Repository: bottlerocket-os/bottlerocket
File: sources/api/certdog/src/main.rs (Rust)

Code before:
    /// log-level trace|debug|info|warn|error
    log_level: LevelFilter,
    #[argh(option, default = "DEFAULT_CONFIG_FILE.to_string()", short = 'c')]
    /// config-path path to apiserver socket
    config_path: String,
    #[argh(option, default = "DEFAULT_TRUSTED_STORE.to_string()", short = 't')]
    /// trusted-store path to the trusted store
    trusted_store: String,
    #[argh(option, default = "DEFAULT_SOURCE_BUNDLE.to_string()", short = 'b')]
    /// source-bundle path to source bundle
    source_bundle: String,
}

struct CertBundle {
    trusted_certs: Vec<x509_parser::pem::Pem>,
    distrusted_certs: Vec<x509_parser::pem::Pem>,
}

/// Query the API for the certificate bundles, returns a tuple with trusted
/// and distrusted PEM certificates
async fn get_certificate_bundles<P>(config_path: P) -> Result<CertBundle>
where
    P: AsRef<Path>,
{
    debug!("Loading certdog configuration");
    if !config_path.as_ref().exists() {
        return split_bundles(None);
    }

    let config_str = fs::read_to_string(config_path.as_ref()).context(error::ConfigReadSnafu {
        config: format!("{:?}", config_path.as_ref()),
    })?;
    let pki: HashMap<Identifier, PemCertificate> =
        toml::from_str(config_str.as_str()).context(error::ConfigDeserializationSnafu {
            config: format!("{:?}", config_path.as_ref()),
        })?;

    split_bundles(Some(pki))
}

/// Returns a tuple with two lists, for trusted and distrusted certificates
fn split_bundles(
    certificates_bundle: Option<HashMap<Identifier, PemCertificate>>,
) -> Result<CertBundle> {
    let mut trusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();
    let mut distrusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();

    for (name, bundle) in certificates_bundle.iter().flatten() {
        let data = bundle.data.clone().unwrap_or_default();

        // Empty data means the certificate bundle was disabled in the API

Review comment (bug):
nit: can remove some duplication by doing the `as_ref()` call once to get a `Path`:
```suggestion
    debug!("Loading certdog configuration");
    let config_path = config_path.as_ref();
    if !config_path.exists() {
```

Code after:
    /// log-level trace|debug|info|warn|error
    log_level: LevelFilter,
    #[argh(option, default = "PathBuf::from(DEFAULT_CONFIG_FILE)", short = 'c')]
    /// config-path path to certdog toml
    config_path: PathBuf,
    #[argh(option, default = "DEFAULT_TRUSTED_STORE.to_string()", short = 't')]
    /// trusted-store path to the trusted store
    trusted_store: String,
    #[argh(option, default = "DEFAULT_SOURCE_BUNDLE.to_string()", short = 'b')]
    /// source-bundle path to source bundle
    source_bundle: String,
}

#[derive(Default)]
struct CertBundle {
    trusted_certs: Vec<x509_parser::pem::Pem>,
    distrusted_certs: Vec<x509_parser::pem::Pem>,
}

/// Query the API for the certificate bundles, returns a tuple with trusted
/// and distrusted PEM certificates
async fn get_certificate_bundles<P>(config_path: P) -> Result<CertBundle>
where
    P: AsRef<Path>,
{
    debug!("Loading certdog configuration");
    let config_path = config_path.as_ref();
    if !config_path.exists() {
        return Ok(CertBundle::default());
    }

    let config_str = fs::read_to_string(config_path).context(error::ConfigReadSnafu {
        config: format!("{:?}", config_path),
    })?;
    let pki: HashMap<Identifier, PemCertificate> =
        toml::from_str(config_str.as_str()).context(error::ConfigDeserializationSnafu {
            config: format!("{:?}", config_path),
        })?;

    split_bundles(pki)
}

/// Returns a tuple with two lists, for trusted and distrusted certificates
fn split_bundles(certificates_bundle: HashMap<Identifier, PemCertificate>) -> Result<CertBundle> {
    let mut trusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();
    let mut distrusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();

    for (name, bundle) in certificates_bundle.iter() {
        let data = bundle.data.clone().unwrap_or_default();

        // Empty data means the certificate bundle was disabled in the API