Refactor signing code out of zone_signer.rs

src/signer/incremental.rs

@@ -22,7 +22,6 @@ use domain::dnssec::sign::denial::nsec::{GenerateNsecConfig, generate_nsecs};
 use domain::dnssec::sign::denial::nsec3::{
     GenerateNsec3Config, Nsec3ParamTtlMode, generate_nsec3s,
 };
-use domain::dnssec::sign::keys::SigningKey;
 use domain::dnssec::sign::keys::keyset::{KeyType, UnixTime};
 use domain::dnssec::sign::records::{DefaultSorter, RecordsIter, Rrset};
 use domain::dnssec::sign::signatures::rrsigs::sign_rrset;
@@ -44,15 +43,14 @@ use crate::center::Center;
 use crate::manager::record_zone_event;
 use crate::policy::{PolicyVersion, SignerDenialPolicy, SignerSerialPolicy};
 use crate::signer::SigningTrigger;
+use crate::signer::keys::ZoneSigningKeys;
 use crate::units::key_manager::mk_dnst_keyset_state_file_path;
 use crate::units::zone_signer::{
-    KeyPair, KeySetState, MinTimestamp, PassThroughMode, SignerError, SigningStatusPerZone,
-    ZoneSigner, faketime_or_now, load_keys,
+    KeySetState, MinTimestamp, PassThroughMode, SignerError, SigningStatusPerZone, faketime_or_now,
 };
 use crate::zone::{HistoricalEvent, Zone};
 
 pub fn sign_incrementally(
-    zone_signer: &ZoneSigner,
     patch: SignedZonePatcher,
     zone: &Arc<Zone>,
     center: &Arc<Center>,
@@ -133,14 +131,7 @@ pub fn sign_incrementally(
         return Err(SignerError::NothingToDo);
     }
 
-    let mut iss = IncrementalSigningState::new(
-        origin.clone(),
-        &policy,
-        zone_signer,
-        center,
-        &ws.keyset_state,
-        status,
-    )?;
+    let mut iss = IncrementalSigningState::new(zone, &policy, center, &ws.keyset_state, status)?;
 
     let start = Instant::now();
     iss.load_signed_zone(&ws.patch.curr())?;
@@ -1467,7 +1458,7 @@ struct IncrementalSigningState {
     modified_nsecs: HashSet<Name<Bytes>>,
 
     /// Signing keys.
-    keys: Vec<SigningKey<Bytes, KeyPair>>,
+    keys: ZoneSigningKeys,
 
     /// Inception time to use for signatures.
     inception: Timestamp,
@@ -1481,14 +1472,14 @@ struct IncrementalSigningState {
 
 impl IncrementalSigningState {
     pub fn new(
-        origin: Name<Bytes>,
+        zone: &Zone,
         policy: &PolicyVersion,
-        zone_signer: &ZoneSigner,
         center: &Arc<Center>,
         keyset_state: &KeySetState,
         status: Arc<RwLock<SigningStatusPerZone>>,
     ) -> Result<Self, SignerError> {
-        let keys = load_keys(zone_signer, center, origin.clone(), keyset_state, status)?;
+        status.write().unwrap().current_action = "Loading signing keys".into();
+        let keys = ZoneSigningKeys::load(center, zone, keyset_state)?;
 
         let now = faketime_or_now();
         let now_u32 = Into::<Duration>::into(now.clone()).as_secs() as u32;
@@ -1508,7 +1499,7 @@ impl IncrementalSigningState {
             }
         }
         Ok(Self {
-            origin,
+            origin: zone.name.clone(),
             old_apex: HashMap::new(),
             old_apex_saved: HashMap::new(),
             new_apex: HashMap::new(),
@@ -2348,7 +2339,7 @@ impl LocalState {
 fn sign_records(
     origin: &Name<Bytes>,
     records: &[Zrd],
-    keys: &[SigningKey<Bytes, KeyPair>],
+    keys: &ZoneSigningKeys,
     inception: Timestamp,
     expiration: Timestamp,
     new_sigs: &mut Vec<(Vec<Zrd>, Rtype)>,
@@ -2365,7 +2356,7 @@ fn sign_records(
     let rrset = Rrset::new_from_owned(records)
         .map_err(|e| SignerError::SigningError(format!("Rrset::new failed: {e}")))?;
     let mut rrsig_records = vec![];
-    for key in keys {
+    for key in &keys.list {
         let rrsig = sign_rrset(key, &rrset, inception, expiration)
             .map_err(|e| SignerError::SigningError(format!("signing failed: {e}")))?;
         let record = Record::new(