chore(xtask): read certificate fields through the certs crate, not the openssl CLI

Closed
  • Is something wrong?
#307 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
53/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
tooling

Research direction

Start by reading the existing cert_* functions in the certs crate and the seven OpenSSL CLI call sites across the five xtask files; the issue does not name those files. Trace the reuse gate in certs.rs and check how cargo xtask env up documents prerequisites. Done means certificate reads use the crate, the subject-organization reader is available, and any remaining shell-out is documented.

Written by the indexing model from the issue text.

Description

good first issue priority/low triage/accepted

What

xtask reads certificate fields by shelling out to the openssl CLI, in seven places across five files. The certs crate already parses certificates in Rust and exposes cert_issuer_and_expiry, cert_validity, cert_public_key_sha256 and cert_pem_from_der. It has no reader for the subject organization, which is the one xtask needs most now that the organization names the site.

Two consequences.

openssl is an undocumented prerequisite of cargo xtask env up. site_certificate_fingerprint calls it on every run of the glb, combined-site, provider-traffic, static-weighted and llmd-pool-metrics topologies, and nothing in the docs says so. A machine without it fails partway through a run rather than at a prerequisite check.

The reuse gate in certs.rs decides whether to regenerate a site identity by reading its subject organization. Regenerating mints a new private key, so that read sits on a path where being unable to answer has to be an error rather than a guess. Asking a library is a better shape for that than spawning a process.

Proposal

Add an organization reader to certs beside the existing cert_* functions, and move xtask's certificate reads onto the certs crate. Where a shell-out remains, say so in the env up prerequisites.

Context

Came out of review on #305, which made the certificate's subject organization the site name and added the reuse gate that reads it.

Dominant language
Rust
Stars
10
Forks
24
Avg merge
1d 13h
Merged PRs (30d)
136

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from praxis-proxy/grid

All issues in praxis-proxy/grid

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.