Run cargo fmt after fixing editor settings

.github/workflows/test.yml

@@ -32,6 +32,9 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-cargo-
 
+    - name: Check formatting
+      run: cargo fmt --all -- --check
+
     - name: Run cargo clippy
       run: cargo clippy --workspace --features azure -- -D warnings
 

attestation-provider-server/build.rs

@@ -37,7 +37,10 @@ fn emit_git_rerun_hints() {
     let manifest_dir =
         PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap_or_else(|_| ".".to_owned()));
 
-    for git_dir in [manifest_dir.join(".git"), manifest_dir.join("..").join(".git")] {
+    for git_dir in [
+        manifest_dir.join(".git"),
+        manifest_dir.join("..").join(".git"),
+    ] {
         if git_dir.exists() {
             println!("cargo:rerun-if-changed={}", git_dir.join("HEAD").display());
             println!(

attestation-provider-server/src/main.rs

@@ -1,6 +1,6 @@
 use attestation_provider_server::{attestation_provider_client, attestation_provider_server};
 use attested_tls_proxy::attestation::{
-    measurements::MeasurementPolicy, AttestationGenerator, AttestationVerifier,
+    AttestationGenerator, AttestationVerifier, measurements::MeasurementPolicy,
 };
 use clap::{Parser, Subcommand};
 use std::{net::SocketAddr, path::PathBuf};

attested-tls/src/attestation/azure/ak_certificate.rs

@@ -1,5 +1,5 @@
 //! Generation and verification of AK certificates from the vTPM
-use crate::attestation::azure::{nv_index, MaaError};
+use crate::attestation::azure::{MaaError, nv_index};
 use once_cell::sync::Lazy;
 use std::time::Duration;
 use tokio_rustls::rustls::pki_types::{CertificateDer, TrustAnchor, UnixTime};

attested-tls/src/attestation/azure/mod.rs

@@ -4,7 +4,7 @@ mod nv_index;
 use ak_certificate::{read_ak_certificate_from_tpm, verify_ak_cert_with_azure_roots};
 
 use az_tdx_vtpm::{hcl, imds, vtpm};
-use base64::{engine::general_purpose::URL_SAFE as BASE64_URL_SAFE, Engine as _};
+use base64::{Engine as _, engine::general_purpose::URL_SAFE as BASE64_URL_SAFE};
 use dcap_qvl::QuoteCollateralV3;
 use num_bigint::BigUint;
 use openssl::{error::ErrorStack, pkey::PKey};
@@ -310,7 +310,9 @@ pub enum MaaError {
     Hex(#[from] hex::FromHexError),
     #[error("Attestation Key from HCL runtime claims does not match that from HCL report")]
     AkFromClaimsNotEqualAkFromHcl,
-    #[error("Attestation Key from HCL runtime claims does not match that from attestation key certificate")]
+    #[error(
+        "Attestation Key from HCL runtime claims does not match that from attestation key certificate"
+    )]
     AkFromClaimsNotEqualAkFromCertificate,
     #[error("WebPKI: {0}")]
     WebPki(#[from] webpki::Error),

attested-tls/src/attestation/azure/nv_index.rs

@@ -1,8 +1,8 @@
 use tss_esapi::{
+    Context,
     handles::NvIndexTpmHandle,
     interface_types::{resource_handles::NvAuth, session_handles::AuthSession},
     tcti_ldr::{DeviceConfig, TctiNameConf},
-    Context,
 };
 
 pub fn get_session_context() -> Result<Context, tss_esapi::Error> {

attested-tls/src/attestation/dcap.rs

@@ -1,12 +1,12 @@
 //! Data Center Attestation Primitives (DCAP) evidence generation and verification
-use crate::attestation::{measurements::MultiMeasurements, AttestationError};
+use crate::attestation::{AttestationError, measurements::MultiMeasurements};
 
 use configfs_tsm::QuoteGenerationError;
 use dcap_qvl::{
+    QuoteCollateralV3,
     collateral::get_collateral_for_fmspc,
     quote::{Quote, Report},
     tcb_info::TcbInfo,
-    QuoteCollateralV3,
 };
 use thiserror::Error;
 

