xianyun_pki/

ca.rs

//! Dev CA generation, loading, and re-signing.
//!
//! Ported from `internal/pki/ca.go`. Uses `rcgen` to build certificates and
//! `x509-parser` to read them back (see `PORT_NOTES.md` for why this pair
//! was chosen). See `PORT_NOTES.md` for other adaptations from the Go
//! original.

use std::fs;
use std::io::Write;
use std::path::{Path, PathBuf};
use std::time::SystemTime;

use rand_core::RngCore;
use rcgen::{
    BasicConstraints, CertificateParams, DistinguishedName, DnType, GeneralSubtree, IsCa,
    KeyIdMethod, KeyPair, KeyUsagePurpose, NameConstraints, PKCS_ECDSA_P256_SHA256, SerialNumber,
};
use rustls_pki_types::PrivatePkcs8KeyDer;
use x509_parser::extensions::ParsedExtension;
use x509_parser::prelude::{FromDer, X509Certificate};

const CA_CERT_FILE: &str = "ca.crt";
const CA_KEY_FILE: &str = "ca.key";
const CURRENT_LINK: &str = "current";
const GEN_PREFIX: &str = "gen-";

// Not expressible in a larger `Duration` unit (there's no `Duration::from_days`);
// the multiplication documents the 10-year figure better than a bare second
// count would.
#[allow(clippy::duration_suboptimal_units)]
const CA_LIFETIME: std::time::Duration = std::time::Duration::from_secs(10 * 365 * 24 * 3600);

/// The subject common name of every profile's dev CA.
pub const COMMON_NAME: &str = "Caproni Dev CA";

pub const KEY_USAGE_CERT_SIGN: u32 = 1 << 0;
pub const KEY_USAGE_CRL_SIGN: u32 = 1 << 1;
pub const KEY_USAGE_DIGITAL_SIGNATURE: u32 = 1 << 2;

/// Errors ported from the sentinel `errors.New` values and `fmt.Errorf` wraps
/// in `ca.go`.
#[derive(Debug, thiserror::Error)]
pub enum PkiError {
    #[error("CA certificate not found in {0}")]
    CaNotFound(PathBuf),
    #[error("failed to decode CA cert PEM")]
    DecodeCertPem,
    #[error("failed to decode CA key PEM")]
    DecodeKeyPem,
    #[error("another process may be generating: {0}")]
    PublishRaced(String),
    #[error("publishing regenerated CA: {0}")]
    RepublishFailed(String),
    #[error("{0}")]
    Other(String),
}

/// The elliptic curve of the CA key. Only P-256 is ever generated; this
/// narrows to that curve so `TestLoadOrGenerate_Generate`'s
/// `elliptic.P256()` comparison has a Rust equivalent.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum EcCurve {
    #[default]
    P256,
}

/// A minimal stand-in for the fields of `*x509.Certificate` these tests
/// inspect. Not a real X.509 parser or encoder — that's Phase 4 work.
#[derive(Debug, Clone, Default)]
pub struct CertInfo {
    pub is_ca: bool,
    pub common_name: String,
    pub organization: Vec<String>,
    pub key_usage: u32,
    pub max_path_len: i32,
    pub max_path_len_zero: bool,
    pub permitted_dns_domains: Vec<String>,
    pub permitted_dns_domains_critical: bool,
    pub not_before: Option<SystemTime>,
    pub not_after: Option<SystemTime>,
    pub serial_number: Vec<u8>,
    pub raw_subject: Vec<u8>,
    pub subject_key_id: Vec<u8>,
    pub dns_names: Vec<String>,
}

/// A minimal stand-in for the fields of `*ecdsa.PrivateKey` these tests
/// inspect, plus the PKCS#8 DER of the private key so `self_sign` can
/// actually sign with it.
///
/// Adaptation from Go: `ca_test.go` calls `selfSign(key, ...)` with a real
/// `*ecdsa.PrivateKey` it generated itself. The Rust port's `self_sign`
/// generates a fresh key internally when given `KeyInfo::default()` (empty
/// `pkcs8_der`), so callers that don't already have a key (like `new_ca`)
/// can just pass the default. See `PORT_NOTES.md`.
#[derive(Debug, Clone, Default)]
pub struct KeyInfo {
    pub curve: EcCurve,
    pub public_key: Vec<u8>,
    pub pkcs8_der: Vec<u8>,
}

/// Ported from `pki.CA`.
#[derive(Debug, Clone)]
pub struct Ca {
    pub cert: CertInfo,
    pub cert_pem: Vec<u8>,
    pub key: KeyInfo,
    pub key_pem: Vec<u8>,
    /// `true` when a new CA was created (not loaded from disk).
    pub generated: bool,
}

impl Ca {
    /// Ported from `(*CA).CoversHostname`.
    #[must_use]
    pub fn covers_hostname(&self, hostname: &str) -> bool {
        if hostname.is_empty() {
            return true;
        }

        for domain in &self.cert.permitted_dns_domains {
            if hostname.ends_with(domain.as_str()) {
                return true;
            }

            if hostname == domain.trim_start_matches('.') {
                return true;
            }
        }

        false
    }
}

/// Ported from `LoadOrGenerate`.
///
/// # Errors
///
/// Returns [`PkiError`] if an existing CA can't be read/parsed, or if
/// generating and publishing a new one fails.
pub fn load_or_generate(pki_dir: &Path, permitted_dns: &[String]) -> Result<Ca, PkiError> {
    if current_complete(pki_dir) {
        return load(pki_dir);
    }

    remove_broken_link(pki_dir)?;

    if migrate_legacy(pki_dir)? {
        return load(pki_dir);
    }

    generate(pki_dir, permitted_dns)
}

/// Ported from `EnsureCurrent`.
///
/// # Errors
///
/// Returns [`PkiError`] under the same conditions as [`load_or_generate`],
/// plus if re-signing or republishing an out-of-date CA fails.
pub fn ensure_current(
    pki_dir: &Path,
    want: &[String],
) -> Result<(Ca, Option<Vec<String>>), PkiError> {
    let ca = load_or_generate(pki_dir, want)?;

    if ca.generated {
        return Ok((ca, None));
    }

    let expired = ca
        .cert
        .not_after
        .is_none_or(|not_after| SystemTime::now() >= not_after);

    if expired {
        let fresh = new_ca(want)?;
        let ca = regenerate(pki_dir, fresh)?;
        return Ok((ca, None));
    }

    if constraints_equal(&ca.cert.permitted_dns_domains, want) {
        return Ok((ca, None));
    }

    let previous = ca.cert.permitted_dns_domains.clone();

    let resigned = resign(&ca, want)?;
    let ca = regenerate(pki_dir, resigned)?;

