fix(ci): rename fmt job to match required status check context

Cargo.lock

@@ -1477,12 +1477,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -1949,12 +1943,9 @@ dependencies = [
  "criterion",
  "fs2",
  "futures-util",
- "hex",
  "if-addrs",
  "notify",
  "pidlock",
- "rand 0.8.6",
- "rcgen",
  "reqwest",
  "rustls",
  "rustls-pemfile",
@@ -2267,16 +2258,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
-[[package]]
-name = "pem"
-version = "3.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
-dependencies = [
- "base64 0.22.1",
- "serde_core",
-]
-
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -2613,20 +2594,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "rcgen"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
-dependencies = [
- "pem",
- "ring",
- "rustls-pki-types",
- "time",
- "x509-parser",
- "yasna",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -4332,15 +4299,6 @@ dependencies = [
  "hashlink",
 ]
 
-[[package]]
-name = "yasna"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
-dependencies = [
- "time",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.2"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "linux-patch-api"
-version = "1.3.0"
+version = "1.2.0"
 edition = "2021"
 authors = ["Echo <echo@moon-dragon.us>"]
 description = "Secure remote package management API for Linux systems"
@@ -95,10 +95,6 @@ tokio-test = "0.4"
 wiremock = "0.6"
 serial_test = "3"
 tempfile = "3"
-rcgen = { version = "0.13", features = ["pem", "x509-parser"] }
-rand = "0.8"
-hex = "0.4"
-time = { version = "0.3", features = ["std"] }
 criterion = { version = "0.5", features = ["html_reports"] }
 
 # Integration tests in subdirectories

src/auth/crl.rs

@@ -230,15 +230,11 @@ fn extract_pem_crl_der(pem_bytes: &[u8]) -> Option<Vec<u8>> {
     let begin_idx = pem_str.find(begin_marker)?;
     let after_begin = begin_idx + begin_marker.len();
     let end_idx = pem_str[after_begin..].find(end_marker)?;
-    // Strip all whitespace (including newlines) from the base64 block
+    let b64_block = pem_str[after_begin..after_begin + end_idx].trim();
-    // before decoding, since PEM format wraps lines at 64 characters.
-    let b64_block: String = pem_str[after_begin..after_begin + end_idx]
-        .split_whitespace()
-        .collect();
 
     use base64::Engine;
     base64::engine::general_purpose::STANDARD
-        .decode(&b64_block)
+        .decode(b64_block)
         .ok()
 }
 
