Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Fixes: #161


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Fixes: #118


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

- Adds all public data required for the `signstar-configure-build`
  crate, as it will be shared by other crates.
- Adds NetHSM specific defaults.
- Adds basic configuration file retrieval and directory handling for
  Signstar hosts.
- Adds administrative credentials file retrieval and directory handling
  for Signstar hosts.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

See: https://github.com/aws/aws-lc-rs/issues/722#issuecomment-2715433122


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: renovate <renovate@archlinux.org>

renovate authored 3 weeks ago and Wiktor Kwapisiewicz committed 3 weeks ago

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

See: https://github.com/briansmith/ring/commit/0d80ad56a24bdcc3daeed338551379d8adbed976


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

This issue is being worked on by the only dependency which uses it
(`aws-lc-rs`) so temporarily allow it to make other jobs pass.

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

See: https://rustsec.org/advisories/RUSTSEC-2025-0009
See: https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05
Fixes: #165


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Enable returning a specific `ExtendedUserMapping` by searching for the
name of a system user in all mappings.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add the wrapper type `ExtendedUserMapping` which is aware of the
administrative and non-administrative secret handling, as well as the
available backend connections while tracking a single `UserMapping`.
This establishes a user mapping centric view of a host.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add a function to easily evaluate whether a `UserMapping` has a system
user and at least one NetHSM user.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Derive `strum::Display` and `strum::EnumString` for
`AdministrativeSecretHandling` as those are useful when e.g. using the
type in errors.

Signed-off-by: David Runge <dvzrv@archlinux.org>

The ring crate is now maintained by the maintainers of rustls.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

The `ring` feature for the `rustls` crate is no longer feasible now that
the upstream project is unmaintained.
Switch the direct use of `rustls` to rely on the default features, which
include the `aws-lc-rs` crypto provider (an AWS maintained fork of
OpenSSL).
Allow the OpenSSL license to be able to use the `aws-lc-rs` feature.

Fixes: #152


Signed-off-by: David Runge <dvzrv@archlinux.org>

Fixes: #151


Signed-off-by: David Runge <dvzrv@archlinux.org>

Ensure to always use style edition 2024.
Format all code according to style edition 2024.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Use resolver 3 (which came with Rust edition 2024).
Set the minimum required Rust version to 1.85.0.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

As `sq` is in the habit of continuously changing its CLI, rely on the
simpler `rpacket` for dumping information on OpenPGP packets.

Signed-off-by: David Runge <dvzrv@archlinux.org>

This fixes the pipeline failure from #144 as well as subsequent issues
and the underlying security issue.

Signed-off-by: Christian Heusel <christian@heusel.eu>