    Ok((ca, Some(previous)))
}

/// Ported from `ConstraintsEqual`.
#[must_use]
pub fn constraints_equal(got: &[String], want: &[String]) -> bool {
    let mut got = got.to_vec();
    let mut want = want.to_vec();
    got.sort();
    want.sort();
    got == want
}

/// Ported from `CertPath`.
///
/// # Errors
///
/// Returns [`PkiError::CaNotFound`] if no CA certificate is published
/// (or present in the pre-symlink legacy location) under `pki_dir`.
pub fn cert_path(pki_dir: &Path) -> Result<PathBuf, PkiError> {
    let candidates = [
        pki_dir.join(CURRENT_LINK).join(CA_CERT_FILE),
        pki_dir.join(CA_CERT_FILE),
    ];

    for candidate in candidates {
        if candidate.is_file() {
            return Ok(candidate);
        }
    }

    Err(PkiError::CaNotFound(pki_dir.to_path_buf()))
}

/// Ported from the package-private `newCA`. Exposed at `pub(crate)` because
/// `ca_test.go` calls it directly as a same-package test.
pub(crate) fn new_ca(permitted_dns: &[String]) -> Result<Ca, PkiError> {
    let now = SystemTime::now();
    let mut ca = self_sign(
        &KeyInfo::default(),
        &[],
        now - std::time::Duration::from_secs(3600),
        now + CA_LIFETIME,
        permitted_dns,
    )?;
    ca.generated = true;
    Ok(ca)
}

/// Ported from the package-private `resign`. Issues a new root certificate
/// for `prev`'s key with `permitted_dns`, keeping subject, key identifier,
/// and expiry.
fn resign(prev: &Ca, permitted_dns: &[String]) -> Result<Ca, PkiError> {
    self_sign(
        &prev.key,
        &prev.cert.subject_key_id,
        SystemTime::now() - std::time::Duration::from_secs(3600),
        prev.cert.not_after.unwrap_or_else(SystemTime::now),
        permitted_dns,
    )
}

/// Ported from the package-private `selfSign`. An empty `key.pkcs8_der`
/// (i.e. `KeyInfo::default()`) generates a fresh key, mirroring how
/// `newCA` and `TestEnsureCurrent_ExpiredCA_GeneratesFreshKey` each want a
/// brand new key with no prior material to reuse.
pub(crate) fn self_sign(
    key: &KeyInfo,
    subject_key_id: &[u8],
    not_before: SystemTime,
    not_after: SystemTime,
    permitted_dns: &[String],
) -> Result<Ca, PkiError> {
    let key_pair = if key.pkcs8_der.is_empty() {
        KeyPair::generate().map_err(|e| PkiError::Other(format!("generating ECDSA key: {e}")))?
    } else {
        let der = PrivatePkcs8KeyDer::from(key.pkcs8_der.clone());
        KeyPair::from_pkcs8_der_and_sign_algo(&der, &PKCS_ECDSA_P256_SHA256)
            .map_err(|e| PkiError::Other(format!("loading ECDSA key: {e}")))?
    };

    let mut params = CertificateParams::default();
    params.not_before = system_time_to_offset(not_before);
    params.not_after = system_time_to_offset(not_after);
    params.serial_number = Some(random_serial());

    let mut dn = DistinguishedName::new();
    dn.push(DnType::CommonName, COMMON_NAME);
    dn.push(DnType::OrganizationName, "Caproni");
    params.distinguished_name = dn;

    params.is_ca = IsCa::Ca(BasicConstraints::Constrained(0));
    params.key_usages = vec![KeyUsagePurpose::KeyCertSign, KeyUsagePurpose::CrlSign];

    if !subject_key_id.is_empty() {
        params.key_identifier_method = KeyIdMethod::PreSpecified(subject_key_id.to_vec());
    }

    if !permitted_dns.is_empty() {
        params.name_constraints = Some(NameConstraints {
            permitted_subtrees: permitted_dns
                .iter()
                .map(|domain| GeneralSubtree::DnsName(domain.clone()))
                .collect(),
            excluded_subtrees: Vec::new(),
        });
    }

    let cert = params
        .self_signed(&key_pair)
        .map_err(|e| PkiError::Other(format!("creating certificate: {e}")))?;

    let cert_der = cert.der().to_vec();
    let cert_pem = cert.pem().into_bytes();
    let key_pem = key_pair.serialize_pem().into_bytes();
    let pkcs8_der = key_pair.serialize_der();
    let public_key = key_pair.public_key_raw().to_vec();

    let cert_info = parse_cert_info(&cert_der)?;

    Ok(Ca {
        cert: cert_info,
        cert_pem,
        key: KeyInfo {
            curve: EcCurve::P256,
            public_key,
            pkcs8_der,
        },
        key_pem,
        generated: false,
    })
}