attested-tls/src/attestation/measurements.rs

@@ -1,10 +1,10 @@
 //! Measurements and policy for enforcing them when validating a remote attestation
-use crate::attestation::{dcap::DcapVerificationError, AttestationError, AttestationType};
+use crate::attestation::{AttestationError, AttestationType, dcap::DcapVerificationError};
 use std::{collections::HashMap, path::PathBuf};
 use std::{fmt, fmt::Formatter};
 
 use dcap_qvl::quote::Report;
-use http::{header::InvalidHeaderValue, HeaderValue};
+use http::{HeaderValue, header::InvalidHeaderValue};
 use serde::Deserialize;
 use thiserror::Error;
 

attested-tls/src/attestation/mod.rs

@@ -206,7 +206,9 @@ impl AttestationGenerator {
                 }
                 #[cfg(not(feature = "azure"))]
                 {
-                    tracing::error!("Attempted to generate an azure attestation but the `azure` feature not enabled");
+                    tracing::error!(
+                        "Attempted to generate an azure attestation but the `azure` feature not enabled"
+                    );
                     Err(AttestationError::AttestationTypeNotSupported)
                 }
             }

attested-tls/src/attested_rpc.rs

@@ -1,7 +1,7 @@
 //! Provides an attested JSON RPC client based on [alloy_rpc_client::RpcClient]
 use alloy_rpc_client::RpcClient;
 use alloy_transport_http::{Http, HyperClient};
-use hyper::{client::conn, Request, Response};
+use hyper::{Request, Response, client::conn};
 use hyper_util::rt::TokioIo;
 use std::{
     future::Future,
@@ -13,8 +13,8 @@ use thiserror::Error;
 use tower_service::Service;
 
 use crate::{
-    attestation::{measurements::MultiMeasurements, AttestationType},
     AttestedTlsClient, AttestedTlsError,
+    attestation::{AttestationType, measurements::MultiMeasurements},
 };
 
 /// Supported HTTP versions for RPC connection bootstrapping
@@ -201,15 +201,15 @@ mod tests {
     use hyper::service::service_fn;
     use hyper::{Request, Response, StatusCode};
     use hyper_util::rt::TokioIo;
-    use serde_json::{json, Value};
+    use serde_json::{Value, json};
     use tokio::net::TcpListener;
 
     use super::AttestedRpcClient;
 
     use crate::{
+        AttestedTlsClient, AttestedTlsServer,
         attestation::{AttestationGenerator, AttestationType, AttestationVerifier},
         test_helpers::{generate_certificate_chain, generate_tls_config},
-        AttestedTlsClient, AttestedTlsServer,
     };
 
     async fn simple_json_rpc_service(

attested-tls/src/lib.rs

@@ -11,8 +11,8 @@ pub mod attested_rpc;
 pub mod test_helpers;
 
 use crate::attestation::{
-    measurements::MultiMeasurements, AttestationError, AttestationExchangeMessage,
-    AttestationGenerator, AttestationType, AttestationVerifier,
+    AttestationError, AttestationExchangeMessage, AttestationGenerator, AttestationType,
+    AttestationVerifier, measurements::MultiMeasurements,
 };
 use parity_scale_codec::{Decode, Encode};
 use sha2::{Digest, Sha256};
@@ -26,11 +26,11 @@ use x509_parser::parse_x509_certificate;
 use std::num::TryFromIntError;
 use std::sync::Arc;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
-use tokio_rustls::rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
 use tokio_rustls::rustls::RootCertStore;
+use tokio_rustls::rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
 use tokio_rustls::{
-    rustls::{ClientConfig, ServerConfig},
     TlsAcceptor, TlsConnector,
+    rustls::{ClientConfig, ServerConfig},
 };
 
 /// This makes it possible to add breaking protocol changes and provide backwards compatibility.

attested-tls/src/test_helpers.rs

@@ -1,14 +1,14 @@
 //! Helper functions used in tests
 use std::{collections::HashMap, net::IpAddr, sync::Arc};
 use tokio_rustls::rustls::{
-    pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer},
-    server::{danger::ClientCertVerifier, WebPkiClientVerifier},
     ClientConfig, RootCertStore, ServerConfig,
+    pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer},
+    server::{WebPkiClientVerifier, danger::ClientCertVerifier},
 };
 
 use crate::{
-    attestation::measurements::{DcapMeasurementRegister, MultiMeasurements},
     SUPPORTED_ALPN_PROTOCOL_VERSIONS,
+    attestation::measurements::{DcapMeasurementRegister, MultiMeasurements},
 };
 
