Repository: scionproto/scion
Pull request #3530 (2019-12-16 14:50:32)

TrustStore: The great export
Export all private types and let the app instantiate the components
as it sees fit.

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/scionproto/scion/3530)
<!-- Reviewable:end -->



Patch:
diff --git a/go/lib/infra/modules/trust/v2/inserter.go b/go/lib/infra/modules/trust/v2/inserter.go
index ad197aac1..4bb0e8c1a 100644
--- a/go/lib/infra/modules/trust/v2/inserter.go
+++ b/go/lib/infra/modules/trust/v2/inserter.go
@@ -47,20 +47,20 @@ type Inserter interface {
 // method of the inserter.
 type TRCProviderFunc func(context.Context, TRCID) (*trc.TRC, error)
 
-// inserter is used to verify and insert trust material into the database.
-type inserter struct {
-	baseInserter
+// DefaultInserter is used to verify and insert trust material into the database.
+type DefaultInserter struct {
+	BaseInserter
 }
 
 // InsertTRC verifies the signed TRC and inserts it into the database.
 // The previous TRC is queried through the provider function, when necessary.
-func (ins *inserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
+func (ins DefaultInserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
 	trcProvider TRCProviderFunc) error {
 
 	if insert, err := ins.shouldInsertTRC(ctx, decTRC, trcProvider); err != nil || !insert {
 		return err
 	}
-	if _, err := ins.db.InsertTRC(ctx, decTRC); err != nil {
+	if _, err := ins.DB.InsertTRC(ctx, decTRC); err != nil {
 		return serrors.WrapStr("unable to insert TRC", err)
 	}
 	return nil
@@ -69,32 +69,32 @@ func (ins *inserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
 // InsertChain verifies the signed certificate chain and inserts it into the
 // database. The issuing TRC is queried through the provider function, when
 // necessary.
-func (ins *inserter) InsertChain(ctx context.Context, chain decoded.Chain,
+func (ins DefaultInserter) InsertChain(ctx context.Context, chain decoded.Chain,
 	trcProvider TRCProviderFunc) error {
 
 	if insert, err := ins.shouldInsertChain(ctx, chain, trcProvider); err != nil || !insert {
 		return err
 	}
-	if _, _, err := ins.db.InsertChain(ctx, chain); err != nil {
+	if _, _, err := ins.DB.InsertChain(ctx, chain); err != nil {
 		return serrors.WrapStr("unable to insert chain", err)
 	}
 	return nil
 }
 
-// fwdInserter is an inserter that always forwards the trust material to the
+// ForwardingInserter is an inserter that always forwards the trust material to the
 // certificate server before inserting it into the database. Forwarding must be
 // successful, otherwise the material is not inserted into the database.
-type fwdInserter struct {
-	baseInserter
-	router localRouter
-	rpc    RPC
+type ForwardingInserter struct {
+	BaseInserter
+	Router LocalRouter
+	RPC    RPC
 }
 
 // InsertTRC verifies the signed TRC and inserts it into the database. The
 // previous TRC is queried through the provider function, when necessary. Before
 // insertion, the TRC is forwarded to the certificate server. If the certificate
 // server does not successfully handle the TRC, the insertion fails.
-func (ins *fwdInserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
+func (ins ForwardingInserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
 	trcProvider TRCProviderFunc) error {
 
 	insert, err := ins.shouldInsertTRC(ctx, decTRC, trcProvider)
@@ -104,11 +104,11 @@ func (ins *fwdInserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
 	if !insert {
 		return nil
 	}
-	cs := ins.router.chooseServer()
-	if err := ins.rpc.SendTRC(ctx, decTRC.Raw, cs); err != nil {
+	cs := ins.Router.chooseServer()
+	if err := ins.RPC.SendTRC(ctx, decTRC.Raw, cs); err != nil {
 		return serrors.WrapStr("unable to push TRC to certificate server", err, "addr", cs)
 	}
-	if _, err := ins.db.InsertTRC(ctx, decTRC); err != nil {
+	if _, err := ins.DB.InsertTRC(ctx, decTRC); err != nil {
 		return serrors.WrapStr("unable to insert TRC", err)
 	}
 	return nil
@@ -119,7 +119,7 @@ func (ins *fwdInserter) InsertTRC(ctx context.Context, decTRC decoded.TRC,
 // necessary. Before insertion, the certificate chain is forwarded to the
 // certificate server. If the certificate server does not successfully handle
 // the certificate chain, the insertion fails.
-func (ins *fwdInserter) InsertChain(ctx context.Context, chain decoded.Chain,
+func (ins ForwardingInserter) InsertChain(ctx context.Context, chain decoded.Chain,
 	trcProvider TRCProviderFunc) error {
 
 	insert, err := ins.shouldInsertChain(ctx, chain, trcProvider)
@@ -129,27 +129,28 @@ func (ins *fwdInserter) InsertChain(ctx context.Context, chain decoded.Chain,
 	if !insert {
 		return nil
 	}
-	cs := ins.router.chooseServer()
-	if err := ins.rpc.SendCertChain(ctx, chain.Raw, cs); err != nil {
+	cs := ins.Router.chooseServer()
+	if err := ins.RPC.SendCertChain(ctx, chain.Raw, cs); err != nil {
 		return serrors.WrapStr("unable to push chain to certificate server", err, "addr", cs)
 	}
-	if _, _, err := ins.db.InsertChain(ctx, chain); err != nil {
+	if _, _, err := ins.DB.InsertChain(ctx, chain); err != nil {
 		return serrors.WrapStr("unable to insert chain", err)
 	}
 	return nil
 }
 
-type baseInserter struct {
-	db ReadWrite
-	// unsafe allows inserts of base TRCs. This is used as a workaround until
+// BaseInserter implements the common functionality of the inserters.
+type BaseInserter struct {
+	DB ReadWrite
+	// Unsafe allows inserts of base TRCs. This is used as a workaround until
 	// TAAC support is implemented.
-	unsafe bool
+	Unsafe bool
 }
 
-func (ins *baseInserter) shouldInsertTRC(ctx context.Context, decTRC decoded.TRC,
+func (ins BaseInserter) shouldInsertTRC(ctx context.Context, decTRC decoded.TRC,
 	trcProvider TRCProviderFunc) (bool, error) {
 
-	found, err := ins.db.TRCExists(ctx, decTRC)
+	found, err := ins.DB.TRCExists(ctx, decTRC)
 	if err != nil {
 		return false, err
 	}
@@ -158,8 +159,8 @@ func (ins *baseInserter) shouldInsertTRC(ctx context.Context, decTRC decoded.TRC
 	}
 	if decTRC.TRC.Base() {
 		// XXX(roosd): remove when TAACs are supported.
-		if ins.unsafe {
-			if _, err := ins.db.InsertTRC(ctx, decTRC); err != nil {
+		if ins.Unsafe {
+			if _, err := ins.DB.InsertTRC(ctx, decTRC); err != nil {
 				return false, serrors.WrapStr("unable to insert base TRC", err)
 			}
 			return false, nil
@@ -177,7 +178,7 @@ func (ins *baseInserter) shouldInsertTRC(ctx context.Context, decTRC decoded.TRC
 	return true, nil
 }
 