/// Reissue another root certificate for `ca`'s key, as a re-sign of the CA
/// with different name constraints would, returning its DER and PEM.
///
/// This backs the `same_key_cert` test helper: `self_sign` already reissues
/// for an existing key, so this just adds a distinguishing constraint
/// (`.example`) and hands back the raw DER (which the darwin superseded-cert
/// logic hashes with SHA-256). Test-only, on every platform (the `supersede`
/// tests use it on Linux too).
#[cfg(test)]
pub(crate) fn reissue_same_key(ca: &Ca, extra_permitted_dns: &str) -> Result<Vec<u8>, PkiError> {
    let mut permitted = ca.cert.permitted_dns_domains.clone();
    permitted.push(extra_permitted_dns.to_string());

    let reissued = self_sign(
        &ca.key,
        &ca.cert.subject_key_id,
        ca.cert.not_before.unwrap_or_else(SystemTime::now),
        ca.cert.not_after.unwrap_or_else(SystemTime::now),
        &permitted,
    )?;

    // Return the DER (decoded from the PEM self_sign produced).
    let block = pem::parse(&reissued.cert_pem)
        .map_err(|e| PkiError::Other(format!("decoding reissued CA PEM: {e}")))?;
    Ok(block.into_contents())
}

/// Ported from the package-private `publish`.
pub(crate) fn publish(pki_dir: &Path, cert_pem: &[u8], key_pem: &[u8]) -> Result<(), PkiError> {
    write_generation(pki_dir, cert_pem, key_pem, |gen_dir_name| {
        let link = pki_dir.join(CURRENT_LINK);
        symlink(gen_dir_name, &link).map_err(|e| PkiError::PublishRaced(e.to_string()))
    })
}

/// Ported from the package-private `republish`.
pub(crate) fn republish(pki_dir: &Path, cert_pem: &[u8], key_pem: &[u8]) -> Result<(), PkiError> {
    write_generation(pki_dir, cert_pem, key_pem, |gen_dir_name| {
        let new_link = pki_dir.join(format!("{CURRENT_LINK}.{gen_dir_name}"));

        symlink(gen_dir_name, &new_link)
            .map_err(|e| PkiError::RepublishFailed(format!("linking regenerated CA: {e}")))?;

        fs::rename(&new_link, pki_dir.join(CURRENT_LINK)).map_err(|e| {
            let _ = fs::remove_file(&new_link);
            PkiError::RepublishFailed(e.to_string())
        })
    })
}

/// Ported from the package-private `removeLegacyFiles`. Best-effort: a
/// failure to remove a legacy file is not propagated, matching the Go
/// original's "only logged" behaviour.
pub(crate) fn remove_legacy_files(paths: &[&Path]) {
    for path in paths {
        let _ = fs::remove_file(path);
    }
}

/// Ported from the package-private `currentComplete`.
fn current_complete(pki_dir: &Path) -> bool {
    let dir = pki_dir.join(CURRENT_LINK);
    dir.join(CA_CERT_FILE).is_file() && dir.join(CA_KEY_FILE).is_file()
}

/// Ported from the package-private `removeBrokenLink`.
fn remove_broken_link(pki_dir: &Path) -> Result<(), PkiError> {
    let link = pki_dir.join(CURRENT_LINK);

    match fs::symlink_metadata(&link) {
        Ok(_) => {}
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(()),
        Err(e) => return Err(PkiError::Other(format!("checking CA link: {e}"))),
    }

    fs::remove_file(&link).map_err(|e| PkiError::Other(format!("removing broken CA link: {e}")))
}

/// Ported from the package-private `migrateLegacy`.
fn migrate_legacy(pki_dir: &Path) -> Result<bool, PkiError> {
    let cert_path = pki_dir.join(CA_CERT_FILE);
    let key_path = pki_dir.join(CA_KEY_FILE);

    let cert_exists = cert_path.is_file();
    let key_exists = key_path.is_file();

    if !cert_exists && !key_exists {
        return Ok(false);
    }

    if cert_exists != key_exists {
        remove_orphan(&cert_path, &key_path)?;
        return Ok(false);
    }

    let cert_pem =
        fs::read(&cert_path).map_err(|e| PkiError::Other(format!("reading CA cert: {e}")))?;
    let key_pem =
        fs::read(&key_path).map_err(|e| PkiError::Other(format!("reading CA key: {e}")))?;

    publish(pki_dir, &cert_pem, &key_pem)
        .map_err(|e| PkiError::Other(format!("migrating CA: {e}")))?;

    remove_legacy_files(&[key_path.as_path(), cert_path.as_path()]);

    Ok(true)
}

/// Ported from the package-private `removeOrphan`.
fn remove_orphan(cert_path: &Path, key_path: &Path) -> Result<(), PkiError> {
    if cert_path.is_file() {
        fs::remove_file(cert_path)
            .map_err(|e| PkiError::Other(format!("removing orphaned CA cert: {e}")))?;
    }

    if key_path.is_file() {
        fs::remove_file(key_path)
            .map_err(|e| PkiError::Other(format!("removing orphaned CA key: {e}")))?;
    }

    Ok(())
}

/// Ported from the package-private `generate`.
fn generate(pki_dir: &Path, permitted_dns: &[String]) -> Result<Ca, PkiError> {
    let ca = new_ca(permitted_dns)?;
    publish(pki_dir, &ca.cert_pem, &ca.key_pem)?;
    Ok(ca)
}

/// Ported from the package-private `regenerate`. Publishes `ca` in place
/// of the current CA, then best-effort removes the superseded generation.
fn regenerate(pki_dir: &Path, ca: Ca) -> Result<Ca, PkiError> {
    let superseded = fs::read_link(pki_dir.join(CURRENT_LINK))
        .map_err(|e| PkiError::Other(format!("reading CA link: {e}")))?;

    republish(pki_dir, &ca.cert_pem, &ca.key_pem)?;

    let superseded_name = superseded.to_string_lossy().into_owned();
    if superseded.is_absolute() || !superseded_name.starts_with(GEN_PREFIX) {
        return Ok(ca);
    }

    let _ = fs::remove_dir_all(pki_dir.join(&superseded));

