPointRunResult {