Add the wrapper type `ExtendedUserMapping` which is aware of the
administrative and non-administrative secret handling, as well as the
available backend connections while tracking a single `UserMapping`.
This establishes a user mapping centric view of a host.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add a function to easily evaluate whether a `UserMapping` has a system
user and at least one NetHSM user.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Derive `strum::Display` and `strum::EnumString` for
`AdministrativeSecretHandling` as those are useful when e.g. using the
type in errors.

Signed-off-by: David Runge <dvzrv@archlinux.org>

The ring crate is now maintained by the maintainers of rustls.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

The `ring` feature for the `rustls` crate is no longer feasible now that
the upstream project is unmaintained.
Switch the direct use of `rustls` to rely on the default features, which
include the `aws-lc-rs` crypto provider (an AWS maintained fork of
OpenSSL).
Allow the OpenSSL license to be able to use the `aws-lc-rs` feature.

Fixes: #152


Signed-off-by: David Runge <dvzrv@archlinux.org>

Fixes: #151


Signed-off-by: David Runge <dvzrv@archlinux.org>

Ensure to always use style edition 2024.
Format all code according to style edition 2024.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Use resolver 3 (which came with Rust edition 2024).
Set the minimum required Rust version to 1.85.0.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

As `sq` is in the habit of continuously changing its CLI, rely on the
simpler `rpacket` for dumping information on OpenPGP packets.

Signed-off-by: David Runge <dvzrv@archlinux.org>

This fixes the pipeline failure from #144 as well as subsequent issues
and the underlying security issue.

Signed-off-by: Christian Heusel <christian@heusel.eu>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

It seems like the 2.4.0 version of codespell does deem the current
wording incorrect, therefore change it to the suggested "reuse"
spelling.

Fixes #143



Signed-off-by: Christian Heusel <christian@heusel.eu>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Add `NonAdministrativeSecretHandling` to `ParallelHermeticConfig` and
adjust all documentation to reflect this.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

- Add `AdministrativeSecretHandling` to `ParallelHermeticConfig` and
  adjust all documentation to reflect this.
- Adjust `ParallelHermeticConfig::validate` to check for users for share
  upload and download only when using Shamir's Secret Sharing and fail
  if they are set otherwise.
- Move all use of configuration file strings in unit tests to separate
  fixture files, which allows better readability (also due to syntax
  highlighting).

Fixes: #123


Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

Fix the wrong use of the `PACMAN_DEV_PACKAGES` environment
variable in the `install-pacman-dev-packages` recipe (it is called
`PACMAN_PACKAGES`).
Execute `pacman` using `run0` to ensure it can be run without `sudo` on
any newer systemd-based system.
Don't update the system but simply install the packages.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Signed-off-by: renovate <renovate@archlinux.org>

Fixes: #109


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

This strategy is more robust when starting multiple containers.

Updating `rustainers` to 0.14 is needed for `require_valid_certs` configuration toggle.
Since NetHSM uses self-signed certificate on port 8443 the check would always fail otherwise.

See: https://github.com/wefoxplatform/rustainers/issues/40


Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>

Signed-off-by: David Runge <dvzrv@archlinux.org>

As normal tests run containerized we can parallelize them with the
integration tests (requiring a VM).

Signed-off-by: David Runge <dvzrv@archlinux.org>

Fixes: #126


Signed-off-by: David Runge <dvzrv@archlinux.org>