-func (ins *baseInserter) checkUpdate(ctx context.Context, prev *trc.TRC, next decoded.TRC) error {
+func (ins BaseInserter) checkUpdate(ctx context.Context, prev *trc.TRC, next decoded.TRC) error {
 	validator := trc.UpdateValidator{
 		Next: next.TRC,
 		Prev: prev,
@@ -197,10 +198,10 @@ func (ins *baseInserter) checkUpdate(ctx context.Context, prev *trc.TRC, next de
 	return nil
 }
 
-func (ins *baseInserter) shouldInsertChain(ctx context.Context, chain decoded.Chain,
+func (ins BaseInserter) shouldInsertChain(ctx context.Context, chain decoded.Chain,
 	trcProvider TRCProviderFunc) (bool, error) {
 
-	found, err := ins.db.ChainExists(ctx, chain)
+	found, err := ins.DB.ChainExists(ctx, chain)
 	if err != nil {
 		return false, err
 	}
@@ -224,7 +225,7 @@ func (ins *baseInserter) shouldInsertChain(ctx context.Context, chain decoded.Ch
 	return true, nil
 }
 
-func (ins *baseInserter) validateChain(chain decoded.Chain) error {
+func (ins BaseInserter) validateChain(chain decoded.Chain) error {
 	if err := chain.Issuer.Validate(); err != nil {
 		return serrors.Wrap(ErrValidation, err, "part", "issuer")
 	}
@@ -234,7 +235,7 @@ func (ins *baseInserter) validateChain(chain decoded.Chain) error {
 	return nil
 }
 
-func (ins *baseInserter) verifyChain(chain decoded.Chain, t *trc.TRC) error {
+func (ins BaseInserter) verifyChain(chain decoded.Chain, t *trc.TRC) error {
 	issVerifier := cert.IssuerVerifier{
 		TRC:          t,
 		Issuer:       chain.Issuer,
diff --git a/go/lib/infra/modules/trust/v2/inspector.go b/go/lib/infra/modules/trust/v2/inspector.go
index abe9af7b2..abc96fb65 100644
--- a/go/lib/infra/modules/trust/v2/inspector.go
+++ b/go/lib/infra/modules/trust/v2/inspector.go
@@ -34,19 +34,18 @@ type Inspector interface {
 	HasAttributes(ctx context.Context, ia addr.IA, opts infra.ASInspectorOpts) (bool, error)
 }
 
-type inspector struct {
-	provider CryptoProvider
+// DefaultInspector is used to inspect primary ASes.
+type DefaultInspector struct {
+	Provider CryptoProvider
 }
 
 // ByAttributes returns a list of primary ASes in the specified ISD that hold
 // all the requested attributes.
-func (i *inspector) ByAttributes(ctx context.Context, isd addr.ISD,
+func (i DefaultInspector) ByAttributes(ctx context.Context, isd addr.ISD,
 	opts infra.ASInspectorOpts) ([]addr.IA, error) {
 
 	trcOpts := infra.TRCOpts{TrustStoreOpts: opts.TrustStoreOpts}
-	t, err := i.provider.GetTRC(ctx, TRCID{
-		ISD: isd, Version: scrypto.Version(scrypto.LatestVer)},
-		trcOpts)
+	t, err := i.Provider.GetTRC(ctx, TRCID{ISD: isd, Version: scrypto.LatestVer}, trcOpts)
 	if err != nil {
 		return nil, serrors.WrapStr("unable to get latest TRC", err, "isd", isd)
 	}
@@ -61,13 +60,11 @@ func (i *inspector) ByAttributes(ctx context.Context, isd addr.ISD,
 
 // HasAttributes indicates whether an AS holds all the specified attributes.
 // The first return value is always false for non-primary ASes.
-func (i *inspector) HasAttributes(ctx context.Context, ia addr.IA,
+func (i DefaultInspector) HasAttributes(ctx context.Context, ia addr.IA,
 	opts infra.ASInspectorOpts) (bool, error) {
 
 	trcOpts := infra.TRCOpts{TrustStoreOpts: opts.TrustStoreOpts}
-	trc, err := i.provider.GetTRC(ctx, TRCID{
-		ISD: ia.I, Version: scrypto.Version(scrypto.LatestVer)},
-		trcOpts)
+	trc, err := i.Provider.GetTRC(ctx, TRCID{ISD: ia.I, Version: scrypto.LatestVer}, trcOpts)
 	if err != nil {
 		return false, serrors.WrapStr("unable to get latest TRC", err, "isd", ia.I)
 	}
diff --git a/go/lib/infra/modules/trust/v2/provider.go b/go/lib/infra/modules/trust/v2/provider.go
index f5c2ac8c3..99710d3ba 100644
--- a/go/lib/infra/modules/trust/v2/provider.go
+++ b/go/lib/infra/modules/trust/v2/provider.go
@@ -16,7 +16,6 @@ package trust
 
 import (
 	"context"
-	"net"
 	"time"
 
 	"golang.org/x/xerrors"
@@ -67,38 +66,42 @@ type ChainID struct {
 	Version scrypto.Version
 }
 
-type cryptoProvider struct {
-	db       DBRead
-	recurser Recurser
-	resolver Resolver
-	router   Router
+// Provider provides crypto material. A crypto provider can spawn network
+// requests if necessary and permitted.
+type Provider struct {
+	DB       DBRead
+	Recurser Recurser
+	Resolver Resolver
+	Router   Router
 }
 
-func (p *cryptoProvider) GetTRC(ctx context.Context, id TRCID,
-	opts infra.TRCOpts) (*trc.TRC, error) {
-
+// GetTRC asks the trust store to return a valid and active TRC for isd,
+// unless inactive TRCs are specifically allowed. The optionally configured
+// server is queried over the network if the TRC is not available locally.
+// Otherwise, the default server is queried. How the default server is
+// determined differs between implementations.
+func (p Provider) GetTRC(ctx context.Context, id TRCID, opts infra.TRCOpts) (*trc.TRC, error) {
 	t, _, err := p.getCheckedTRC(ctx, id, opts)
 	return t, err
 }
 
-func (p *cryptoProvider) GetRawTRC(ctx context.Context, id TRCID,
-	opts infra.TRCOpts) ([]byte, error) {
-
+// GetRawTRC behaves the same as GetTRC, except returning the raw signed TRC.
+func (p Provider) GetRawTRC(ctx context.Context, id TRCID, opts infra.TRCOpts) ([]byte, error) {
 	_, raw, err := p.getCheckedTRC(ctx, id, opts)
 	return raw, err
 }
 
