From 603a2b1762386c167c2a523b23b87bb57bbf339b Mon Sep 17 00:00:00 2001
From: Marc Hartmayer <marc@linux.ibm.com>
Date: Wed, 8 Jul 2026 16:38:08 +0200
Subject: [PATCH] pv: Increase flexibility of verify_chain()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Increase the flexibility of verify_chain and reduce the need of using
clone.

Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 rust/pv/src/verify.rs        | 10 ++--------
 rust/pv/src/verify/helper.rs | 14 +++++++-------
 rust/pv/src/verify/test.rs   |  8 ++++----
 3 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/rust/pv/src/verify.rs b/rust/pv/src/verify.rs
index 68d4aff1..2199c0ea 100644
--- a/rust/pv/src/verify.rs
+++ b/rust/pv/src/verify.rs
@@ -2,7 +2,6 @@
 //
 // Copyright IBM Corp. 2023
 
-use core::slice;
 use std::path::Path;
 
 use helper::{download_first_crl_from_x509, StoreSetupMode};
@@ -205,7 +204,7 @@ impl CertVerifier {
         helper::verify_chain(
             &store_builder.build(),
             &chain,
-            slice::from_ref(&ibm_z_sign_key),
+            &[&ibm_z_sign_key],
             &root_ca_verification,
         )?;
 
@@ -225,12 +224,7 @@ impl CertVerifier {
         }
 
         let store = store_builder.build();
-        helper::verify_chain(
-            &store,
-            &chain,
-            slice::from_ref(&ibm_z_sign_key),
-            &root_ca_verification,
-        )?;
+        helper::verify_chain(&store, &chain, &[&ibm_z_sign_key], &root_ca_verification)?;
 
         Ok(Self {
             store,
diff --git a/rust/pv/src/verify/helper.rs b/rust/pv/src/verify/helper.rs
index 34fce64d..4da2dde7 100644
--- a/rust/pv/src/verify/helper.rs
+++ b/rust/pv/src/verify/helper.rs
@@ -13,7 +13,7 @@ use openssl::asn1::{Asn1Time, Asn1TimeRef};
 use openssl::error::ErrorStack;
 use openssl::nid::Nid;
 use openssl::ssl::SslFiletype;
-use openssl::stack::Stack;
+use openssl::stack::{Stack, StackRef};
 use openssl::x509::store::{File, X509Lookup, X509StoreBuilder, X509StoreRef};
 use openssl::x509::verify::{X509VerifyFlags, X509VerifyParam};
 use openssl::x509::{
@@ -209,8 +209,8 @@ fn check_x509_org_name(cert: &X509Ref, expected_org: &str) -> bool {
 /// * `root_ca_verification` - Root CA verification mode
 pub fn verify_chain(
     store: &X509StoreRef,
-    untrusted_certs: &Stack<X509>,
-    sign_keys: &[X509],
+    untrusted_certs: &StackRef<X509>,
+    sign_keys: &[&X509Ref],
     root_ca_verification: &RootCaVerification,
 ) -> Result<()> {
     fn verify_fun(
@@ -1500,7 +1500,7 @@ mod tests {
             let result = verify_chain(
                 &store,
                 &untrusted,
-                &[ibm_cert],
+                &[&ibm_cert],
                 &RootCaVerification::SkipPinning,
             );
 
@@ -1537,7 +1537,7 @@ mod tests {
             let result = verify_chain(
                 &store,
                 &untrusted,
-                &[ibm_cert],
+                &[&ibm_cert],
                 &RootCaVerification::SkipPinning,
             );
 
@@ -1576,7 +1576,7 @@ mod tests {
             let result = verify_chain(
                 &store,
                 &untrusted,
-                &[ibm_cert.clone()],
+                &[&ibm_cert.clone()],
                 &RootCaVerification::RootCaOrganizationPinning(wrong_org),
             );
 
@@ -1586,7 +1586,7 @@ mod tests {
             let result = verify_chain(
                 &store,
                 &untrusted,
-                &[ibm_cert],
+                &[&ibm_cert],
                 &RootCaVerification::RootCaOrganizationPinning(
                     "International Business Machines Corporation",
                 ),
diff --git a/rust/pv/src/verify/test.rs b/rust/pv/src/verify/test.rs
index 4258a041..fa13e457 100644
--- a/rust/pv/src/verify/test.rs
+++ b/rust/pv/src/verify/test.rs
@@ -61,7 +61,7 @@ fn verify_chain_offline() {
     assert!(verify_chain(
         &store,
         &sk,
-        &[ibm_crt.clone()],
+        &[&ibm_crt],
         &RootCaVerification::RootCaOrganizationPinning(
             "International Business Machines Corporationn"
         )
@@ -70,21 +70,21 @@ fn verify_chain_offline() {
     assert!(verify_chain(
         &store,
         &sk,
-        &[ibm_crt.clone()],
+        &[&ibm_crt],
         &RootCaVerification::RootCaOrganizationPinning("International")
     )
     .is_err());
     assert!(verify_chain(
         &store,
         &sk,
-        &[ibm_crt.clone()],
+        &[&ibm_crt],
         &RootCaVerification::RootCaOrganizationPinning(
             "International Business Machines Corporation"
         )
     )
     .is_ok());
 
-    assert!(verify_chain(&store, &sk, &[ibm_crt], &RootCaVerification::SkipPinning).is_ok());
+    assert!(verify_chain(&store, &sk, &[&ibm_crt], &RootCaVerification::SkipPinning).is_ok());
 }
 
 #[test]