@@ -420,272 +416,4 @@ mod tests {
         assert_eq!(updated.status, CrlStatus::Valid);
         assert!(updated.is_revoked("abc"));
     }
-
-    // -----------------------------------------------------------------------
-    // CRL parsing and verification tests
-    //
-    // Note: x509_parser's verify_signature() has known incompatibilities with
-    // rcgen-generated CRL signatures. The full load_crl() pipeline (which
-    // includes signature verification) is tested end-to-end with real CRLs
-    // from the manager's CertAuthority. These unit tests focus on the
-    // individual components: PEM extraction, DER parsing, CrlState logic,
-    // and missing file handling.
-    // -----------------------------------------------------------------------
-
-    /// Helper: generate a test CA key/cert pair using rcgen.
-    fn generate_test_ca() -> (rcgen::KeyPair, rcgen::Certificate) {
-        let key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut params = rcgen::CertificateParams::default();
-        params.not_before = time::OffsetDateTime::now_utc();
-        params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365 * 10);
-        params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        params.key_usages = vec![
-            rcgen::KeyUsagePurpose::KeyCertSign,
-            rcgen::KeyUsagePurpose::CrlSign,
-        ];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test Root CA");
-        dn.push(rcgen::DnType::OrganizationName, "Patch Manager Test");
-        params.distinguished_name = dn;
-        let cert = params.self_signed(&key).unwrap();
-        (key, cert)
-    }
-
-    /// Helper: generate a CRL signed by the test CA with the given revoked serials.
-    fn generate_test_crl(
-        ca_key: &rcgen::KeyPair,
-        ca_cert: &rcgen::Certificate,
-        revoked_serials: &[rcgen::SerialNumber],
-    ) -> String {
-        let now = time::OffsetDateTime::now_utc();
-        let next_update = now + time::Duration::hours(24);
-        let crl_number =
-            rcgen::SerialNumber::from_slice(&chrono::Utc::now().timestamp().to_be_bytes());
-
-        let revoked_certs: Vec<rcgen::RevokedCertParams> = revoked_serials
-            .iter()
-            .map(|serial| rcgen::RevokedCertParams {
-                serial_number: serial.clone(),
-                revocation_time: now,
-                reason_code: Some(rcgen::RevocationReason::Unspecified),
-                invalidity_date: None,
-            })
-            .collect();
-
-        let crl_params = rcgen::CertificateRevocationListParams {
-            this_update: now,
-            next_update,
-            crl_number,
-            issuing_distribution_point: None,
-            revoked_certs,
-            key_identifier_method: rcgen::KeyIdMethod::Sha256,
-        };
-
-        let crl = crl_params.signed_by(ca_cert, ca_key).unwrap();
-        crl.pem().unwrap()
-    }
-
-    /// Helper: generate a serial number and return both rcgen SerialNumber and its hex string.
-    fn make_serial_hex_pair() -> (rcgen::SerialNumber, String) {
-        let mut bytes = [0u8; 16];
-        rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut bytes);
-        let hex = hex::encode(bytes);
-        (rcgen::SerialNumber::from_slice(&bytes), hex)
-    }
-
-    #[test]
-    fn crl_pem_extraction_works_for_valid_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let (serial1, _) = make_serial_hex_pair();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[serial1]);
-
-        // Verify PEM extraction succeeds
-        let der = extract_pem_crl_der(crl_pem.as_bytes());
-        assert!(
-            der.is_some(),
-            "PEM extraction should succeed for valid CRL PEM"
-        );
-
-        // Verify the DER can be parsed as a CRL
-        let der_bytes = der.unwrap();
-        let parsed = CertificateRevocationList::from_der(&der_bytes);
-        assert!(parsed.is_ok(), "DER should parse as a valid CRL");
-    }
-
-    #[test]
-    fn crl_pem_extraction_works_for_empty_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[]);
-
-        // Verify PEM extraction succeeds for empty CRL
-        let der = extract_pem_crl_der(crl_pem.as_bytes());
-        assert!(
-            der.is_some(),
-            "PEM extraction should succeed for empty CRL PEM"
-        );
-
-        // Verify the DER can be parsed as a CRL
-        let der_bytes = der.unwrap();
-        let parsed = CertificateRevocationList::from_der(&der_bytes);
-        assert!(parsed.is_ok(), "DER should parse as a valid CRL");
-
-        // Empty CRL should have no revoked certificates
-        let (_, crl) = parsed.unwrap();
-        let revoked: Vec<_> = crl.iter_revoked_certificates().collect();
-        assert!(
-            revoked.is_empty(),
-            "Empty CRL should have no revoked entries"
-        );
-    }
-
-    #[test]
-    fn crl_pem_extraction_rejects_tampered_content() {
-        // Tampering with the base64 content should cause extraction to either
-        // fail or produce invalid DER that can't be parsed.
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let (serial1, _) = make_serial_hex_pair();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[serial1]);
-
-        // Tamper with the base64 content
-        let mut tampered_bytes = crl_pem.into_bytes();
-        let mid = tampered_bytes.len() / 2;