-func (p *cryptoProvider) getCheckedTRC(ctx context.Context, id TRCID,
+func (p Provider) getCheckedTRC(ctx context.Context, id TRCID,
 	opts infra.TRCOpts) (*trc.TRC, []byte, error) {
 
-	decTRC, err := p.getTRC(ctx, id, opts, nil)
+	decTRC, err := p.getTRC(ctx, id, opts)
 	if err != nil {
 		return nil, nil, serrors.WrapStr("unable to get requested TRC", err)
 	}
 	if opts.AllowInactive {
 		return decTRC.TRC, decTRC.Raw, nil
 	}
-	info, err := p.db.GetTRCInfo(ctx, TRCID{ISD: id.ISD, Version: scrypto.LatestVer})
+	info, err := p.DB.GetTRCInfo(ctx, TRCID{ISD: id.ISD, Version: scrypto.LatestVer})
 	if err != nil {
 		return nil, nil, serrors.WrapStr("unable to get latest TRC info", err)
 	}
@@ -140,10 +143,8 @@ func (p *cryptoProvider) getCheckedTRC(ctx context.Context, id TRCID,
 // whether this function is allowed to create new network requests. Parameter
 // client contains the node that caused the function to be called, or nil if the
 // function was called due to a local feature.
-func (p *cryptoProvider) getTRC(ctx context.Context, id TRCID,
-	opts infra.TRCOpts, client net.Addr) (decoded.TRC, error) {
-
-	raw, err := p.db.GetRawTRC(ctx, id)
+func (p Provider) getTRC(ctx context.Context, id TRCID, opts infra.TRCOpts) (decoded.TRC, error) {
+	raw, err := p.DB.GetRawTRC(ctx, id)
 	switch {
 	case err == nil:
 		return decoded.DecodeTRC(raw)
@@ -157,11 +158,11 @@ func (p *cryptoProvider) getTRC(ctx context.Context, id TRCID,
 }
 
 // fetchTRC fetches a TRC via a network request, if allowed.
-func (p *cryptoProvider) fetchTRC(ctx context.Context, id TRCID,
+func (p Provider) fetchTRC(ctx context.Context, id TRCID,
 	opts infra.TRCOpts) (decoded.TRC, error) {
 
 	server := opts.Server
-	if err := p.recurser.AllowRecursion(opts.Client); err != nil {
+	if err := p.Recurser.AllowRecursion(opts.Client); err != nil {
 		return decoded.TRC{}, err
 	}
 	req := TRCReq{
@@ -171,26 +172,33 @@ func (p *cryptoProvider) fetchTRC(ctx context.Context, id TRCID,
 	// Choose remote server, if not set.
 	if server == nil {
 		var err error
-		if server, err = p.router.ChooseServer(ctx, id.ISD); err != nil {
+		if server, err = p.Router.ChooseServer(ctx, id.ISD); err != nil {
 			return decoded.TRC{}, serrors.WrapStr("unable to route TRC request", err)
 		}
 	}
-	decTRC, err := p.resolver.TRC(ctx, req, server)
+	decTRC, err := p.Resolver.TRC(ctx, req, server)
 	if err != nil {
 		return decoded.TRC{}, serrors.WrapStr("unable to resolve signed TRC from network", err)
 	}
 	return decTRC, nil
 }
 
-func (p *cryptoProvider) GetRawChain(ctx context.Context, id ChainID,
+// GetRawChain asks the trust store to return a valid and active certificate
+// chain, unless inactive chains are specifically allowed. The optionally
+// configured server is queried over the network if the certificate chain is
+// not available locally. Otherwise, the default server is queried. How the
+// default server is determined differs between implementations.
+func (p Provider) GetRawChain(ctx context.Context, id ChainID,
 	opts infra.ChainOpts) ([]byte, error) {
 
 	chain, err := p.getCheckedChain(ctx, id, opts)
 	return chain.Raw, err
 }
 
-func (p *cryptoProvider) GetASKey(ctx context.Context,
-	id ChainID, opts infra.ChainOpts) (scrypto.KeyMeta, error) {
+// GetASKey returns from trust store the public key required to verify signature
+// originated from an AS.
+func (p Provider) GetASKey(ctx context.Context, id ChainID,
+	opts infra.ChainOpts) (scrypto.KeyMeta, error) {
 
 	chain, err := p.getCheckedChain(ctx, id, opts)
 	if err != nil {
@@ -199,7 +207,7 @@ func (p *cryptoProvider) GetASKey(ctx context.Context,
 	return chain.AS.Keys[cert.SigningKey], nil
 }
 
-func (p *cryptoProvider) getCheckedChain(ctx context.Context, id ChainID,
+func (p Provider) getCheckedChain(ctx context.Context, id ChainID,
 	opts infra.ChainOpts) (decoded.Chain, error) {
 
 	chain, err := p.getChain(ctx, id, opts)
@@ -235,10 +243,10 @@ func (p *cryptoProvider) getCheckedChain(ctx context.Context, id ChainID,
 	}
 }
 
-func (p *cryptoProvider) getChain(ctx context.Context, id ChainID,
+func (p Provider) getChain(ctx context.Context, id ChainID,
 	opts infra.ChainOpts) (decoded.Chain, error) {
 
-	raw, err := p.db.GetRawChain(ctx, id)
+	raw, err := p.DB.GetRawChain(ctx, id)
 	switch {
 	case err == nil:
 		return decoded.DecodeChain(raw)
@@ -251,7 +259,7 @@ func (p *cryptoProvider) getChain(ctx context.Context, id ChainID,
 	}
 }
 
-func (p *cryptoProvider) issuerActive(ctx context.Context, chain decoded.Chain,
+func (p Provider) issuerActive(ctx context.Context, chain decoded.Chain,
 	opts infra.TrustStoreOpts) error {
 
 	if !chain.AS.Validity.Contains(time.Now()) {
@@ -266,12 +274,12 @@ func (p *cryptoProvider) issuerActive(ctx context.Context, chain decoded.Chain,
 	if err != nil {
 		return serrors.WrapStr("unable to preload latest TRC", err)
 	}
-	iss, err := p.db.GetIssuingKeyInfo(ctx, chain.Issuer.Subject, chain.Issuer.Issuer.TRCVersion)
+	iss, err := p.DB.GetIssuingKeyInfo(ctx, chain.Issuer.Subject, chain.Issuer.Issuer.TRCVersion)
 	if err != nil {
 		return serrors.WrapStr("unable to get issuing key info for issuing TRC", err,
 			"version", chain.Issuer.Issuer.TRCVersion)
 	}
-	latest, err := p.db.GetIssuingKeyInfo(ctx, chain.Issuer.Subject, scrypto.LatestVer)
+	latest, err := p.DB.GetIssuingKeyInfo(ctx, chain.Issuer.Subject, scrypto.LatestVer)
 	if err != nil {
 		return serrors.WrapStr("unable to get issuing key info for latest TRC", err)
 	}
@@ -283,7 +291,7 @@ func (p *cryptoProvider) issuerActive(ctx context.Context, chain decoded.Chain,
 			"latest_trc_version", latest.TRC.Version,
 			"expected", iss.Version, "actual", latest.Version)
 	}
-	inGrace, err := p.db.GetIssuingKeyInfo(ctx, chain.Issuer.Subject, latest.TRC.Version-1)
+	inGrace, err := p.DB.GetIssuingKeyInfo(ctx, chain.Issuer.Subject, latest.TRC.Version-1)
 	if err != nil {
 		return serrors.WrapStr("unable to get issuing key info for TRC in grace period", err,
 			"version", latest.TRC.Version-1)
@@ -296,11 +304,11 @@ func (p *cryptoProvider) issuerActive(ctx context.Context, chain decoded.Chain,
 	return nil
 }
 
