| 728 | } |
| 729 | |
| 730 | fn write_local_jwt_bundle(bundle: &PkiBundle, paths: &LocalPaths) -> Result<()> { |
| 731 | let temp = sibling_temp_dir(&paths.jwt_dir); |
| 732 | if temp.exists() { |
| 733 | std::fs::remove_dir_all(&temp) |
| 734 | .into_diagnostic() |
| 735 | .wrap_err_with(|| format!("failed to remove stale {}", temp.display()))?; |
| 736 | } |
| 737 | |
| 738 | create_dir_restricted(&temp)?; |
| 739 | write_pem(&temp.join("signing.pem"), &bundle.jwt_signing_key_pem, true)?; |
| 740 | write_pem(&temp.join("public.pem"), &bundle.jwt_public_key_pem, false)?; |
| 741 | write_pem(&temp.join("kid"), &bundle.jwt_key_id, false)?; |
| 742 | |
| 743 | create_dir_restricted(&paths.jwt_dir)?; |
| 744 | let renames: [(PathBuf, &Path); 3] = [ |
| 745 | (temp.join("signing.pem"), paths.jwt_signing.as_path()), |
| 746 | (temp.join("public.pem"), paths.jwt_public.as_path()), |
| 747 | (temp.join("kid"), paths.jwt_kid.as_path()), |
| 748 | ]; |
| 749 | for (from, to) in &renames { |
| 750 | std::fs::rename(from, to) |
| 751 | .into_diagnostic() |
| 752 | .wrap_err_with(|| format!("failed to move {} -> {}", from.display(), to.display()))?; |
| 753 | } |
| 754 | |
| 755 | let _ = std::fs::remove_dir_all(&temp); |
| 756 | Ok(()) |
| 757 | } |
| 758 | |
| 759 | fn write_pem(path: &Path, contents: &str, owner_only: bool) -> Result<()> { |
| 760 | std::fs::write(path, contents) |