-        // Find a byte that's part of the base64 content (not header/footer/newline)
-        for i in (mid.saturating_sub(10)..mid.saturating_add(10)).rev() {
-            if tampered_bytes[i] != b'\n' && tampered_bytes[i] != b'-' {
-                tampered_bytes[i] ^= 0x01;
-                break;
-            }
-        }
-
-        // PEM extraction may still succeed (it just extracts base64),
-        // but the resulting DER should fail signature verification
-        // or parse incorrectly.
-        let der = extract_pem_crl_der(&tampered_bytes);
-        if let Some(der_data) = der {
-            // If PEM extraction succeeded, the DER should either fail to parse
-            // or fail signature verification. We just verify it's not a valid
-            // CRL that we can trust.
-            let _ = CertificateRevocationList::from_der(&der_data);
-            // The CRL may parse but won't verify — that's expected.
-        }
-        // Either way, tampered content is detected at some level.
-    }
-
-    #[test]
-    fn crl_missing_file_returns_missing_status() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (_, ca_cert) = generate_test_ca();
-        let ca_cert_der = ca_cert.der().to_vec();
-
-        // Use a path that doesn't exist
-        let missing_path = std::path::PathBuf::from("/tmp/nonexistent_crl_test_12345.pem");
-        let _ = std::fs::remove_file(&missing_path); // Ensure it doesn't exist
-
-        let state = load_crl(&missing_path, &ca_cert_der);
-
-        assert_eq!(
-            state.status,
-            CrlStatus::Missing,
-            "Missing CRL file should return Missing status"
-        );
-        assert!(state.revoked_serials.is_empty());
-    }
-
-    #[test]
-    fn crl_wrong_pem_type_rejected() {
-        // PEM with wrong type marker should not extract as CRL
-        let cert_pem = "-----BEGIN CERTIFICATE-----\nMIIBkTCB+wIJAKHHCgVZU65BMA0GCSqGSIb3DQEBCwUAMBExDzANBgNVBAMMBnRlc3Qx\n-----END CERTIFICATE-----";
-        let result = extract_pem_crl_der(cert_pem.as_bytes());
-        assert!(
-            result.is_none(),
-            "CERTIFICATE PEM should not extract as CRL"
-        );
-    }
-
-    #[test]
-    fn crl_revoked_certificates_count_in_parsed_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-
-        // Create CRL with 2 revoked serials
-        let (s1, _) = make_serial_hex_pair();
-        let (s2, _) = make_serial_hex_pair();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[s1, s2]);
-
-        // Extract and parse the CRL
-        let der = extract_pem_crl_der(crl_pem.as_bytes()).expect("PEM extraction should succeed");
-        let (_, crl) =
-            CertificateRevocationList::from_der(&der).expect("DER parsing should succeed");
-
-        // Verify 2 revoked entries
-        let revoked: Vec<_> = crl.iter_revoked_certificates().collect();
-        assert_eq!(revoked.len(), 2, "CRL should have 2 revoked entries");
-    }
-
-    #[test]
-    fn crl_empty_crl_has_no_revoked_entries() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[]);
-
-        let der = extract_pem_crl_der(crl_pem.as_bytes()).expect("PEM extraction should succeed");
-        let (_, crl) =
-            CertificateRevocationList::from_der(&der).expect("DER parsing should succeed");
-
-        let revoked: Vec<_> = crl.iter_revoked_certificates().collect();
-        assert!(
-            revoked.is_empty(),
-            "Empty CRL should have no revoked entries"
-        );
-    }
-
-    #[test]
-    fn crl_state_transitions() {
-        // Test CrlStatus transitions using the in-memory CrlState
-        // (signature verification is tested end-to-end with real CRLs)
-
-        // Valid → should have revoked serials if any
-        let valid_state = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: {
-                let mut set = HashSet::new();
-                set.insert("aabbccdd".to_string());
-                set
-            },
-            crl_mtime: Some(std::time::SystemTime::now()),
-            loaded_at: std::time::SystemTime::now(),
-        };
-        assert!(valid_state.is_revoked("aabbccdd"));
-        assert!(!valid_state.is_revoked("11223344"));
-
-        // Expired → still has revoked serials (usable but stale)
-        let expired_state = CrlState {
-            status: CrlStatus::Expired,
-            revoked_serials: valid_state.revoked_serials.clone(),
-            crl_mtime: Some(std::time::SystemTime::now() - std::time::Duration::from_secs(86400)),
-            loaded_at: std::time::SystemTime::now(),
-        };
-        assert!(expired_state.is_revoked("aabbccdd"));
-
-        // Missing → no serials, no mtime
-        let missing_state = CrlState::default();
-        assert_eq!(missing_state.status, CrlStatus::Missing);
-        assert!(missing_state.revoked_serials.is_empty());
-        assert!(missing_state.crl_mtime.is_none());
-
-        // Invalid → no serials (fail-closed)
-        let invalid_state = CrlState {
-            status: CrlStatus::Invalid,
-            revoked_serials: HashSet::new(),
-            crl_mtime: Some(std::time::SystemTime::now()),
-            loaded_at: std::time::SystemTime::now(),
-        };
-        assert!(
-            !invalid_state.is_revoked("aabbccdd"),
-            "Invalid CRL should not match any serial"
-        );
-    }
 }