-func (p *cryptoProvider) fetchChain(ctx context.Context, id ChainID,
+func (p Provider) fetchChain(ctx context.Context, id ChainID,
 	opts infra.ChainOpts) (decoded.Chain, error) {
 
 	server := opts.Server
-	if err := p.recurser.AllowRecursion(opts.Client); err != nil {
+	if err := p.Recurser.AllowRecursion(opts.Client); err != nil {
 		return decoded.Chain{}, err
 	}
 	req := ChainReq{
@@ -310,11 +318,11 @@ func (p *cryptoProvider) fetchChain(ctx context.Context, id ChainID,
 	// Choose remote server, if not set.
 	if server == nil {
 		var err error
-		if server, err = p.router.ChooseServer(ctx, id.IA.I); err != nil {
+		if server, err = p.Router.ChooseServer(ctx, id.IA.I); err != nil {
 			return decoded.Chain{}, serrors.WrapStr("unable to route TRC request", err)
 		}
 	}
-	chain, err := p.resolver.Chain(ctx, req, server)
+	chain, err := p.Resolver.Chain(ctx, req, server)
 	if err != nil {
 		return decoded.Chain{}, serrors.WrapStr("unable to resolve signed certificate chain"+
 			"from network", err)
diff --git a/go/lib/infra/modules/trust/v2/recurser.go b/go/lib/infra/modules/trust/v2/recurser.go
index ad424c04e..f7eaaa6cc 100644
--- a/go/lib/infra/modules/trust/v2/recurser.go
+++ b/go/lib/infra/modules/trust/v2/recurser.go
@@ -43,7 +43,7 @@ type ASLocalRecurser struct {
 
 // AllowRecursion returns an error if address is not part of the local AS (or if
 // the check cannot be made).
-func (r *ASLocalRecurser) AllowRecursion(peer net.Addr) error {
+func (r ASLocalRecurser) AllowRecursion(peer net.Addr) error {
 	if peer == nil {
 		return nil
 	}
diff --git a/go/lib/infra/modules/trust/v2/resolver.go b/go/lib/infra/modules/trust/v2/resolver.go
index 932c426bf..fc6d1bc18 100644
--- a/go/lib/infra/modules/trust/v2/resolver.go
+++ b/go/lib/infra/modules/trust/v2/resolver.go
@@ -46,14 +46,18 @@ type Resolver interface {
 	Chain(ctx context.Context, req ChainReq, server net.Addr) (decoded.Chain, error)
 }
 
-// resolver resolves trust material.
-type resolver struct {
-	db       DBRead
-	inserter Inserter
-	rpc      RPC
+// DefaultResolver resolves trust material.
+type DefaultResolver struct {
+	DB       DBRead
+	Inserter Inserter
+	RPC      RPC
 }
 
-func (r *resolver) TRC(ctx context.Context, req TRCReq, server net.Addr) (decoded.TRC, error) {
+// TRC resolves the decoded signed TRC. Missing links in the TRC
+// verification chain are also requested.
+func (r DefaultResolver) TRC(ctx context.Context, req TRCReq,
+	server net.Addr) (decoded.TRC, error) {
+
 	if req.Version.IsLatest() {
 		latest, err := r.resolveLatestVersion(ctx, req, server)
 		if err != nil {
@@ -61,7 +65,7 @@ func (r *resolver) TRC(ctx context.Context, req TRCReq, server net.Addr) (decode
 		}
 		req = req.withVersion(latest)
 	}
-	prev, err := r.db.GetTRC(ctx, TRCID{ISD: req.ISD, Version: scrypto.LatestVer})
+	prev, err := r.DB.GetTRC(ctx, TRCID{ISD: req.ISD, Version: scrypto.LatestVer})
 	if err != nil && !xerrors.Is(err, ErrNotFound) {
 		return decoded.TRC{}, serrors.WrapStr("error fetching latest locally available TRC", err)
 	}
@@ -91,7 +95,7 @@ func (r *resolver) TRC(ctx context.Context, req TRCReq, server net.Addr) (decode
 			return decoded.TRC{}, serrors.WrapStr("unable to fetch parts of TRC chain", err)
 		}
 		decTRC = res.Decoded
-		if err = r.inserter.InsertTRC(ctx, decTRC, w.TRC); err != nil {
+		if err = r.Inserter.InsertTRC(ctx, decTRC, w.TRC); err != nil {
 			return decoded.TRC{}, serrors.WrapStr("unable to insert parts of TRC chain", err,
 				"trc", decTRC)
 		}
@@ -102,10 +106,10 @@ func (r *resolver) TRC(ctx context.Context, req TRCReq, server net.Addr) (decode
 
 // FIXME(roosd): Add RPC that resolves just the latest version instead of the
 // full TRC.
-func (r *resolver) resolveLatestVersion(ctx context.Context, req TRCReq,
+func (r DefaultResolver) resolveLatestVersion(ctx context.Context, req TRCReq,
 	server net.Addr) (scrypto.Version, error) {
 
-	rawTRC, err := r.rpc.GetTRC(ctx, req, server)
+	rawTRC, err := r.RPC.GetTRC(ctx, req, server)
 	if err != nil {
 		return 0, serrors.WrapStr("unable to resolve latest TRC", err)
 	}
@@ -119,12 +123,12 @@ func (r *resolver) resolveLatestVersion(ctx context.Context, req TRCReq,
 	return decTRC.TRC.Version, nil
 }
 
-func (r *resolver) startFetchTRC(ctx context.Context, res chan<- resOrErr,
+func (r DefaultResolver) startFetchTRC(ctx context.Context, res chan<- resOrErr,
 	req TRCReq, server net.Addr) {
 
 	go func() {
 		defer log.LogPanicAndExit()
-		rawTRC, err := r.rpc.GetTRC(ctx, req, server)
+		rawTRC, err := r.RPC.GetTRC(ctx, req, server)
 		if err != nil {
 			res <- resOrErr{Err: serrors.WrapStr("error requesting TRC", err,
 				"isd", req.ISD, "version", req.Version)}
@@ -144,7 +148,7 @@ func (r *resolver) startFetchTRC(ctx context.Context, res chan<- resOrErr,
 	}()
 }
 
