<commit_before>package trustmanager

import (
	"crypto/sha256"
	"crypto/x509"
	"errors"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
	"path"
)

// X509FileStore implements X509Store that persists on disk
type X509FileStore struct {
	baseDir        string
	validate       Validator
	fileMap        map[ID]string
	fingerprintMap map[ID]*x509.Certificate
	nameMap        map[string][]ID
}

// NewX509FileStore returns a new X509FileStore.
func NewX509FileStore(directory string) *X509FileStore {
	validate := ValidatorFunc(func(cert *x509.Certificate) bool { return true })

	s := &X509FileStore{

		baseDir:        directory,
		validate:       validate,
		fileMap:        make(map[ID]string),
		fingerprintMap: make(map[ID]*x509.Certificate),
		nameMap:        make(map[string][]ID),
	}

	loadCertsFromDir(s, directory)

	return s
}

// NewX509FilteredFileStore returns a new X509FileStore that validates certificates
// that are added.
func NewX509FilteredFileStore(directory string, validate func(*x509.Certificate) bool) *X509FileStore {
	s := &X509FileStore{

		baseDir:        directory,
		validate:       ValidatorFunc(validate),
		fileMap:        make(map[ID]string),
		fingerprintMap: make(map[ID]*x509.Certificate),
		nameMap:        make(map[string][]ID),
	}

	loadCertsFromDir(s, directory)

	return s
}

// AddCert creates a filename for a given cert and adds a certificate with that name
func (s X509FileStore) AddCert(cert *x509.Certificate) error {
	if cert == nil {
		return errors.New("adding nil Certificate to X509Store")
	}

	fingerprint := fingerprintCert(cert)
	filename := path.Join(s.baseDir, string(fingerprint)+certExtension)
	if err := s.addNamedCert(cert, filename); err != nil {
		return err
	}

	return nil
}

// addNamedCert allows adding a certificate while controling the filename it gets
// stored under. If the file does not exist on disk, saves it.
func (s X509FileStore) addNamedCert(cert *x509.Certificate, filename string) error {
	if cert == nil {
		return errors.New("adding nil Certificate to X509Store")
	}

	fingerprint := fingerprintCert(cert)

	// Validate if we already loaded this certificate before
	if _, ok := s.fingerprintMap[fingerprint]; ok {
		return errors.New("certificate already in the store")
	}

	// Check if this certificate meets our validation criteria
	if !s.validate.Validate(cert) {
		return errors.New("certificate validation failed")
	}

	// Overwrite every certificate SubjectKeyID with a SHA256 version.
	subjectKeyID := sha256.Sum256(cert.Raw)
	cert.SubjectKeyId = subjectKeyID[:]

	// Add the certificate to our in-memory storage
	s.fingerprintMap[fingerprint] = cert
	s.fileMap[fingerprint] = filename

	name := string(cert.RawSubject)
	s.nameMap[name] = append(s.nameMap[name], fingerprint)

	// Save the file to disk if not already there.
	if _, err := os.Stat(filename); os.IsNotExist(err) {
		return saveCertificate(cert, filename)
	}

	return nil
}

// RemoveCert removes a certificate from a X509FileStore.
func (s X509FileStore) RemoveCert(cert *x509.Certificate) error {
	if cert == nil {
		return errors.New("removing nil Certificate from X509Store")
	}

	fingerprint := fingerprintCert(cert)<commit_msg>Remove overwrote of SKID on saved certificates<commit_after>package trustmanager

import (
	"crypto/x509"
	"errors"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
	"path"
)

// X509FileStore implements X509Store that persists on disk
type X509FileStore struct {
	baseDir        string
	validate       Validator
	fileMap        map[ID]string
	fingerprintMap map[ID]*x509.Certificate
	nameMap        map[string][]ID
}

// NewX509FileStore returns a new X509FileStore.
func NewX509FileStore(directory string) *X509FileStore {
	validate := ValidatorFunc(func(cert *x509.Certificate) bool { return true })

	s := &X509FileStore{

		baseDir:        directory,
		validate:       validate,
		fileMap:        make(map[ID]string),
		fingerprintMap: make(map[ID]*x509.Certificate),
		nameMap:        make(map[string][]ID),
	}

	loadCertsFromDir(s, directory)

	return s
}

// NewX509FilteredFileStore returns a new X509FileStore that validates certificates
// that are added.
func NewX509FilteredFileStore(directory string, validate func(*x509.Certificate) bool) *X509FileStore {
	s := &X509FileStore{

		baseDir:        directory,
		validate:       ValidatorFunc(validate),
		fileMap:        make(map[ID]string),
		fingerprintMap: make(map[ID]*x509.Certificate),
		nameMap:        make(map[string][]ID),
	}

	loadCertsFromDir(s, directory)

	return s
}

// AddCert creates a filename for a given cert and adds a certificate with that name
func (s X509FileStore) AddCert(cert *x509.Certificate) error {
	if cert == nil {
		return errors.New("adding nil Certificate to X509Store")
	}

	fingerprint := fingerprintCert(cert)
	filename := path.Join(s.baseDir, string(fingerprint)+certExtension)
	if err := s.addNamedCert(cert, filename); err != nil {
		return err
	}

	return nil
}

// addNamedCert allows adding a certificate while controling the filename it gets
// stored under. If the file does not exist on disk, saves it.
func (s X509FileStore) addNamedCert(cert *x509.Certificate, filename string) error {
	if cert == nil {
		return errors.New("adding nil Certificate to X509Store")
	}

	fingerprint := fingerprintCert(cert)

	// Validate if we already loaded this certificate before
	if _, ok := s.fingerprintMap[fingerprint]; ok {
		return errors.New("certificate already in the store")
	}

	// Check if this certificate meets our validation criteria
	if !s.validate.Validate(cert) {
		return errors.New("certificate validation failed")
	}

	// Add the certificate to our in-memory storage
	s.fingerprintMap[fingerprint] = cert
	s.fileMap[fingerprint] = filename

	name := string(cert.RawSubject)
	s.nameMap[name] = append(s.nameMap[name], fingerprint)

	// Save the file to disk if not already there.
	if _, err := os.Stat(filename); os.IsNotExist(err) {
		return saveCertificate(cert, filename)
	}

	return nil
}

// RemoveCert removes a certificate from a X509FileStore.
func (s X509FileStore) RemoveCert(cert *x509.Certificate) error {
	if cert == nil {
		return errors.New("removing nil Certificate from X509Store")
	}

	fingerprint := fingerprintCert(cert)
{'fraction_non_alphanumeric': 0.10219797850152415, 'fraction_numerical': 0.02984116797689716, 'mean_word_length': 4.19067443796836, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5191198', 'n_tokens_mistral': 2169, 'n_tokens_neox': 1928, 'n_words': 562}