src/auth/mtls.rs

@@ -494,167 +494,4 @@ mod tests {
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("expired"));
     }
-
-    // -----------------------------------------------------------------------
-    // CrlAwareVerifier unit tests
-    // -----------------------------------------------------------------------
-
-    /// Test that CrlAwareVerifier can be constructed with a WebPKI verifier
-    /// and a SharedCrlState. This verifies the wiring is correct.
-    #[test]
-    fn crl_aware_verifier_construction() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        use super::super::crl::{new_shared_state, CrlState, CrlStatus};
-        use std::collections::HashSet;
-
-        // Build a simple CA cert + key for the root store.
-        let ca_key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut ca_params = rcgen::CertificateParams::default();
-        ca_params.not_before = time::OffsetDateTime::now_utc();
-        ca_params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365);
-        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        ca_params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test CA for Verifier");
-        ca_params.distinguished_name = dn;
-        let ca_cert = ca_params.self_signed(&ca_key).unwrap();
-
-        // Build root cert store with the CA.
-        let mut root_store = RootCertStore::empty();
-        root_store.add(ca_cert.der().to_owned()).unwrap();
-
-        // Build WebPKI verifier — build() returns Arc<WebPkiClientVerifier>
-        // which coerces to Arc<dyn ClientCertVerifier>.
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        // Build CRL state in Valid status.
-        let crl_state = new_shared_state();
-        let valid_state = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: HashSet::new(),
-            crl_mtime: None,
-            loaded_at: std::time::SystemTime::now(),
-        };
-        crl_state.store(Arc::new(valid_state));
-
-        // Construct CrlAwareVerifier — should succeed.
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
-        // If we reach here without panic, construction succeeded.
-    }
-
-    /// Test that CrlAwareVerifier with Missing CRL state can be constructed.
-    /// Missing CRL means the verifier falls back to WebPKI-only.
-    #[test]
-    fn crl_aware_verifier_with_missing_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        use super::super::crl::new_shared_state;
-
-        let ca_key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut ca_params = rcgen::CertificateParams::default();
-        ca_params.not_before = time::OffsetDateTime::now_utc();
-        ca_params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365);
-        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        ca_params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test CA for Verifier");
-        ca_params.distinguished_name = dn;
-        let ca_cert = ca_params.self_signed(&ca_key).unwrap();
-
-        let mut root_store = RootCertStore::empty();
-        root_store.add(ca_cert.der().to_owned()).unwrap();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        // Default state is Missing.
-        let crl_state = new_shared_state();
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
-    }
-
-    /// Test that CrlAwareVerifier with Invalid CRL state can be constructed.
-    /// Invalid CRL means the verifier should reject ALL client certificates.
-    #[test]
-    fn crl_aware_verifier_with_invalid_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        use super::super::crl::{new_shared_state, CrlState, CrlStatus};
-        use std::collections::HashSet;
-
-        let ca_key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut ca_params = rcgen::CertificateParams::default();
-        ca_params.not_before = time::OffsetDateTime::now_utc();
-        ca_params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365);
-        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        ca_params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test CA for Verifier");
-        ca_params.distinguished_name = dn;
-        let ca_cert = ca_params.self_signed(&ca_key).unwrap();
-
-        let mut root_store = RootCertStore::empty();
-        root_store.add(ca_cert.der().to_owned()).unwrap();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        let crl_state = new_shared_state();
-        let invalid_state = CrlState {
-            status: CrlStatus::Invalid,
-            revoked_serials: HashSet::new(),
-            crl_mtime: None,
-            loaded_at: std::time::SystemTime::now(),
-        };
-        crl_state.store(Arc::new(invalid_state));
-
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
-    }
-
-    /// Test that CrlAwareVerifier with a revoked serial in Valid CRL state
-    /// can be constructed. The actual verification logic is tested through
-    /// integration tests since it requires a full TLS handshake.
-    #[test]
-    fn crl_aware_verifier_with_revoked_serial() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        use super::super::crl::{new_shared_state, CrlState, CrlStatus};
-        use std::collections::HashSet;
-
-        let ca_key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut ca_params = rcgen::CertificateParams::default();
-        ca_params.not_before = time::OffsetDateTime::now_utc();
-        ca_params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365);
-        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        ca_params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test CA for Verifier");
-        ca_params.distinguished_name = dn;
-        let ca_cert = ca_params.self_signed(&ca_key).unwrap();
-
-        let mut root_store = RootCertStore::empty();
-        root_store.add(ca_cert.der().to_owned()).unwrap();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        let crl_state = new_shared_state();
-        let mut revoked = HashSet::new();
-        revoked.insert("deadbeef".to_string());
-        let valid_with_revoked = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: revoked,
-            crl_mtime: None,
-            loaded_at: std::time::SystemTime::now(),
-        };
-        crl_state.store(Arc::new(valid_with_revoked));
-
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
-        // Construction succeeded — the verifier is ready to reject revoked certs.
-    }
 }