-func (r *resolver) trcCheck(req TRCReq, t *trc.TRC) error {
+func (r DefaultResolver) trcCheck(req TRCReq, t *trc.TRC) error {
 	switch {
 	case req.ISD != t.ISD:
 		return serrors.New("wrong isd", "expected", req.ISD, "actual", t.ISD)
@@ -154,10 +158,12 @@ func (r *resolver) trcCheck(req TRCReq, t *trc.TRC) error {
 	return nil
 }
 
-func (r *resolver) Chain(ctx context.Context, req ChainReq,
+// Chain resolves the raw signed certificate chain. If the issuing TRC is
+// missing, it is also requested.
+func (r DefaultResolver) Chain(ctx context.Context, req ChainReq,
 	server net.Addr) (decoded.Chain, error) {
 
-	msg, err := r.rpc.GetCertChain(ctx, req, server)
+	msg, err := r.RPC.GetCertChain(ctx, req, server)
 	if err != nil {
 		return decoded.Chain{}, serrors.WrapStr("error requesting certificate chain", err)
 	}
@@ -172,14 +178,14 @@ func (r *resolver) Chain(ctx context.Context, req ChainReq,
 		resolver: r,
 		server:   server,
 	}
-	if err := r.inserter.InsertChain(ctx, dec, w.TRC); err != nil {
+	if err := r.Inserter.InsertChain(ctx, dec, w.TRC); err != nil {
 		return decoded.Chain{}, serrors.WrapStr("unable to insert certificate chain", err,
 			"chain", dec)
 	}
 	return dec, nil
 }
 
-func (r *resolver) chainCheck(req ChainReq, as *cert.AS) error {
+func (r DefaultResolver) chainCheck(req ChainReq, as *cert.AS) error {
 	switch {
 	case !req.IA.Equal(as.Subject):
 		return serrors.New("wrong subject", "expected", req.IA, "actual", as.Subject)
@@ -216,13 +222,13 @@ func (w *prevWrap) TRC(_ context.Context, id TRCID) (*trc.TRC, error) {
 // resolverWrap provides TRCs that are backed by the resolver. If a TRC is
 // missing in the DB, network requests are allowed.
 type resolveWrap struct {
-	resolver *resolver
+	resolver DefaultResolver
 	server   net.Addr
 }
 
 func (w resolveWrap) TRC(ctx context.Context, id TRCID) (*trc.TRC, error) {
 
-	t, err := w.resolver.db.GetTRC(ctx, id)
+	t, err := w.resolver.DB.GetTRC(ctx, id)
 	switch {
 	case err == nil:
 		return t, nil
diff --git a/go/lib/infra/modules/trust/v2/router.go b/go/lib/infra/modules/trust/v2/router.go
index 32d4b88d6..52a9fda89 100644
--- a/go/lib/infra/modules/trust/v2/router.go
+++ b/go/lib/infra/modules/trust/v2/router.go
@@ -34,35 +34,40 @@ type Router interface {
 	ChooseServer(ctx context.Context, subjectISD addr.ISD) (net.Addr, error)
 }
 
-type localRouter struct {
-	ia addr.IA
+// LocalRouter routes requests to the local CS.
+type LocalRouter struct {
+	IA addr.IA
 }
 
 // ChooseServer always routes to the local CS.
-func (r *localRouter) ChooseServer(_ context.Context, _ addr.ISD) (net.Addr, error) {
+func (r LocalRouter) ChooseServer(_ context.Context, _ addr.ISD) (net.Addr, error) {
 	return r.chooseServer(), nil
 }
 
-func (r *localRouter) chooseServer() net.Addr {
-	return snet.NewSVCAddr(r.ia, nil, nil, addr.SvcCS)
+func (r LocalRouter) chooseServer() net.Addr {
+	return snet.NewSVCAddr(r.IA, nil, nil, addr.SvcCS)
 }
 
-type csRouter struct {
-	isd    addr.ISD
-	router snet.Router
-	db     TRCRead
+// AuthRouter routes requests for missing crypto material to the authoritative
+// ASes of the appropriate ISD.
+//
+// TODO(roosd): Add implementation of snet.Router that routes to authoritative AS.
+type AuthRouter struct {
+	ISD    addr.ISD
+	Router snet.Router
+	DB     TRCRead
 }
 
 // ChooseServer builds a CS address for crypto with the subject in a given ISD.
 //  * a local authoritative CS if subject is ISD-local.
 //  * a local authoritative CS if subject is in remote ISD, but no active TRC is available.
 //  * a remote authoritative CS otherwise.
-func (r *csRouter) ChooseServer(ctx context.Context, subjectISD addr.ISD) (net.Addr, error) {
+func (r AuthRouter) ChooseServer(ctx context.Context, subjectISD addr.ISD) (net.Addr, error) {
 	dstISD, err := r.dstISD(ctx, subjectISD)
 	if err != nil {
 		return nil, serrors.WrapStr("unable to determine dest ISD to query", err)
 	}
-	path, err := r.router.Route(ctx, addr.IA{I: dstISD})
+	path, err := r.Router.Route(ctx, addr.IA{I: dstISD})
 	if err != nil {
 		return nil, serrors.WrapStr("unable to find path to any core AS", err, "isd", dstISD)
 	}
@@ -70,23 +75,19 @@ func (r *csRouter) ChooseServer(ctx context.Context, subjectISD addr.ISD) (net.A
 	return ret, nil
 }
 
-// dstISD selects the CS to ask for crypto material, using the following strategy:
-//  * a local authoritative CS if subject is ISD-local.
-//  * a local authoritative CS if subject is in remote ISD, but no active TRC is available.
-//  * a remote authoritative CS otherwise.
-func (r *csRouter) dstISD(ctx context.Context, destination addr.ISD) (addr.ISD, error) {
-	if destination == r.isd {
-		return r.isd, nil
+func (r AuthRouter) dstISD(ctx context.Context, destination addr.ISD) (addr.ISD, error) {
+	if destination == r.ISD {
+		return r.ISD, nil
 	}
-	info, err := r.db.GetTRCInfo(ctx, TRCID{ISD: destination, Version: scrypto.LatestVer})
+	info, err := r.DB.GetTRCInfo(ctx, TRCID{ISD: destination, Version: scrypto.LatestVer})
 	if err != nil {
 		if xerrors.Is(err, ErrNotFound) {
-			return r.isd, nil
+			return r.ISD, nil
 		}
 		return 0, serrors.WrapStr("error querying DB for TRC", err)
 	}
 	if !info.Validity.Contains(time.Now()) {
-		return r.isd, nil
+		return r.ISD, nil
 	}
 	return destination, nil
 }
diff --git a/go/lib/infra/modules/trust/v2/rpc.go b/go/lib/infra/modules/trust/v2/rpc.go
index 0edf78910..bd60d01af 100644
--- a/go/lib/infra/modules/trust/v2/rpc.go
+++ b/go/lib/infra/modules/trust/v2/rpc.go
@@ -52,11 +52,11 @@ type ChainReq struct {
 