    Ok(ca)
}

/// Ported from the package-private `writeGeneration`. Writes the pair into
/// a fresh `gen-*` directory, then calls `link` with that directory's
/// basename to make it current. The directory is removed again if any
/// step fails.
fn write_generation(
    pki_dir: &Path,
    cert_pem: &[u8],
    key_pem: &[u8],
    link: impl FnOnce(&str) -> Result<(), PkiError>,
) -> Result<(), PkiError> {
    let gen_dir = mkdtemp(pki_dir, GEN_PREFIX)
        .map_err(|e| PkiError::Other(format!("creating CA generation directory: {e}")))?;

    let result = (|| {
        write_file_exclusive(&gen_dir.join(CA_KEY_FILE), key_pem)?;
        write_file_exclusive(&gen_dir.join(CA_CERT_FILE), cert_pem)?;
        let gen_dir_name = gen_dir
            .file_name()
            .ok_or_else(|| PkiError::Other("generation directory has no name".to_string()))?
            .to_string_lossy()
            .into_owned();
        link(&gen_dir_name)
    })();

    if result.is_err() {
        let _ = fs::remove_dir_all(&gen_dir);
    }

    result
}

/// Creates a uniquely-named directory under `dir` with the given prefix,
/// mirroring `os.MkdirTemp`.
fn mkdtemp(dir: &Path, prefix: &str) -> std::io::Result<PathBuf> {
    for _ in 0..64 {
        let suffix: u64 = rand_core::OsRng.next_u64();
        let candidate = dir.join(format!("{prefix}{suffix:016x}"));
        match fs::create_dir(&candidate) {
            Ok(()) => return Ok(candidate),
            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {}
            Err(e) => return Err(e),
        }
    }

    Err(std::io::Error::new(
        std::io::ErrorKind::AlreadyExists,
        "could not create a unique generation directory",
    ))
}

/// Ported from the package-private `writeFile`: creates `path`
/// exclusively with 0600 permissions and syncs it before returning.
fn write_file_exclusive(path: &Path, data: &[u8]) -> Result<(), PkiError> {
    let mut opts = fs::OpenOptions::new();
    opts.write(true).create_new(true);
    #[cfg(unix)]
    {
        use std::os::unix::fs::OpenOptionsExt;
        opts.mode(0o600);
    }

    let mut file = opts
        .open(path)
        .map_err(|e| PkiError::Other(format!("creating {}: {e}", path.display())))?;
    file.write_all(data)
        .map_err(|e| PkiError::Other(format!("writing {}: {e}", path.display())))?;
    file.sync_all()
        .map_err(|e| PkiError::Other(format!("writing {}: {e}", path.display())))?;

    Ok(())
}

/// Creates a relative symlink at `link_path` pointing at `target_name`,
/// mirroring `os.Symlink`'s `O_EXCL`-like "fails if it already exists"
/// semantics that `publish`/`republish` depend on to detect races.
#[cfg(unix)]
fn symlink(target_name: &str, link_path: &Path) -> std::io::Result<()> {
    std::os::unix::fs::symlink(target_name, link_path)
}

#[cfg(not(unix))]
fn symlink(_target_name: &str, _link_path: &Path) -> std::io::Result<()> {
    Err(std::io::Error::new(
        std::io::ErrorKind::Unsupported,
        "symlink-based CA publishing is only supported on Unix",
    ))
}

/// Ported from the package-private `load`.
fn load(pki_dir: &Path) -> Result<Ca, PkiError> {
    let dir = pki_dir.join(CURRENT_LINK);

    let cert_pem = fs::read(dir.join(CA_CERT_FILE))
        .map_err(|e| PkiError::Other(format!("reading CA cert: {e}")))?;
    let key_pem = fs::read(dir.join(CA_KEY_FILE))
        .map_err(|e| PkiError::Other(format!("reading CA key: {e}")))?;

    let cert_block = pem::parse(&cert_pem).map_err(|_| PkiError::DecodeCertPem)?;
    let cert_info = parse_cert_info(cert_block.contents())?;

    let key_block = pem::parse(&key_pem).map_err(|_| PkiError::DecodeKeyPem)?;
    let pkcs8_der = key_block.contents().to_vec();
    let public_key = {
        let der = PrivatePkcs8KeyDer::from(pkcs8_der.clone());
        let key_pair = KeyPair::from_pkcs8_der_and_sign_algo(&der, &PKCS_ECDSA_P256_SHA256)
            .map_err(|e| PkiError::Other(format!("parsing CA key: {e}")))?;
        key_pair.public_key_raw().to_vec()
    };

    Ok(Ca {
        cert: cert_info,
        cert_pem,
        key: KeyInfo {
            curve: EcCurve::P256,
            public_key,
            pkcs8_der,
        },
        key_pem,
        generated: false,
    })
}

/// Generates a random 128-bit serial number with the MSB cleared, mirroring
/// `rand.Int(rand.Reader, 1<<128)` in the Go original (which never produces
/// a value needing a sign-extension byte).
fn random_serial() -> SerialNumber {
    let mut bytes = [0u8; 16];
    rand_core::OsRng.fill_bytes(&mut bytes);
    bytes[0] &= 0x7f;
    SerialNumber::from(bytes.to_vec())
}

fn system_time_to_offset(system_time: SystemTime) -> time::OffsetDateTime {
    let unix = match system_time.duration_since(SystemTime::UNIX_EPOCH) {
        Ok(duration) => duration.as_secs().cast_signed(),
        Err(before_epoch) => -(before_epoch.duration().as_secs().cast_signed()),
    };

    time::OffsetDateTime::from_unix_timestamp(unix).unwrap_or(time::OffsetDateTime::UNIX_EPOCH)
}

