fix: remove Hash + PartialEq on ConfirmedOrder and dependent structs #267
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What:
Remove impls of
Hash
,PartialEq
,Eq
onCertifiedOrder
and dependentsWhy
It's a quick and easy way to check that certificates can't be used in a way that assumes the details of their signature set are meaningful. Certificate equivocation (change in signature set without loss of overall validity) is allowed.
We might indeed need to compare
CertifiedOrder
s in the future, in which case a comment at the point where astatic_assertions
will blow up offers guidance on what to do.Why not do more?
The reason this doesn't already implement the signature-agnostic way of comparing Certificates is to avoid misuse of that
Eq
implementation in a context where we do not have distinctValidCertifiedOrder
andUncheckedCertifiedOrder
types.Imagine you have a list of
CertifiedOrder
s L and anEq
function that's signature agnostic. You also have a deduplicate function on vecs that usesEq
:dedup
? Probably yes,dedup
? Probably not.But there's a lot of duplication of utility functions!
Yes. Those are used in a test context where doing the dangerous thing (testing certificates byte for byte) makes sense, either because one of:
This could be implemented with less code duplication using a test feature (to make sure the utility functions can be exported across crates but only in a test context), but would lead to fighting Rust's feature unification. The ad-hoc utility functions are actually less trouble.
Contributes to #266