 /// Helper to generate a self-signed certificate for testing
@@ -67,10 +67,7 @@ pub fn generate_tls_config_with_client_auth(
     alice_key: PrivateKeyDer<'static>,
     bob_certificate_chain: Vec<CertificateDer<'static>>,
     bob_key: PrivateKeyDer<'static>,
-) -> (
-    (ServerConfig, ClientConfig),
-    (ServerConfig, ClientConfig),
-) {
+) -> ((ServerConfig, ClientConfig), (ServerConfig, ClientConfig)) {
     let supported_protocols: Vec<_> = SUPPORTED_ALPN_PROTOCOL_VERSIONS
         .into_iter()
         .map(|p| p.to_vec())

attested-tls/src/websockets.rs

@@ -2,11 +2,11 @@
 use std::{net::SocketAddr, sync::Arc};
 use thiserror::Error;
 use tokio::net::{TcpListener, ToSocketAddrs};
-use tokio_tungstenite::{tungstenite::protocol::WebSocketConfig, WebSocketStream};
+use tokio_tungstenite::{WebSocketStream, tungstenite::protocol::WebSocketConfig};
 
 use crate::{
-    attestation::{measurements::MultiMeasurements, AttestationType},
     AttestedTlsClient, AttestedTlsError, AttestedTlsServer,
+    attestation::{AttestationType, measurements::MultiMeasurements},
 };
 
 /// Websocket message type re-exported for convenience
@@ -118,7 +118,7 @@ pub enum AttestedWsError {
 
 #[cfg(test)]
 mod tests {
-    use futures_util::{sink::SinkExt, StreamExt};
+    use futures_util::{StreamExt, sink::SinkExt};
     use tokio_tungstenite::tungstenite::protocol::Message;
 
     use super::*;

build.rs

@@ -37,7 +37,10 @@ fn emit_git_rerun_hints() {
     let manifest_dir =
         PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap_or_else(|_| ".".to_owned()));
 
-    for git_dir in [manifest_dir.join(".git"), manifest_dir.join("..").join(".git")] {
+    for git_dir in [
+        manifest_dir.join(".git"),
+        manifest_dir.join("..").join(".git"),
+    ] {
         if git_dir.exists() {
             println!("cargo:rerun-if-changed={}", git_dir.join("HEAD").display());
             println!(

src/attested_get.rs

@@ -69,10 +69,10 @@ async fn attested_get_with_client(
 mod tests {
     use super::*;
     use crate::{
+        ProxyServer,
         attestation::AttestationType,
         file_server::static_file_server,
         test_helpers::{generate_certificate_chain, generate_tls_config},
-        ProxyServer,
     };
     use tempfile::tempdir;
 

src/file_server.rs

@@ -52,7 +52,7 @@ pub(crate) async fn static_file_server(path: PathBuf) -> Result<SocketAddr, Prox
 
 #[cfg(test)]
 mod tests {
-    use crate::{attestation::AttestationType, ProxyClient};
+    use crate::{ProxyClient, attestation::AttestationType};
 
     use super::*;
     use crate::test_helpers::{generate_certificate_chain, generate_tls_config};

src/health_check.rs

@@ -1,5 +1,5 @@
 //! Provides health / version details for an attested proxy server or client
-use axum::{routing::get, Json, Router};
+use axum::{Json, Router, routing::get};
 use serde::{Deserialize, Serialize};
 use std::net::SocketAddr;
 use tokio::net::TcpListener;

src/lib.rs

@@ -16,24 +16,24 @@ mod test_helpers;
 
 use bytes::Bytes;
 use http::{HeaderMap, HeaderName, HeaderValue};
-use http_body_util::{combinators::BoxBody, BodyExt};
-use hyper::{service::service_fn, Response};
+use http_body_util::{BodyExt, combinators::BoxBody};
+use hyper::{Response, service::service_fn};
 use hyper_util::rt::TokioIo;
 use std::{net::SocketAddr, num::TryFromIntError, sync::Arc, time::Duration};
 use thiserror::Error;
 use tokio::io;
 use tokio::net::{TcpListener, TcpStream, ToSocketAddrs};
 use tokio::sync::{mpsc, oneshot};
 use tokio_rustls::rustls::server::VerifierBuilderError;
-use tokio_rustls::rustls::{pki_types::CertificateDer, ClientConfig, ServerConfig};
+use tokio_rustls::rustls::{ClientConfig, ServerConfig, pki_types::CertificateDer};
 use tracing::{debug, error, warn};
 