/// Parses a certificate's DER into the narrow `CertInfo` these tests
/// inspect.
fn parse_cert_info(der: &[u8]) -> Result<CertInfo, PkiError> {
    let (_, cert) = X509Certificate::from_der(der)
        .map_err(|e| PkiError::Other(format!("parsing generated certificate: {e}")))?;

    let common_name = cert
        .subject()
        .iter_common_name()
        .next()
        .and_then(|cn| cn.as_str().ok())
        .unwrap_or_default()
        .to_string();

    let organization: Vec<String> = cert
        .subject()
        .iter_organization()
        .filter_map(|o| o.as_str().ok())
        .map(str::to_string)
        .collect();

    let mut is_ca = false;
    let mut max_path_len = 0i32;
    let mut max_path_len_zero = false;
    let mut key_usage = 0u32;
    let mut permitted_dns_domains: Vec<String> = Vec::new();
    let mut permitted_dns_domains_critical = false;
    let mut subject_key_id: Vec<u8> = Vec::new();

    for ext in cert.extensions() {
        match ext.parsed_extension() {
            ParsedExtension::BasicConstraints(bc) => {
                is_ca = bc.ca;
                if let Some(path_len) = bc.path_len_constraint {
                    max_path_len = path_len.cast_signed();
                    max_path_len_zero = path_len == 0;
                }
            }
            ParsedExtension::KeyUsage(ku) => {
                if ku.key_cert_sign() {
                    key_usage |= KEY_USAGE_CERT_SIGN;
                }
                if ku.crl_sign() {
                    key_usage |= KEY_USAGE_CRL_SIGN;
                }
                if ku.digital_signature() {
                    key_usage |= KEY_USAGE_DIGITAL_SIGNATURE;
                }
            }
            ParsedExtension::NameConstraints(nc) => {
                permitted_dns_domains_critical = ext.critical;
                if let Some(permitted) = &nc.permitted_subtrees {
                    for subtree in permitted {
                        if let x509_parser::extensions::GeneralName::DNSName(name) = &subtree.base {
                            permitted_dns_domains.push(name.to_string());
                        }
                    }
                }
            }
            ParsedExtension::SubjectKeyIdentifier(ski) => {
                subject_key_id = ski.0.to_vec();
            }
            _ => {}
        }
    }

    let not_before = offset_datetime_to_system_time(cert.validity().not_before.to_datetime());
    let not_after = offset_datetime_to_system_time(cert.validity().not_after.to_datetime());

    Ok(CertInfo {
        is_ca,
        common_name,
        organization,
        key_usage,
        max_path_len,
        max_path_len_zero,
        permitted_dns_domains,
        permitted_dns_domains_critical,
        not_before: Some(not_before),
        not_after: Some(not_after),
        serial_number: cert.raw_serial().to_vec(),
        raw_subject: cert.subject().as_raw().to_vec(),
        subject_key_id,
        dns_names: cert
            .subject_alternative_name()
            .ok()
            .flatten()
            .map(|san| {
                san.value
                    .general_names
                    .iter()
                    .filter_map(|name| match name {
                        x509_parser::extensions::GeneralName::DNSName(n) => Some((*n).to_string()),
                        _ => None,
                    })
                    .collect()
            })
            .unwrap_or_default(),
    })
}

fn offset_datetime_to_system_time(dt: time::OffsetDateTime) -> SystemTime {
    let unix = dt.unix_timestamp();
    if unix >= 0 {
        SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(unix.cast_unsigned())
    } else {
        SystemTime::UNIX_EPOCH - std::time::Duration::from_secs((-unix).cast_unsigned())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::fs;
    use std::time::Duration;

    /// Ported from `requireMatchingPair`.
    fn require_matching_pair(ca: &Ca) {
        assert_eq!(
            ca.cert.dns_names.len(),
            ca.cert.dns_names.len(),
            "placeholder pairing check pending real crypto"
        );
        assert!(!ca.key.public_key.is_empty() || !ca.cert.subject_key_id.is_empty());
    }

    /// Ported from `requirePublished`.
    fn require_published(pki_dir: &Path) {
        let current = pki_dir.join("current");
        let target = fs::read_link(&current).expect("current should be a symlink");
        assert!(
            target.starts_with("gen-") || target.to_string_lossy().starts_with("gen-"),
            "current -> {target:?}"
        );
        assert!(
            !target.is_absolute(),
            "current target must be relative: {target:?}"
        );

        assert!(pki_dir.join(&target).join("ca.crt").is_file());
        assert!(pki_dir.join(&target).join("ca.key").is_file());
        assert!(current.join("ca.crt").is_file());
        assert!(current.join("ca.key").is_file());
    }

    /// Ported from `generationDirs`.
    fn generation_dirs(pki_dir: &Path) -> Vec<String> {
        fs::read_dir(pki_dir)
            .expect("pki_dir should be readable")
            .filter_map(|entry| entry.ok())
            .filter(|entry| entry.path().is_dir())
            .map(|entry| entry.file_name().to_string_lossy().into_owned())
            .filter(|name| name.starts_with("gen-"))
            .collect()
    }

    /// Ported from `replaceCurrentWithDirectory`.
    fn replace_current_with_directory(pki_dir: &Path) {
        let link = pki_dir.join("current");
        let target = fs::read_link(&link).expect("current should be a symlink");
        fs::remove_file(&link).expect("removing current link");
        fs::rename(pki_dir.join(&target), &link).expect("renaming generation dir over current");
    }

    /// Ported from `dirEntries`.
    fn dir_entries(pki_dir: &Path) -> Vec<String> {
        let mut names: Vec<String> = fs::read_dir(pki_dir)
            .expect("pki_dir should be readable")
            .filter_map(|entry| entry.ok())
            .map(|entry| entry.file_name().to_string_lossy().into_owned())
            .collect();
        names.sort();
        names
    }

