Better debugging for signing key fetching

This commit is contained in:
Lambda 2024-09-13 13:31:04 +00:00
parent 9e6a5e6604
commit 5691cf0868

View file

@ -1909,17 +1909,24 @@ impl Service {
query_via_trusted_servers: bool, query_via_trusted_servers: bool,
) -> Result<SigningKeys> { ) -> Result<SigningKeys> {
let contains_all_ids = |keys: &SigningKeys| { let contains_all_ids = |keys: &SigningKeys| {
signature_ids.iter().all(|id| { for id in &signature_ids {
keys.verify_keys let in_verify_keys = keys
.verify_keys
.keys() .keys()
.map(ToString::to_string) .map(ToString::to_string)
.any(|key_id| id == &key_id) .any(|key_id| id == &key_id);
|| keys let in_old_verify_keys = keys
.old_verify_keys .old_verify_keys
.keys() .keys()
.map(ToString::to_string) .map(ToString::to_string)
.any(|key_id| id == &key_id) .any(|key_id| id == &key_id);
})
if !in_verify_keys && !in_old_verify_keys {
trace!(id, "signature key not yet in known set");
return false;
}
}
true
}; };
let permit = services() let permit = services()
@ -1982,6 +1989,9 @@ impl Service {
debug!( debug!(
server = %origin, server = %origin,
key_ids = ?result.verify_keys.keys().collect::<Vec<_>>(),
old_key_ids =
?result.old_verify_keys.keys().collect::<Vec<_>>(),
ts_threshold = %ts_threshold.get(), ts_threshold = %ts_threshold.get(),
ts_valid_until = %result.valid_until_ts.get(), ts_valid_until = %result.valid_until_ts.get(),
"Loaded signing keys for server", "Loaded signing keys for server",
@ -2000,6 +2010,7 @@ impl Service {
} }
expires_soon_or_has_expired = true; expires_soon_or_has_expired = true;
trace!("Found all keys, but they will expire too soon");
} }
} }