Repository: bottlerocket-os/bottlerocket
File: sources/api/certdog/src/main.rs (Rust)

Code before:
use std::io::{BufRead, Seek};
use std::path::Path;
use std::process;

use model::modeled_types::Identifier;
use model::PemCertificate;

// Default location of the config file
const DEFAULT_CONFIG_FILE: &str = "/etc/certdog.toml";
// Read from the source in `/usr/share/factory` not the copy in `/etc`
const DEFAULT_SOURCE_BUNDLE: &str = "/usr/share/factory/etc/pki/tls/certs/ca-bundle.crt";
// This file is first created with tmpfilesd configurations
const DEFAULT_TRUSTED_STORE: &str = "/etc/pki/tls/certs/ca-bundle.crt";

// PEM delimiters
const PEM_HEADER: &str = "-----BEGIN";
const PEM_FOOTER: &str = "-----END";
const PEM_SUFFIX: &str = "-----";

/// Stores user-supplied global arguments
#[derive(FromArgs, Debug)]
struct Args {
    #[argh(option, default = "LevelFilter::Info", short = 'l')]
    /// log-level trace|debug|info|warn|error
    log_level: LevelFilter,
    #[argh(option, default = "DEFAULT_CONFIG_FILE.to_string()", short = 'c')]
    /// config-path path to apiserver socket
    config_path: String,
    #[argh(option, default = "DEFAULT_TRUSTED_STORE.to_string()", short = 't')]
    /// trusted-store path to the trusted store
    trusted_store: String,
    #[argh(option, default = "DEFAULT_SOURCE_BUNDLE.to_string()", short = 'b')]
    /// source-bundle path to source bundle
    source_bundle: String,
}

struct CertBundle {
    trusted_certs: Vec<x509_parser::pem::Pem>,
    distrusted_certs: Vec<x509_parser::pem::Pem>,
}

/// Query the API for the certificate bundles, returns a tuple with trusted
/// and distrusted PEM certificates
async fn get_certificate_bundles<P>(config_path: P) -> Result<CertBundle>
where
    P: AsRef<Path>,
{
    debug!("Loading certdog configuration");
    if !config_path.as_ref().exists() {
        return split_bundles(None);
    }

Review comment (suggestion):
This looks weird. I guess this is correctly resolving to the constant+function call and not setting the default to the string literal `DEFAULT_CONFIG_FILE.to_string()`? Did you check this? I don't know if the Bottlerocket call sites are specifying the path or relying on this default.

Code after:
use std::io::{BufRead, Seek};
use std::path::{Path, PathBuf};
use std::process;

use model::modeled_types::Identifier;
use model::PemCertificate;

// Default location of the config file
const DEFAULT_CONFIG_FILE: &str = "/etc/certdog.toml";
// Read from the source in `/usr/share/factory` not the copy in `/etc`
const DEFAULT_SOURCE_BUNDLE: &str = "/usr/share/factory/etc/pki/tls/certs/ca-bundle.crt";
// This file is first created with tmpfilesd configurations
const DEFAULT_TRUSTED_STORE: &str = "/etc/pki/tls/certs/ca-bundle.crt";

// PEM delimiters
const PEM_HEADER: &str = "-----BEGIN";
const PEM_FOOTER: &str = "-----END";
const PEM_SUFFIX: &str = "-----";

/// Stores user-supplied global arguments
#[derive(FromArgs, Debug)]
struct Args {
    #[argh(option, default = "LevelFilter::Info", short = 'l')]
    /// log-level trace|debug|info|warn|error
    log_level: LevelFilter,
    #[argh(option, default = "PathBuf::from(DEFAULT_CONFIG_FILE)", short = 'c')]
    /// config-path path to certdog toml
    config_path: PathBuf,
    #[argh(option, default = "DEFAULT_TRUSTED_STORE.to_string()", short = 't')]
    /// trusted-store path to the trusted store
    trusted_store: String,
    #[argh(option, default = "DEFAULT_SOURCE_BUNDLE.to_string()", short = 'b')]
    /// source-bundle path to source bundle
    source_bundle: String,
}

#[derive(Default)]
struct CertBundle {
    trusted_certs: Vec<x509_parser::pem::Pem>,
    distrusted_certs: Vec<x509_parser::pem::Pem>,
}

/// Query the API for the certificate bundles, returns a tuple with trusted
/// and distrusted PEM certificates
async fn get_certificate_bundles<P>(config_path: P) -> Result<CertBundle>
where
    P: AsRef<Path>,
{
    debug!("Loading certdog configuration");
    let config_path = config_path.as_ref();
    if !config_path.exists() {