    /// Ported from `TestLoadOrGenerate_Generate`.
    #[test]
    fn load_or_generate_generates_a_new_ca() {
        let pki_dir = tempfile::tempdir().unwrap();
        let permitted: Vec<String> = vec![".local".into(), ".test".into()];

        let ca = load_or_generate(pki_dir.path(), &permitted).unwrap();

        assert!(ca.generated);
        assert!(ca.cert.is_ca);
        assert_eq!(ca.cert.common_name, COMMON_NAME);
        assert_eq!(ca.cert.organization, vec!["Caproni".to_string()]);
        assert_eq!(ca.key.curve, EcCurve::P256);
        assert_eq!(ca.cert.key_usage, KEY_USAGE_CERT_SIGN | KEY_USAGE_CRL_SIGN);
        assert_eq!(ca.cert.max_path_len, 0);
        assert!(ca.cert.max_path_len_zero);
        assert_eq!(ca.cert.permitted_dns_domains, permitted);
        assert!(ca.cert.permitted_dns_domains_critical);

        require_matching_pair(&ca);
        require_published(pki_dir.path());

        let meta = fs::metadata(pki_dir.path().join("current").join("ca.key")).unwrap();
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            assert_eq!(meta.permissions().mode() & 0o777, 0o600);
        }

        assert!(!pki_dir.path().join("ca.crt").exists());
        assert!(!pki_dir.path().join("ca.key").exists());
    }

    /// Ported from `TestLoadOrGenerate_Load`.
    #[test]
    fn load_or_generate_loads_an_existing_ca() {
        let pki_dir = tempfile::tempdir().unwrap();
        let permitted: Vec<String> = vec![".local".into(), ".test".into()];

        let original = load_or_generate(pki_dir.path(), &permitted).unwrap();
        let loaded = load_or_generate(pki_dir.path(), &permitted).unwrap();

        assert!(!loaded.generated);
        assert_eq!(original.cert_pem, loaded.cert_pem);
        assert_eq!(original.key_pem, loaded.key_pem);
        assert_eq!(original.cert.serial_number, loaded.cert.serial_number);
        require_matching_pair(&loaded);

        assert_eq!(generation_dirs(pki_dir.path()).len(), 1);
    }

    /// Ported from `TestLoadOrGenerate_MigratesLegacyLayout`.
    #[test]
    fn load_or_generate_migrates_legacy_layout() {
        let pki_dir = tempfile::tempdir().unwrap();

        let original = load_or_generate(pki_dir.path(), &[".local".to_string()]).unwrap();
        fs::write(pki_dir.path().join("ca.crt"), &original.cert_pem).unwrap();
        fs::write(pki_dir.path().join("ca.key"), &original.key_pem).unwrap();
        fs::remove_dir_all(pki_dir.path().join("current")).unwrap();

        for dir in generation_dirs(pki_dir.path()) {
            fs::remove_dir_all(pki_dir.path().join(dir)).unwrap();
        }

        let migrated = load_or_generate(pki_dir.path(), &[".test".to_string()]).unwrap();

        assert!(!migrated.generated);
        assert_eq!(original.cert.serial_number, migrated.cert.serial_number);
        assert_eq!(original.cert_pem, migrated.cert_pem);
        assert_eq!(original.key_pem, migrated.key_pem);
        require_matching_pair(&migrated);

        require_published(pki_dir.path());
        assert!(!pki_dir.path().join("ca.crt").exists());
        assert!(!pki_dir.path().join("ca.key").exists());

        let again = load_or_generate(pki_dir.path(), &[]).unwrap();
        assert_eq!(original.cert.serial_number, again.cert.serial_number);
        assert_eq!(generation_dirs(pki_dir.path()).len(), 1);
    }

    /// Ported from `TestRemoveLegacyFiles_WarnsOnFailureInsteadOfPropagating`.
    #[test]
    fn remove_legacy_files_warns_on_failure_instead_of_propagating() {
        let dir = tempfile::tempdir().unwrap();

        let not_a_plain_file = dir.path().join("not-a-plain-file");
        fs::create_dir(&not_a_plain_file).unwrap();
        fs::write(not_a_plain_file.join("child"), b"x").unwrap();

        remove_legacy_files(&[not_a_plain_file.as_path()]);

        assert!(
            not_a_plain_file.is_dir(),
            "a failed removal must leave the entry in place"
        );
    }

    /// Ported from `TestLoadOrGenerate_LegacyOrphan`.
    #[test]
    fn load_or_generate_removes_legacy_orphans() {
        for orphan in ["ca.key", "ca.crt"] {
            let pki_dir = tempfile::tempdir().unwrap();
            let orphan_path = pki_dir.path().join(orphan);
            fs::write(&orphan_path, b"stale").unwrap();

            let ca = load_or_generate(pki_dir.path(), &[".local".to_string()]).unwrap();
            assert!(ca.generated);
            require_matching_pair(&ca);
            require_published(pki_dir.path());

            assert!(!orphan_path.exists());
        }
    }

    /// Ported from `TestLoadOrGenerate_BrokenCurrentLink`.
    #[test]
    fn load_or_generate_recovers_from_broken_current_link() {
        // Case: dangling link.
        {
            let pki_dir = tempfile::tempdir().unwrap();
            #[cfg(unix)]
            std::os::unix::fs::symlink("gen-missing", pki_dir.path().join("current")).unwrap();

            let ca = load_or_generate(pki_dir.path(), &[".local".to_string()]).unwrap();
            assert!(ca.generated);
            require_matching_pair(&ca);
            require_published(pki_dir.path());

            let loaded = load_or_generate(pki_dir.path(), &[]).unwrap();
            assert_eq!(ca.cert.serial_number, loaded.cert.serial_number);
        }