 // DefaultRPC implements the RPC interface using the given messenger.
 type DefaultRPC struct {
-	M infra.Messenger
+	Msgr infra.Messenger
 }
 
 func (r DefaultRPC) GetTRC(ctx context.Context, req TRCReq, a net.Addr) ([]byte, error) {
-	reply, err := r.M.GetTRC(ctx, &cert_mgmt.TRCReq{
+	reply, err := r.Msgr.GetTRC(ctx, &cert_mgmt.TRCReq{
 		ISD:     req.ISD,
 		Version: req.Version,
 	}, a, messenger.NextId())
@@ -67,7 +67,7 @@ func (r DefaultRPC) GetTRC(ctx context.Context, req TRCReq, a net.Addr) ([]byte,
 }
 
 func (r DefaultRPC) GetCertChain(ctx context.Context, req ChainReq, a net.Addr) ([]byte, error) {
-	reply, err := r.M.GetCertChain(ctx, &cert_mgmt.ChainReq{
+	reply, err := r.Msgr.GetCertChain(ctx, &cert_mgmt.ChainReq{
 		RawIA:   req.IA.IAInt(),
 		Version: req.Version,
 	}, a, messenger.NextId())
@@ -78,13 +78,13 @@ func (r DefaultRPC) GetCertChain(ctx context.Context, req ChainReq, a net.Addr)
 }
 
 func (r DefaultRPC) SendTRC(ctx context.Context, trc []byte, a net.Addr) error {
-	return r.M.SendTRC(ctx, &cert_mgmt.TRC{
+	return r.Msgr.SendTRC(ctx, &cert_mgmt.TRC{
 		RawTRC: trc,
 	}, a, messenger.NextId())
 }
 
 func (r DefaultRPC) SendCertChain(ctx context.Context, chain []byte, a net.Addr) error {
-	return r.M.SendCertChain(ctx, &cert_mgmt.Chain{
+	return r.Msgr.SendCertChain(ctx, &cert_mgmt.Chain{
 		RawChain: chain,
 	}, a, messenger.NextId())
 }


Test patch:
diff --git a/go/lib/infra/modules/trust/v2/export_test.go b/go/lib/infra/modules/trust/v2/export_test.go
index 832afe993..ed24577f7 100644
--- a/go/lib/infra/modules/trust/v2/export_test.go
+++ b/go/lib/infra/modules/trust/v2/export_test.go
@@ -14,34 +14,9 @@
 
 package trust
 
-import (
-	"github.com/scionproto/scion/go/lib/addr"
-	"github.com/scionproto/scion/go/lib/infra"
-	"github.com/scionproto/scion/go/lib/snet"
-)
+import "github.com/scionproto/scion/go/lib/infra"
 
 var (
-	// NewCryptoProvider allows instantiating the private cryptoProvider for
-	// black-box testing.
-	NewCryptoProvider = newTestCryptoProvider
-	// NewCSRouter allows instantiating the private CS router for black-box
-	// testing.
-	NewCSRouter = newTestCSRouter
-	// NewFwdInserter allows instantiating the private forwarding
-	// inserter for black-box testing.
-	NewFwdInserter = newTestFwdInserter
-	// NewInserter allows instantiating the private inserter for black-box
-	// testing.
-	NewInserter = newTestInserter
-	// NewTestInspector allows instantiating the private inspector for black-box
-	// testing.
-	NewTestInspector = newTestInspector
-	// NewLocalRouter allows instantiating the private resolver for black-box
-	// testing.
-	NewLocalRouter = newTestLocalRouter
-	// NewResolver allows instantiating the private resolver for black-box
-	// testing.
-	NewResolver = newTestResolver
 	// NewChainPushHandler allows instantiating the private chain push handler for black-box
 	// testing.
 	NewChainPushHandler = newTestChainPushHandler
@@ -56,68 +31,6 @@ var (
 	NewTRCReqHandler = newTestTRCReqResolver
 )
 
-// newTestCryptoProvider returns a new crypto provider for testing.
-func newTestCryptoProvider(db DBRead, recurser Recurser, resolver Resolver,
-	router Router) CryptoProvider {
-
-	return &cryptoProvider{
-		db:       db,
-		recurser: recurser,
-		resolver: resolver,
-		router:   router,
-	}
-}
-
-// newTestCSRouter returns a new router for testing.
-func newTestCSRouter(isd addr.ISD, router snet.Router, db TRCRead) Router {
-	return &csRouter{
-		isd:    isd,
-		router: router,
-		db:     db,
-	}
-}
-
-// newTestFwdInserter returns a new forwarding inserter for testing.
-func newTestFwdInserter(db ReadWrite, rpc RPC) Inserter {
-	return &fwdInserter{
-		baseInserter: baseInserter{
-			db: db,
-		},
-		rpc: rpc,
-	}
-}
-
-// newTestInserter returns a new inserter for testing.
-func newTestInserter(db ReadWrite, unsafe bool) Inserter {
-	return &inserter{
-		baseInserter: baseInserter{
-			db:     db,
-			unsafe: unsafe,
-		},
-	}
-}
-
-// newTestInspector returns a new inspector for testing.
-func newTestInspector(provider CryptoProvider) Inspector {
-	return &inspector{
-		provider: provider,
-	}
-}
-
-// newTestLocalRouter returns a new router for testing.
-func newTestLocalRouter(ia addr.IA) Router {
-	return &localRouter{ia: ia}
-}
-
-// newTestResolver returns a new resolver for testing.
-func newTestResolver(db DBRead, inserter Inserter, rpc RPC) Resolver {
-	return &resolver{
-		db:       db,
-		inserter: inserter,
-		rpc:      rpc,
-	}
-}
-
 // newTestChainReqHandler returns a new resolver for testing.
 func newTestChainReqHandler(request *infra.Request, provider CryptoProvider) *chainReqHandler {
 	return &chainReqHandler{
diff --git a/go/lib/infra/modules/trust/v2/inserter_test.go b/go/lib/infra/modules/trust/v2/inserter_test.go
index 03277be76..bb1e0e1b0 100644
--- a/go/lib/infra/modules/trust/v2/inserter_test.go
+++ b/go/lib/infra/modules/trust/v2/inserter_test.go
@@ -89,8 +89,12 @@ func TestInserterInsertTRC(t *testing.T) {
 			db := mock_v2.NewMockDB(mctrl)
 			decoded := loadTRC(t, trc1v1)
 			test.Expect(db, decoded)
-			ins := trust.NewInserter(db, test.Unsafe)
-
+			ins := trust.DefaultInserter{
+				BaseInserter: trust.BaseInserter{
+					DB:     db,
+					Unsafe: test.Unsafe,
+				},
+			}
 			err := ins.InsertTRC(context.Background(), decoded, nil)
 			xtest.AssertErrorsIs(t, err, test.ExpectedErr)
 		})
@@ -197,7 +201,11 @@ func TestInserterInsertChain(t *testing.T) {
 			db := mock_v2.NewMockDB(mctrl)
 			decoded := loadChain(t, chain110v1)
 			test.Expect(db, decoded)
-			ins := trust.NewInserter(db, false)
+			ins := trust.DefaultInserter{
+				BaseInserter: trust.BaseInserter{
+					DB: db,
+				},
+			}
 
