Function write_local_bundle

crates/openshell-server/src/certgen.rs:626–687

(dir: &Path, bundle: &PkiBundle, paths: &LocalPaths)

}

fn write_local_bundle(dir: &Path, bundle: &PkiBundle, paths: &LocalPaths) -> Result<()> {
    // Stage to a sibling tmp dir so individual renames into the final layout
    // are atomic on the same filesystem.
    let temp = sibling_temp_dir(dir);
    if temp.exists() {
        std::fs::remove_dir_all(&temp)
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to remove stale {}", temp.display()))?;
    }

    let temp_server = temp.join("server");
    let temp_client = temp.join("client");
    let temp_jwt = temp.join("jwt");
    create_dir_restricted(&temp)?;
    create_dir_restricted(&temp_server)?;
    create_dir_restricted(&temp_client)?;
    create_dir_restricted(&temp_jwt)?;

    write_pem(&temp.join("ca.crt"), &bundle.ca_cert_pem, false)?;
    write_pem(&temp.join("ca.key"), &bundle.ca_key_pem, true)?;
    write_pem(&temp_server.join("tls.crt"), &bundle.server_cert_pem, false)?;
    write_pem(&temp_server.join("tls.key"), &bundle.server_key_pem, true)?;
    write_pem(&temp_client.join("tls.crt"), &bundle.client_cert_pem, false)?;
    write_pem(&temp_client.join("tls.key"), &bundle.client_key_pem, true)?;
    write_pem(
        &temp_jwt.join("signing.pem"),
        &bundle.jwt_signing_key_pem,
        true,
    )?;
    write_pem(
        &temp_jwt.join("public.pem"),
        &bundle.jwt_public_key_pem,
        false,
    )?;
    write_pem(&temp_jwt.join("kid"), &bundle.jwt_key_id, false)?;

    // Final destination (might not exist yet on first run).
    create_dir_restricted(dir)?;
    create_dir_restricted(&paths.server_dir)?;
    create_dir_restricted(&paths.client_dir)?;
    create_dir_restricted(&paths.jwt_dir)?;

    let renames: [(PathBuf, &Path); 9] = [
        (temp.join("ca.crt"), paths.ca_crt.as_path()),
        (temp.join("ca.key"), paths.ca_key.as_path()),
        (temp_server.join("tls.crt"), paths.server_crt.as_path()),
        (temp_server.join("tls.key"), paths.server_key.as_path()),
        (temp_client.join("tls.crt"), paths.client_crt.as_path()),
        (temp_client.join("tls.key"), paths.client_key.as_path()),
        (temp_jwt.join("signing.pem"), paths.jwt_signing.as_path()),
        (temp_jwt.join("public.pem"), paths.jwt_public.as_path()),
        (temp_jwt.join("kid"), paths.jwt_kid.as_path()),
    ];
    for (from, to) in &renames {
        std::fs::rename(from, to)
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to move {} -> {}", from.display(), to.display()))?;
    }