Add the `build-test-image` recipe to allow building a Signstar image
using local executables and testing configurations.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add the `build` recipe and allow providing further cargo build options.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Replace the exemplary, custom user creation with a call to
`signstar-configure-build`.
Currently only run the new executable if it is in PATH, as it is not
packaged yet and therefore only around when testing with locally built
executables.

Signed-off-by: David Runge <dvzrv@archlinux.org>

As we want to be able to test executables such as
`signstar-configure-build` in CI on each change, we need a separate
mkosi profile to be able to provide the latest executable and an example
configuration without interfering with the stable image build.

The `local-testing` mkosi profile allows copying more files into the
image which will shadow whatever is installed into the image.

Signed-off-by: David Runge <dvzrv@archlinux.org>

As `clap` and `nethsm-config` are now workspace dependencies, we want to
rely on them centrally.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Use a `test-readmes` recipe as bundled target for testing all README.md
based end-to-end integrations that are available.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Extend the `test-readme` recipe to allow running tangler in an Arch
Linux container.
Allow global overrides to container creation and running.
Add specific overrides when testing against `signstar-configure-build`
project, as here we need to test inside of a container.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add executable `signstar-configure-build` to create system users and
their integration for signstar hosts during build-time.
Users are created without a passphrase with the help of `useradd` and
unlocked using `usermod`.
User home directories are created in a dedicated directory with the help
of `tmpfiles.d`.
Afterwards, if available for the specific user mapping, SSH
configuration is created based on system-wide drop-ins, that define
which SSH keys are authorized for authentication and sets a command,
which is enforced upon login.

Fixes: archlinux/signstar#78


Signed-off-by: David Runge <dvzrv@archlinux.org>

The `cargo test` command cannot parallelize across crates and it makes
tests slower than necessary:

```
$ time cargo test --all
...
real	0m8,449s
user	1m24,149s
sys	0m37,558s
```

Comparing with `nextest` the difference is clear:

```
$ time cargo nextest run --all
...
real	0m2,898s
user	0m5,922s
sys	0m2,079s
```

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Fixes: #107
Fixes: #108


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: renovate <renovate@archlinux.org>

Fixes: #98


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

This reverts commit ecc6e5d8.

Fixes: #102


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

See: #102


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

renovate authored 4 months ago and Wiktor Kwapisiewicz committed 4 months ago

Signed-off-by: renovate <renovate@archlinux.org>
Co-authored-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Check for `cargo` and `mold` (`cargo-publish` does not exist and `git`
is not required).

Signed-off-by: David Runge <dvzrv@archlinux.org>

Move dependencies that are used multiple times in the same crate, but
with differing features (i.e. ed25519-dalek, rsa) to the workspace
dependencies.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Move all dependencies, that are used by more than or equal to two crates
(i.e. chrono, nethsm, rand, serde, strum) to workspace dependencies.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Move dependencies shared by all crates (i.e. rstest, testdir, testresult
and thiserror) to the workspace dependencies.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Move the authors, edition, homepage, license and repository metadata to
workspace metadata, as it is the same for all crates.

Signed-off-by: David Runge <dvzrv@archlinux.org>

The reproducible-builds.org website has been unavailable several times,
breaking CI, so we switch to checking something more reliable: the Arch
Wiki.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Use the `ensure-command` recipe in other recipes to fail early if a
required command is not available.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Run `lychee` on all files instead of selected ones.
Selecting specific files leads to the .gitignore not being honored and
users with an in-project target dir waste many cycles on checking links
in there.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Use an inline script instead of a just script string in the `test`
recipe, as that is more readable.
Reuse the `docs` recipe in the `test` recipe to test docs in a more
standardized fashion.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add the `docs` recipe to build the Rust documentation of all crates.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add `HermeticParallelConfig` as configuration file integration for a
passphrase-less, system-wide configuration file format, that tracks
parallel `NetHsm`s and `UserMapping`s across them.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Inner error messages are not represented by `confy::ConfyError`, so we
adapt `config::Error::Load` to also track the `String` representation
of the inner `Error` type, so that users of the library get meaningful
error messages on configuration loading issues.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add `NetHsmMetricsUsers` for tracking the `UserId` of a user in the
Metrics role and a list of unique `UserId`s representing users in the
Operator role.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add `AuthorizedKeyEntry` and `AuthorizedKeyEntryList` for representing
(lists of) SSH `authorized_keys` entries.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Instead of hardcoding the current default (defined by the `ConfigName`
default), use the config name passed in by the `ConfigSettings` when
creating a new `Config` object.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

As the enum doesn't carry owned data, it is safe to make it `Copy`.

Signed-off-by: David Runge <dvzrv@archlinux.org>