oxidecomputer / offline-keystore

yubihsm-setup replacing the yubico cruft with our own cruft!
Mozilla Public License 2.0
10 stars 1 forks source link

Refactor `ca` module into a type. #244

Closed flihp closed 1 week ago

flihp commented 3 weeks ago

This commit refactors the functions that previously made up the ca module into a type. This is intended to make the code more legible and hopefully more maintainable as well. A significant part of this work was moving the output handling out of the ca module and up into main. The ca module is now limited to processing inputs (key / csr / dscr specs) and generating outputs. This simplifies the ca module significantly and moves policy decisions like where to write output files further up the call stack.

The config module was updated to allow serialization of the KeySpec type back to json. We do this so that we can use the type system to ensure that the Ca type is only passed valid KeySpecs. Internally this type persists the KeySpec alongside other CA state info which requires serializing it back out to JSON.