 			decTRC := loadTRC(t, trc1v1)
 			p := func(_ context.Context, _ trust.TRCID) (*trc.TRC, error) {
@@ -216,9 +224,8 @@ func TestInserterInsertChain(t *testing.T) {
 func TestFwdInserterInsertChain(t *testing.T) {
 	internal := serrors.New("internal")
 	type mocks struct {
-		DB     *mock_v2.MockDB
-		Router *mock_v2.MockRouter
-		RPC    *mock_v2.MockRPC
+		DB  *mock_v2.MockDB
+		RPC *mock_v2.MockRPC
 	}
 	tests := map[string]struct {
 		Expect      func(*mocks, decoded.Chain)
@@ -282,13 +289,17 @@ func TestFwdInserterInsertChain(t *testing.T) {
 			defer mctrl.Finish()
 
 			m := &mocks{
-				DB:     mock_v2.NewMockDB(mctrl),
-				RPC:    mock_v2.NewMockRPC(mctrl),
-				Router: mock_v2.NewMockRouter(mctrl),
+				DB:  mock_v2.NewMockDB(mctrl),
+				RPC: mock_v2.NewMockRPC(mctrl),
 			}
 			decoded := loadChain(t, chain110v1)
 			test.Expect(m, decoded)
-			ins := trust.NewFwdInserter(m.DB, m.RPC)
+			ins := trust.ForwardingInserter{
+				RPC: m.RPC,
+				BaseInserter: trust.BaseInserter{
+					DB: m.DB,
+				},
+			}
 