-use crate::http_version::{HttpConnection, HttpSender, HttpVersion, ALPN_H2, ALPN_HTTP11};
+use crate::http_version::{ALPN_H2, ALPN_HTTP11, HttpConnection, HttpSender, HttpVersion};
 use attested_tls::{
+    AttestedTlsClient, AttestedTlsError, AttestedTlsServer, TlsCertAndKey,
     attestation::{
-        measurements::MultiMeasurements, AttestationError, AttestationType, AttestationVerifier,
+        AttestationError, AttestationType, AttestationVerifier, measurements::MultiMeasurements,
     },
-    AttestedTlsClient, AttestedTlsError, AttestedTlsServer, TlsCertAndKey,
 };
 
 /// The header name for giving attestation type

src/main.rs

@@ -10,16 +10,15 @@ use tokio_rustls::rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use tracing::level_filters::LevelFilter;
 
 use attested_tls_proxy::{
+    AttestationGenerator, ProxyClient, ProxyServer,
     attested_get::attested_get,
     attested_tls::{
-        attestation::{measurements::MeasurementPolicy, AttestationType, AttestationVerifier},
         TlsCertAndKey,
+        attestation::{AttestationType, AttestationVerifier, measurements::MeasurementPolicy},
     },
     file_server::attested_file_server,
-    get_tls_cert,
-    health_check,
+    get_tls_cert, health_check,
     normalize_pem::normalize_private_key_pem_to_pkcs8,
-    AttestationGenerator, ProxyClient, ProxyServer,
 };
 
 const GIT_REV: &str = match option_env!("GIT_REV") {
@@ -351,9 +350,13 @@ async fn main() -> anyhow::Result<()> {
                 ),
                 None => None,
             };
-            let cert_chain =
-                get_tls_cert(server, attestation_verifier, remote_tls_cert, allow_self_signed)
-                    .await?;
+            let cert_chain = get_tls_cert(
+                server,
+                attestation_verifier,
+                remote_tls_cert,
+                allow_self_signed,
+            )
+            .await?;
             println!("{}", certs_to_pem_string(&cert_chain)?);
         }
         CliCommand::AttestedFileServer {

src/normalize_pem.rs

@@ -1,4 +1,4 @@
-use anyhow::{anyhow, bail, Result};
+use anyhow::{Result, anyhow, bail};
 use pkcs8::EncodePrivateKey;
 use std::io::Cursor;
 use tokio_rustls::rustls::pki_types::{PrivateKeyDer, PrivatePkcs8KeyDer};

src/self_signed.rs

@@ -200,10 +200,10 @@ impl rustls::server::danger::ClientCertVerifier for SkipClientVerification {
 mod tests {
     use super::*;
     use crate::{
+        AttestationGenerator,
         attestation::{AttestationType, AttestationVerifier},
         attested_tls::{AttestedTlsClient, AttestedTlsServer},
         test_helpers::{generate_certificate_chain, generate_tls_config},
-        AttestationGenerator,
     };
     use tokio::net::TcpListener;
     use tokio_rustls::rustls::pki_types::ServerName;

src/test_helpers.rs

@@ -7,17 +7,17 @@ use std::{
 };
 use tokio::net::TcpListener;
 use tokio_rustls::rustls::{
-    pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer},
-    server::{danger::ClientCertVerifier, WebPkiClientVerifier},
     ClientConfig, RootCertStore, ServerConfig,
+    pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer},
+    server::{WebPkiClientVerifier, danger::ClientCertVerifier},
 };
-use tracing_subscriber::{fmt, EnvFilter};
+use tracing_subscriber::{EnvFilter, fmt};
 
 static INIT: Once = Once::new();
 
 use crate::{
-    attestation::measurements::{DcapMeasurementRegister, MultiMeasurements},
     MEASUREMENT_HEADER,
+    attestation::measurements::{DcapMeasurementRegister, MultiMeasurements},
 };
 
 /// Helper to generate a self-signed certificate for testing