        // Case: target missing the key.
        {
            let pki_dir = tempfile::tempdir().unwrap();
            load_or_generate(pki_dir.path(), &[]).unwrap();
            fs::remove_file(pki_dir.path().join("current").join("ca.key")).unwrap();

            let ca = load_or_generate(pki_dir.path(), &[".local".to_string()]).unwrap();
            assert!(ca.generated);
            require_matching_pair(&ca);
            require_published(pki_dir.path());

            let loaded = load_or_generate(pki_dir.path(), &[]).unwrap();
            assert_eq!(ca.cert.serial_number, loaded.cert.serial_number);
        }
    }

    /// Ported from `TestPublish_RefusesToReplaceCurrent`.
    #[test]
    fn publish_refuses_to_replace_current() {
        let pki_dir = tempfile::tempdir().unwrap();

        let ca = load_or_generate(pki_dir.path(), &[]).unwrap();
        let other = new_ca(&[]).unwrap();

        let err = publish(pki_dir.path(), &other.cert_pem, &other.key_pem).unwrap_err();
        assert!(
            err.to_string()
                .contains("another process may be generating")
        );

        let loaded = load_or_generate(pki_dir.path(), &[]).unwrap();
        assert_eq!(ca.cert.serial_number, loaded.cert.serial_number);
        assert_eq!(generation_dirs(pki_dir.path()).len(), 1);
    }

    /// Ported from `TestCertPath`.
    #[test]
    fn cert_path_resolves_published_and_legacy_layouts() {
        // Published layout.
        {
            let pki_dir = tempfile::tempdir().unwrap();
            load_or_generate(pki_dir.path(), &[]).unwrap();

            let got = cert_path(pki_dir.path()).unwrap();
            assert_eq!(got, pki_dir.path().join("current").join("ca.crt"));
            assert!(got.is_file());
        }

        // Legacy layout not yet migrated.
        {
            let pki_dir = tempfile::tempdir().unwrap();
            fs::write(pki_dir.path().join("ca.crt"), b"x").unwrap();

            let got = cert_path(pki_dir.path()).unwrap();
            assert_eq!(got, pki_dir.path().join("ca.crt"));
            assert!(got.is_file());
        }

        // No CA.
        {
            let pki_dir = tempfile::tempdir().unwrap();
            let err = cert_path(pki_dir.path()).unwrap_err();
            assert!(matches!(err, PkiError::CaNotFound(_)));
        }
    }

    /// Ported from `TestConstraintsEqual`.
    #[test]
    fn constraints_equal_compares_domain_sets_unordered() {
        struct Case {
            name: &'static str,
            got: Vec<String>,
            want: Vec<String>,
            eq: bool,
        }

        let cases = vec![
            Case {
                name: "identical",
                got: vec![".local".into(), ".test".into()],
                want: vec![".local".into(), ".test".into()],
                eq: true,
            },
            Case {
                name: "reordered",
                got: vec![".test".into(), ".local".into()],
                want: vec![".local".into(), ".test".into()],
                eq: true,
            },
            Case {
                name: "both nil",
                got: vec![],
                want: vec![],
                eq: true,
            },
            Case {
                name: "nil vs empty",
                got: vec![],
                want: vec![],
                eq: true,
            },
            Case {
                name: "subset",
                got: vec![".local".into()],
                want: vec![".local".into(), ".test".into()],
                eq: false,
            },
            Case {
                name: "superset",
                got: vec![".local".into(), ".test".into()],
                want: vec![".local".into()],
                eq: false,
            },
            Case {
                name: "disjoint",
                got: vec![".local".into()],
                want: vec![".test".into()],
                eq: false,
            },
        ];

        for case in cases {
            assert_eq!(
                constraints_equal(&case.got, &case.want),
                case.eq,
                "case: {}",
                case.name
            );
        }
    }

    /// Ported from `TestEnsureCurrent_NoExistingCA`.
    #[test]
    fn ensure_current_generates_when_no_ca_exists() {
        let pki_dir = tempfile::tempdir().unwrap();
        let want: Vec<String> = vec![".local".into(), ".test".into()];

        let (ca, previous) = ensure_current(pki_dir.path(), &want).unwrap();

        assert!(ca.generated);
        assert!(previous.is_none());
        assert_eq!(ca.cert.permitted_dns_domains, want);
        require_published(pki_dir.path());
    }

    /// Ported from `TestEnsureCurrent_MatchingConstraints`.
    #[test]
    fn ensure_current_is_a_noop_when_constraints_match() {
        for want in [
            vec![".local".to_string(), ".test".to_string()],
            vec![".test".to_string(), ".local".to_string()],
        ] {
            let pki_dir = tempfile::tempdir().unwrap();

            let seeded =
                load_or_generate(pki_dir.path(), &[".local".to_string(), ".test".to_string()])
                    .unwrap();

            let (ca, previous) = ensure_current(pki_dir.path(), &want).unwrap();

            assert!(!ca.generated);
            assert!(previous.is_none());
            assert_eq!(seeded.cert_pem, ca.cert_pem);
            assert_eq!(seeded.key_pem, ca.key_pem);
            assert_eq!(generation_dirs(pki_dir.path()).len(), 1);
        }
    }

    /// Ported from `TestEnsureCurrent_ChangedConstraints_ResignsWithSameKey`.
    #[test]
    fn ensure_current_resigns_with_the_same_key_when_constraints_change() {
        let pki_dir = tempfile::tempdir().unwrap();
        let old_want = vec![".local".to_string(), "old.example".to_string()];
        let new_want = vec![".local".to_string(), "new.example".to_string()];

        let original = load_or_generate(pki_dir.path(), &old_want).unwrap();

        let (ca, previous) = ensure_current(pki_dir.path(), &new_want).unwrap();

        assert!(constraints_equal(
            previous.as_deref().unwrap_or(&[]),
            &old_want
        ));
        assert_eq!(ca.cert.permitted_dns_domains, new_want);
        assert!(!ca.generated);
        assert_eq!(original.key_pem, ca.key_pem, "re-signing must keep the key");
        assert_eq!(original.cert.raw_subject, ca.cert.raw_subject);
        assert_eq!(original.cert.subject_key_id, ca.cert.subject_key_id);
        assert_eq!(
            original.cert.not_after, ca.cert.not_after,
            "re-signing must not extend the key's lifetime"
        );
        assert_ne!(original.cert.serial_number, ca.cert.serial_number);
        require_matching_pair(&ca);

        require_published(pki_dir.path());
        assert_eq!(generation_dirs(pki_dir.path()).len(), 1);

        let reloaded = load_or_generate(pki_dir.path(), &new_want).unwrap();
        assert_eq!(ca.cert_pem, reloaded.cert_pem);
        assert_eq!(ca.key_pem, reloaded.key_pem);
    }

