Repository: bottlerocket-os/bottlerocket
File: sources/api/certdog/src/main.rs (Rust)

Code before:
    config_path: String,
    #[argh(option, default = "DEFAULT_TRUSTED_STORE.to_string()", short = 't')]
    /// trusted-store path to the trusted store
    trusted_store: String,
    #[argh(option, default = "DEFAULT_SOURCE_BUNDLE.to_string()", short = 'b')]
    /// source-bundle path to source bundle
    source_bundle: String,
}

struct CertBundle {
    trusted_certs: Vec<x509_parser::pem::Pem>,
    distrusted_certs: Vec<x509_parser::pem::Pem>,
}

/// Query the API for the certificate bundles, returns a tuple with trusted
/// and distrusted PEM certificates
async fn get_certificate_bundles<P>(config_path: P) -> Result<CertBundle>
where
    P: AsRef<Path>,
{
    debug!("Loading certdog configuration");
    if config_path.as_ref().exists() {
        let config_str =
            fs::read_to_string(config_path.as_ref()).context(error::ConfigReadSnafu {
                config: config_path.as_ref().to_str().unwrap(),
            })?;
        let pki: HashMap<Identifier, PemCertificate> = toml::from_str(config_str.as_str())
            .context(error::ConfigDeserializationSnafu {
                config: config_path.as_ref().to_str().unwrap(),
            })?;

        split_bundles(pki)
    } else {
        split_bundles(HashMap::new())
    }
}

/// Returns a tuple with two lists, for trusted and distrusted certificates
fn split_bundles(certificates_bundle: HashMap<Identifier, PemCertificate>) -> Result<CertBundle> {
    let mut trusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();
    let mut distrusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();

    for (name, bundle) in certificates_bundle.iter() {
        let data = bundle.data.clone().unwrap_or_default();

        // Empty data means the certificate bundle was disabled in the API
        if data.trim() == "" {
            debug!("Found empty bundle: {}", name);
            continue;
        }


Review comment (suggestion):
nit: I prefer the early return approach, e.g.:
```
if !config_path.as_ref().exists() {
    return split_bundles(HashMap::new());
}
let config_str = ...
...
split_bundles(pki)
```

That helps avoid some of the rightward drift and keeps the branch logic close to its condition.

Code after:
    config_path: PathBuf,
    #[argh(option, default = "DEFAULT_TRUSTED_STORE.to_string()", short = 't')]
    /// trusted-store path to the trusted store
    trusted_store: String,
    #[argh(option, default = "DEFAULT_SOURCE_BUNDLE.to_string()", short = 'b')]
    /// source-bundle path to source bundle
    source_bundle: String,
}

#[derive(Default)]
struct CertBundle {
    trusted_certs: Vec<x509_parser::pem::Pem>,
    distrusted_certs: Vec<x509_parser::pem::Pem>,
}

/// Query the API for the certificate bundles, returns a tuple with trusted
/// and distrusted PEM certificates
async fn get_certificate_bundles<P>(config_path: P) -> Result<CertBundle>
where
    P: AsRef<Path>,
{
    debug!("Loading certdog configuration");
    let config_path = config_path.as_ref();
    if !config_path.exists() {
        return Ok(CertBundle::default());
    }

    let config_str = fs::read_to_string(config_path).context(error::ConfigReadSnafu {
        config: format!("{:?}", config_path),
    })?;
    let pki: HashMap<Identifier, PemCertificate> =
        toml::from_str(config_str.as_str()).context(error::ConfigDeserializationSnafu {
            config: format!("{:?}", config_path),
        })?;

    split_bundles(pki)
}

/// Returns a tuple with two lists, for trusted and distrusted certificates
fn split_bundles(certificates_bundle: HashMap<Identifier, PemCertificate>) -> Result<CertBundle> {
    let mut trusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();
    let mut distrusted_certs: Vec<x509_parser::pem::Pem> = Vec::new();

    for (name, bundle) in certificates_bundle.iter() {
        let data = bundle.data.clone().unwrap_or_default();

        // Empty data means the certificate bundle was disabled in the API
        if data.trim() == "" {
            debug!("Found empty bundle: {}", name);
            continue;
        }