Skip to content

Major Rewrite - "Builder" Pattern is Here!

Compare
Choose a tag to compare
@obelisk obelisk released this 03 Apr 17:46
· 31 commits to master since this release

I put a lot of work into trying to make the crate easier for other people to use. The biggest change is that of Certificate::new which no longer exists. Before you would create a certificate like this:

    let user_cert = Certificate::new(
        ssh_pubkey.clone(),
        CertType::User,
        0xFEFEFEFEFEFEFEFE,
        String::from("key_id"),
        vec![String::from("obelisk")],
        0,
        0xFFFFFFFFFFFFFFFF,
        CriticalOptions::None,
        Extensions::Standard,
        ca_pubkey.clone(),
        test_ecdsa256_signer,
    );

Now it's this:

    let user_cert = Certificate::builder(&ssh_pubkey, CertType::User, &ca_pubkey).unwrap()
        .serial(0xFEFEFEFEFEFEFEFE)
        .key_id("key_id")
        .principal("obelisk")
        .valid_after(0)
        .valid_before(0xFFFFFFFFFFFFFFFF)
        .set_critical_options(CriticalOptions::None)
        .set_extensions(Extensions::Standard)
        .sign(test_ecdsa256_signer);

These generate equivalent certificates but the new version has significantly more flexibility in terms of adding new principals, critical options, or extensions. See tests for more examples.

The second big change is in the Yubikey module where the actions have been wrapped inside a structure. This makes it possible to guarantee that in a system with more than one yubikey, you continue using the same key (I still need to write more APIs to make this truly possible though).

Finally, error handling has been improved. Errors are now crate level and expose the type directly instead of through ErrorKind which has now been removed.