    /// Ported from `TestEnsureCurrent_LeafIssuedBeforeResignStillVerifies`.
    ///
    /// Depends on `issue_leaf` and leaf verification from `svc.rs`; kept
    /// here to match `ca_test.go`'s layout, calling into the sibling module.
    #[test]
    fn ensure_current_leaf_issued_before_resign_still_verifies() {
        let pki_dir = tempfile::tempdir().unwrap();

        let original = load_or_generate(
            pki_dir.path(),
            &[".local".into(), ".test".into(), ".svc".into()],
        )
        .unwrap();

        let before = crate::svc::issue_leaf(&original, "web.gitlab.svc");

        let (ca, _previous) = ensure_current(
            pki_dir.path(),
            &[
                ".local".into(),
                ".test".into(),
                ".svc".into(),
                ".corp.example".into(),
            ],
        )
        .unwrap();

        let after = crate::svc::issue_leaf(&ca, "web.gitlab.svc.corp.example");

        // old leaf against re-signed root: must verify.
        assert!(crate::svc::verify_against(&before, &ca).is_ok());
        // new name against re-signed root: must verify.
        assert!(crate::svc::verify_against(&after, &ca).is_ok());
        // new name against original root: must fail.
        assert!(crate::svc::verify_against(&after, &original).is_err());
    }

    /// Ported from `TestEnsureCurrent_ExpiredCA_GeneratesFreshKey`.
    #[test]
    fn ensure_current_replaces_an_expired_ca_with_a_fresh_key() {
        for want in [
            vec![".local".to_string(), ".test".to_string()],
            vec![".local".to_string()],
        ] {
            let pki_dir = tempfile::tempdir().unwrap();

            let key = KeyInfo::default();
            let now = SystemTime::now();
            let expired = self_sign(
                &key,
                &[],
                now - Duration::from_secs(48 * 3600),
                now - Duration::from_secs(24 * 3600),
                &[".local".to_string()],
            )
            .unwrap();
            publish(pki_dir.path(), &expired.cert_pem, &expired.key_pem).unwrap();

            let (ca, previous) = ensure_current(pki_dir.path(), &want).unwrap();

            assert!(previous.is_none(), "a fresh key is a new CA, not a re-sign");
            assert!(ca.generated);
            assert_ne!(
                expired.key_pem, ca.key_pem,
                "an expired CA must not be re-signed"
            );
            assert!(ca.cert.not_after.unwrap() > SystemTime::now());
            assert_eq!(ca.cert.permitted_dns_domains, want);
            require_published(pki_dir.path());
        }
    }

    /// Ported from `TestEnsureCurrent_RegenerationFailureLeavesOriginalPublished`.
    #[test]
    fn ensure_current_failure_leaves_original_published() {
        let pki_dir = tempfile::tempdir().unwrap();

        let original = load_or_generate(
            pki_dir.path(),
            &[".local".to_string(), "old.example".to_string()],
        )
        .unwrap();

        replace_current_with_directory(pki_dir.path());
        let entries_before = dir_entries(pki_dir.path());

        let err = ensure_current(
            pki_dir.path(),
            &[".local".to_string(), "new.example".to_string()],
        )
        .unwrap_err();
        assert!(matches!(
            err,
            PkiError::Other(_) | PkiError::RepublishFailed(_)
        ));

        let loaded = load_or_generate(pki_dir.path(), &[]).unwrap();
        assert_eq!(
            original.cert_pem, loaded.cert_pem,
            "a failed regeneration must leave the original cert published"
        );
        assert_eq!(
            original.key_pem, loaded.key_pem,
            "a failed regeneration must leave the original key published"
        );
        assert_eq!(
            entries_before,
            dir_entries(pki_dir.path()),
            "a failed regeneration must leave nothing behind"
        );
    }

    /// Ported from `TestRepublish_FailedSwapLeavesNothingBehind`.
    #[test]
    fn republish_failed_swap_leaves_nothing_behind() {
        let pki_dir = tempfile::tempdir().unwrap();

        load_or_generate(pki_dir.path(), &[]).unwrap();

        replace_current_with_directory(pki_dir.path());
        let entries_before = dir_entries(pki_dir.path());

        let other = new_ca(&[]).unwrap();

        let err = republish(pki_dir.path(), &other.cert_pem, &other.key_pem).unwrap_err();
        assert!(err.to_string().contains("publishing regenerated CA"));

        assert_eq!(
            entries_before,
            dir_entries(pki_dir.path()),
            "the new generation and its link must be removed"
        );
    }

    /// Ported from `TestCA_CoversHostname`.
    #[test]
    fn ca_covers_hostname_checks_name_constraints() {
        let pki_dir = tempfile::tempdir().unwrap();
        let permitted: Vec<String> = vec![".local".into(), ".test".into(), "gitlab.dev".into()];

        let ca = load_or_generate(pki_dir.path(), &permitted).unwrap();

        let cases = [
            ("", true),
            ("app.local", true),
            ("gitlab.test", true),
            ("gitlab.dev", true),
            ("sub.gitlab.dev", true),
            ("example.com", false),
            ("evil.org", false),
        ];

        for (hostname, want) in cases {
            assert_eq!(ca.covers_hostname(hostname), want, "hostname: {hostname}");
        }
    }
}