Support fetching intermediates

upki-cli/tests/data/verify_non_existent_dir/config.toml

@@ -2,3 +2,7 @@ cache-dir = "not-exist/"
 
 [revocation]
 fetch-url = ""
+
+[intermediates]
+enabled = false
+fetch-url = ""

upki-cli/tests/integration.rs

@@ -49,7 +49,7 @@ fn config_unknown_fields() {
           |
         1 | cache_dir = "tests/data/config_unknown_fields/"
           | ^^^^^^^^^
-        unknown field `cache_dir`, expected `cache-dir` or `revocation`
+        unknown field `cache_dir`, expected one of `cache-dir`, `revocation`, `intermediates`
 
 
     Location:
@@ -92,6 +92,10 @@ fn show_config_fixpoint() {
     [revocation]
     fetch-url = ""
 
+    [intermediates]
+    enabled = false
+    fetch-url = ""
+
     ----- stderr -----
     "#);
 }

upki-mirror/src/bin/intermediates.rs

@@ -10,7 +10,7 @@ use eyre::{Context, Report, anyhow};
 use rustls_pki_types::CertificateDer;
 use rustls_pki_types::pem::PemObject;
 use serde::Deserialize;
-use upki::revocation::{Manifest, ManifestFile};
+use upki::data::{Manifest, ManifestFile};
 
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> Result<(), Report> {

upki-mirror/src/bin/mozilla-crlite.rs

@@ -7,7 +7,7 @@ use std::time::SystemTime;
 use aws_lc_rs::digest::{SHA256, digest};
 use clap::{Parser, ValueEnum};
 use eyre::{Context, Report, anyhow};
-use upki::revocation::{Manifest, ManifestFile};
+use upki::data::{Manifest, ManifestFile};
 
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> Result<(), Report> {

upki/src/data.rs

@@ -0,0 +1,76 @@
+#[cfg(feature = "__fetch")]
+use std::{fs::File, io::BufReader, path::PathBuf};
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use tracing::info;
+
+use crate::revocation::Error;
+
+/// The structure contained in a manifest.json
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Manifest {
+    /// When this file was generated.
+    ///
+    /// UNIX timestamp in seconds.
+    pub generated_at: u64,
+
+    /// Some human-readable text.
+    pub comment: String,
+
+    /// List of required files.
+    #[serde(alias = "filters")]
+    pub files: Vec<ManifestFile>,
+}
+
+impl Manifest {
+    #[cfg(feature = "__fetch")]
+    pub(crate) fn from_file(file_name: PathBuf) -> Result<Self, Error> {
+        let file = match File::open(&file_name) {
+            Ok(f) => f,
+            Err(error) => {
+                return Err(Error::FileRead {
+                    error,
+                    path: Some(file_name),
+                });
+            }
+        };
+
+        serde_json::from_reader(BufReader::new(file)).map_err(|error| Error::FileDecode {
+            error: Box::new(error),
+            path: Some(file_name),
+        })
+    }
+
+    /// Logs metadata fields in this manifest.
+    pub fn introduce(&self) -> Result<(), Error> {
+        let dt = match DateTime::<Utc>::from_timestamp(self.generated_at as i64, 0) {
+            Some(dt) => dt.to_rfc3339(),
+            None => {
+                return Err(Error::InvalidTimestamp {
+                    input: self.generated_at.to_string(),
+                    context: "manifest generated (in s)",
+                });
+            }
+        };
+
+        info!(comment = self.comment, date = dt, "parsed manifest");
+        Ok(())
+    }
+}
+
+/// Manifest data for a single manifest file.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ManifestFile {
+    /// Relative filename.
+    ///
+    /// This is also the suggested local filename.
+    pub filename: String,
+
+    /// File size, indicative.  Allows a fetcher to predict data usage.
+    pub size: usize,
+
+    /// SHA256 hash of file contents.
+    #[serde(with = "hex::serde")]
+    pub hash: Vec<u8>,
+}

upki/src/intermediates.rs

@@ -0,0 +1,20 @@
+use serde::{Deserialize, Serialize};
+
+/// Details about intermediate preloading.
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case", deny_unknown_fields, default)]
+pub struct IntermediatesConfig {
+    /// Whether to fetch things at all.
+    pub enabled: bool,
+    /// Where to fetch intermediate certificates.
+    pub fetch_url: String,
+}
+
+impl Default for IntermediatesConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            fetch_url: "https://upki.rustls.dev/intermediates/".into(),
+        }
+    }
+}

upki/src/lib.rs

@@ -14,6 +14,14 @@ pub(crate) mod sha256;
 
 /// Determining revocation status of publicly trusted certificates.
 pub mod revocation;
+
+/// Fetching intermediate certificates to assist chain building.
+pub mod intermediates;
+
+/// Common data storage formats.
+pub mod data;
+
+use crate::intermediates::IntermediatesConfig;
 use crate::revocation::RevocationConfig;
 
 /// Foreign function interface.
@@ -29,6 +37,10 @@ pub struct Config {
 
     /// Configuration for crlite-style revocation.
     pub revocation: RevocationConfig,
+
+    /// Configuration for intermediate preloading.
+    #[serde(default)]
+    pub intermediates: IntermediatesConfig,
 }
 
 impl Config {
@@ -71,6 +83,7 @@ impl Config {
                 }
             },
             revocation: RevocationConfig::default(),
+            intermediates: IntermediatesConfig::default(),
         })
     }