 			decTRC := loadTRC(t, trc1v1)
 			p := func(_ context.Context, _ trust.TRCID) (*trc.TRC, error) {
diff --git a/go/lib/infra/modules/trust/v2/inspector_test.go b/go/lib/infra/modules/trust/v2/inspector_test.go
index 7ff7b5e22..bbc4444d9 100644
--- a/go/lib/infra/modules/trust/v2/inspector_test.go
+++ b/go/lib/infra/modules/trust/v2/inspector_test.go
@@ -74,7 +74,9 @@ func TestInspectorByAttributes(t *testing.T) {
 			provider := mock_v2.NewMockCryptoProvider(mctrl)
 			decoded := loadTRC(t, trc1v1)
 			test.Expect(provider, decoded.TRC)
-			ins := trust.NewTestInspector(provider)
+			ins := trust.DefaultInspector{
+				Provider: provider,
+			}
 			// Prepare the request.
 			opts := infra.ASInspectorOpts{
 				RequiredAttributes: test.Attrs,
@@ -154,7 +156,9 @@ func TestInspectorHasAttributes(t *testing.T) {
 			provider := mock_v2.NewMockCryptoProvider(mctrl)
 			decoded := loadTRC(t, trc1v1)
 			test.Expect(provider, decoded.TRC)
-			ins := trust.NewTestInspector(provider)
+			ins := trust.DefaultInspector{
+				Provider: provider,
+			}
 			// Prepare the request.
 			opts := infra.ASInspectorOpts{
 				RequiredAttributes: test.Attrs,
diff --git a/go/lib/infra/modules/trust/v2/provider_test.go b/go/lib/infra/modules/trust/v2/provider_test.go
index 18ec94155..cd918457a 100644
--- a/go/lib/infra/modules/trust/v2/provider_test.go
+++ b/go/lib/infra/modules/trust/v2/provider_test.go
@@ -260,9 +260,14 @@ func TestCryptoProviderGetTRC(t *testing.T) {
 			}
 			decoded := loadTRC(t, trc1v1)
 			test.Expect(&m, &decoded)
-			provider := trust.NewCryptoProvider(m.DB, m.Recurser, m.Resolver, m.Router)
-			ptrc, err := provider.GetTRC(nil,
-				trust.TRCID{ISD: trc1v1.ISD, Version: trc1v1.Version}, test.Opts)
+			provider := trust.Provider{
+				DB:       m.DB,
+				Recurser: m.Recurser,
+				Resolver: m.Resolver,
+				Router:   m.Router,
+			}
+			id := trust.TRCID{ISD: trc1v1.ISD, Version: trc1v1.Version}
+			ptrc, err := provider.GetTRC(nil, id, test.Opts)
 			if test.ExpectedErr != nil {
 				require.Error(t, err)
 				assert.Truef(t, xerrors.Is(err, test.ExpectedErr),
@@ -309,7 +314,7 @@ func TestCryptoProviderGetTRCLatest(t *testing.T) {
 				m.Router.EXPECT().ChooseServer(gomock.Any(), dec.TRC.ISD).Return(ip, nil)
 				req := trust.TRCReq{
 					ISD:     dec.TRC.ISD,
-					Version: scrypto.Version(scrypto.LatestVer),
+					Version: scrypto.LatestVer,
 				}
 				m.Resolver.EXPECT().TRC(gomock.Any(), req, ip).Return(*dec, nil)
 				return *dec
@@ -354,7 +359,7 @@ func TestCryptoProviderGetTRCLatest(t *testing.T) {
 				m.Router.EXPECT().ChooseServer(gomock.Any(), dec.TRC.ISD).Return(ip, nil)
 				req := trust.TRCReq{
 					ISD:     dec.TRC.ISD,
-					Version: scrypto.Version(scrypto.LatestVer),
+					Version: scrypto.LatestVer,
 				}
 				m.Resolver.EXPECT().TRC(gomock.Any(), req, ip).Return(*dec, nil)
 				return decoded.TRC{}
@@ -379,7 +384,7 @@ func TestCryptoProviderGetTRCLatest(t *testing.T) {
 				m.Router.EXPECT().ChooseServer(gomock.Any(), dec.TRC.ISD).Return(ip, nil)
 				req := trust.TRCReq{
 					ISD:     dec.TRC.ISD,
-					Version: scrypto.Version(scrypto.LatestVer),
+					Version: scrypto.LatestVer,
 				}
 				newer := decoded.TRC{TRC: &(*dec.TRC)}
 				newer.TRC.Version += 1
@@ -408,7 +413,7 @@ func TestCryptoProviderGetTRCLatest(t *testing.T) {
 				m.Router.EXPECT().ChooseServer(gomock.Any(), dec.TRC.ISD).Return(ip, nil)
 				req := trust.TRCReq{
 					ISD:     dec.TRC.ISD,
-					Version: scrypto.Version(scrypto.LatestVer),
+					Version: scrypto.LatestVer,
 				}
 				newer := decoded.TRC{TRC: &(*dec.TRC)}
 				newer.TRC.Version += 1
@@ -434,9 +439,14 @@ func TestCryptoProviderGetTRCLatest(t *testing.T) {
 			}
 			decoded := loadTRC(t, trc1v1)
 			expected := test.Expect(&m, &decoded)
-			provider := trust.NewCryptoProvider(m.DB, m.Recurser, m.Resolver, m.Router)
-			trcObj, err := provider.GetTRC(nil,
-				trust.TRCID{ISD: trc1v1.ISD, Version: scrypto.LatestVer}, test.Opts)
+			provider := trust.Provider{
+				DB:       m.DB,
+				Recurser: m.Recurser,
+				Resolver: m.Resolver,
+				Router:   m.Router,
+			}
+			id := trust.TRCID{ISD: trc1v1.ISD, Version: scrypto.LatestVer}
+			trcObj, err := provider.GetTRC(nil, id, test.Opts)
 			assert.Equal(t, expected.TRC, trcObj)
 			if test.ExpectedErr != nil {
 				require.Error(t, err)
@@ -1235,14 +1245,14 @@ func TestCryptoProviderGetRawChain(t *testing.T) {
 			t.Parallel()
 			mctrl := gomock.NewController(t)
 			defer mctrl.Finish()
-			p := trust.NewCryptoProvider(
-				test.DB(t, mctrl),
-				test.Recurser(t, mctrl),
-				test.Resolver(t, mctrl),
-				test.Router(t, mctrl))
-			raw, err := p.GetRawChain(nil,
-				trust.ChainID{IA: test.ChainDesc.IA, Version: test.ChainDesc.Version},
-				test.Opts)
+			p := trust.Provider{
+				DB:       test.DB(t, mctrl),
+				Recurser: test.Recurser(t, mctrl),
+				Resolver: test.Resolver(t, mctrl),
+				Router:   test.Router(t, mctrl),
+			}
+			id := trust.ChainID{IA: test.ChainDesc.IA, Version: test.ChainDesc.Version}
+			raw, err := p.GetRawChain(nil, id, test.Opts)
 			xtest.AssertErrorsIs(t, err, test.ExpectedErr)
 			assert.Equal(t, test.ExpectedRaw, raw)
 		})
@@ -1314,14 +1324,14 @@ func TestCryptoProviderGetASKey(t *testing.T) {
 			t.Parallel()
 			mctrl := gomock.NewController(t)
 			defer mctrl.Finish()
-			p := trust.NewCryptoProvider(
-				test.DB(t, mctrl),
-				test.Recurser(t, mctrl),
-				test.Resolver(t, mctrl),
-				test.Router(t, mctrl))
-			km, err := p.GetASKey(nil,
-				trust.ChainID{IA: test.ChainDesc.IA, Version: test.ChainDesc.Version},
-				test.Opts)
+			p := trust.Provider{
+				DB:       test.DB(t, mctrl),
+				Recurser: test.Recurser(t, mctrl),
+				Resolver: test.Resolver(t, mctrl),
+				Router:   test.Router(t, mctrl),
+			}
+			id := trust.ChainID{IA: test.ChainDesc.IA, Version: test.ChainDesc.Version}
+			km, err := p.GetASKey(nil, id, test.Opts)
 			xtest.AssertErrorsIs(t, err, test.ExpectedErr)
 			assert.Equal(t, test.ExpectedKeyMeta, km)
 		})
diff --git a/go/lib/infra/modules/trust/v2/resolver_test.go b/go/lib/infra/modules/trust/v2/resolver_test.go
index cd8f97dae..047230c69 100644
--- a/go/lib/infra/modules/trust/v2/resolver_test.go
+++ b/go/lib/infra/modules/trust/v2/resolver_test.go
@@ -109,7 +109,11 @@ func TestResolverTRC(t *testing.T) {
 				RPC:      mock_v2.NewMockRPC(mctrl),
 			}
 			expected := test.Expect(t, m)
-			r := trust.NewResolver(m.DB, m.Inserter, m.RPC)
+			r := trust.DefaultResolver{
+				DB:       m.DB,
+				Inserter: m.Inserter,
+				RPC:      m.RPC,
+			}
 			decTRC, err := r.TRC(context.Background(), test.TRCReq, nil)
 			xtest.AssertErrorsIs(t, err, test.ExpectedErr)
 			assert.Equal(t, expected, decTRC)
@@ -264,7 +268,11 @@ func TestResolverChain(t *testing.T) {
 				RPC:      mock_v2.NewMockRPC(mctrl),
 			}
 			expected := test.Expect(t, m)
-			r := trust.NewResolver(m.DB, m.Inserter, m.RPC)
+			r := trust.DefaultResolver{
+				DB:       m.DB,
+				Inserter: m.Inserter,
+				RPC:      m.RPC,
+			}
 			dec, err := r.Chain(context.Background(), test.ChainReq, nil)
 			xtest.AssertErrorsIs(t, err, test.ExpectedErr)
 			assert.Equal(t, expected, dec)
diff --git a/go/lib/infra/modules/trust/v2/router_test.go b/go/lib/infra/modules/trust/v2/router_test.go
index 9cdf9533e..8926d12db 100644
--- a/go/lib/infra/modules/trust/v2/router_test.go
+++ b/go/lib/infra/modules/trust/v2/router_test.go
@@ -43,7 +43,9 @@ func TestLocalRouterChooseServer(t *testing.T) {
 	for name, isd := range tests {
 		t.Run(name, func(t *testing.T) {
 			localCS := snet.NewSVCAddr(ia122, nil, nil, addr.SvcCS)
-			router := trust.NewLocalRouter(localCS.IA)
+			router := trust.LocalRouter{
+				IA: localCS.IA,
+			}
 			routed, err := router.ChooseServer(context.Background(), isd)
 			require.NoError(t, err)
 			assert.Equal(t, localCS, routed)
@@ -134,7 +136,11 @@ func TestCSRouterChooseServer(t *testing.T) {
 			db := mock_v2.NewMockDB(mctrl)
 			r, p := mock_snet.NewMockRouter(mctrl), mock_snet.NewMockPath(mctrl)
 			test.Expect(db, r, p)
-			router := trust.NewCSRouter(1, r, db)
+			router := trust.AuthRouter{
+				ISD:    1,
+				Router: r,
+				DB:     db,
+			}
 			res, err := router.ChooseServer(context.Background(), test.ISD)
 			if test.ExpectedErr != nil {
 				xtest.AssertErrorsIs(t, err, test.ExpectedErr)