didbot_tls/

storage.rs

//! Certificate and ACME account-key storage in the data directory.
//!
//! An ACME account key is a credential in the same sense a signing key is:
//! whoever holds it can request certificates in this server's name against
//! its account. It gets the same treatment `crates/didbot-pds/src/wal/mod.rs`
//! gives the write-ahead log: `0600` files inside a `0700` directory, and the
//! directory's mode is set unconditionally rather than only on creation — a
//! `mkdir`'d-by-hand data directory or a mounted volume gets the same
//! tightening a freshly created one always did. See that module's
//! `create_dir` for the fuller argument; this is the same fix, independently
//! applied, because this crate cannot reach into `didbot-pds`'s
//! `pub(crate)` copy.

use std::fs;
use std::io;
use std::path::{Path, PathBuf};

#[cfg(unix)]
const FILE_MODE: u32 = 0o600;
#[cfg(unix)]
const DIR_MODE: u32 = 0o700;

const ACCOUNT_FILE: &str = "acme-account.json";
const CA_FILE: &str = "ca.pem";
const CA_KEY_FILE: &str = "ca-key.pem";
const CERT_FILE: &str = "cert.pem";
const KEY_FILE: &str = "cert-key.pem";
const META_FILE: &str = "meta.json";

/// Why the on-disk certificate state could not be read or written.
#[derive(Debug, thiserror::Error)]
pub enum StorageError {
    /// A filesystem operation on `path` failed.
    #[error("could not prepare {path}: {source}")]
    Io {
        /// The file or directory involved.
        path: PathBuf,
        /// The underlying error.
        #[source]
        source: io::Error,
    },
    /// A zone hostname could not be used as a directory name.
    #[error("{zone:?} is not usable as a certificate directory name")]
    InvalidZone {
        /// The zone that was refused.
        zone: String,
    },
    /// `path` existed but was not valid JSON for the type expected there.
    #[error("{path} did not parse: {source}")]
    Parse {
        /// The file that failed to parse.
        path: PathBuf,
        /// The underlying error.
        #[source]
        source: serde_json::Error,
    },
}

/// Where this crate's own state lives inside a PDS data directory: a `tls/`
/// subdirectory, so it sits beside the write-ahead log and blob store rather
/// than mixed into either.
///
/// # Two directories, because two things have different scopes
///
/// The ACME account is one account per deployment however many zones it
/// serves — orders are per certificate, registration is not — so
/// `acme-account.json` stays at the `tls/` root. A certificate covers
/// exactly one zone (`<zone>` plus `*.<zone>`, and a wildcard matches one
/// label, so a second zone needs a second certificate), so each zone's
/// certificate and key live in `tls/zones/<zone>/`. [`CertStore::open_zone`]
/// is the constructor that splits them; [`CertStore::open`] points both at
/// the root and is what a caller with no zone at all — a test, or a tool
/// only touching the account — wants.
#[derive(Debug, Clone)]
pub struct CertStore {
    dir: PathBuf,
    account_dir: PathBuf,
}

/// The metadata kept beside the certificate: which directory issued it and
/// when it was written. The certificate's own `notAfter` is not duplicated
/// here — `cert.rs::leaf_expiry` reads that from the DER, which cannot drift
/// from what the certificate actually says.
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
pub struct CertMeta {
    /// Which authority issued this certificate: an ACME directory URL, or
    /// [`crate::local::LOCAL_SOURCE`]. A certificate is only as good as the
    /// authority behind it — a staging leaf, a production leaf and a leaf
    /// from this machine's own authority are served by the same code and
    /// trusted by different people — so the run that reads one back checks
    /// this before serving it.
    pub directory_url: String,
    /// When this crate last wrote a certificate here.
    #[serde(with = "time::serde::rfc3339")]
    pub issued_at: time::OffsetDateTime,
}

/// An ACME account read back off disk, and which directory registered it.
///
/// The pair, rather than the credentials alone, because credentials are only
/// usable against the directory that issued them: an account registered at
/// Let's Encrypt staging can place orders at staging and nowhere else, and
/// the CAA record naming it authorises issuance at staging and nowhere else.
/// A deployment that switches directories has to know which one it is
/// holding before it decides whether to restore it.
pub struct StoredAccount {
    /// The credentials, ready to restore an `instant_acme::Account` from.
    pub credentials: instant_acme::AccountCredentials,
    /// The ACME directory URL these credentials record. `None` for a file
    /// written by a pre-0.4 `instant-acme`, which recorded the directory's
    /// individual endpoint URLs instead of the directory itself.
    pub directory_url: Option<String>,
}

impl StoredAccount {
    /// Whether these credentials were registered against `directory_url`.
    ///
    /// A file that records no directory answers `false` for every one:
    /// registering a fresh account costs one round trip, and using
    /// credentials against a directory that may not have issued them costs
    /// an outage at the next order.
    pub fn issued_by(&self, directory_url: &str) -> bool {
        self.directory_url.as_deref() == Some(directory_url)
    }
}

impl CertStore {
    /// Opens `<data_dir>/tls`, creating it `0700` if absent and tightening it
    /// to `0700` if it already existed.
    pub fn open(data_dir: &Path) -> Result<Self, StorageError> {
        let dir = data_dir.join("tls");
        create_dir(&dir)?;
        Ok(Self {
            account_dir: dir.clone(),
            dir,
        })
    }

    /// Opens `<data_dir>/tls/zones/<zone>` for `zone`'s certificate, with the
    /// ACME account still read from and written to `<data_dir>/tls`.
    ///
    /// One directory per zone is what makes a per-zone certificate pair
    /// possible at all: two zones' `cert.pem` files cannot share a path, and
    /// the alternative — one file whose contents depend on which zone was
    /// bootstrapped last — is the bug this layout exists to make
    /// unrepresentable.
    ///
    /// A zone hostname is a validated DNS name by the time it reaches here,
    /// but this checks anyway rather than joining an attacker-controlled
    /// string onto a path: anything with a separator, a `..`, or nothing in
    /// it at all is refused.
    pub fn open_zone(data_dir: &Path, zone: &str) -> Result<Self, StorageError> {
        let component = zone_directory_component(zone)?;
        let account_dir = data_dir.join("tls");
        create_dir(&account_dir)?;
        let dir = account_dir.join("zones").join(component);
        create_dir(&dir)?;
        Ok(Self { dir, account_dir })
    }

    /// The directory this store keeps `zone`'s certificate in.
    pub fn directory(&self) -> &Path {
        &self.dir
    }

    /// The ACME account last saved here, if any: the credentials, and the
    /// directory they were registered against.
    pub fn account_credentials(&self) -> Result<Option<StoredAccount>, StorageError> {
        let path = self.account_dir.join(ACCOUNT_FILE);
        let Some(value): Option<serde_json::Value> = self.read_json_at(&path)? else {
            return Ok(None);
        };
        // `instant_acme::AccountCredentials` keeps the directory it was
        // registered against and serializes it, but does not expose it on
        // the type, so it is read off the same JSON the credentials are
        // deserialized from rather than out of them.
        let directory_url = value
            .get("directory")
            .and_then(serde_json::Value::as_str)
            .map(str::to_owned);
        let credentials =
            serde_json::from_value(value).map_err(|source| StorageError::Parse { path, source })?;
        Ok(Some(StoredAccount {
            credentials,
            directory_url,
        }))
    }

    /// Persists ACME account credentials, `0600`.
    pub fn save_account_credentials(
        &self,
        credentials: &instant_acme::AccountCredentials,
    ) -> Result<(), StorageError> {
        write_json_at(&self.account_dir.join(ACCOUNT_FILE), credentials)
    }

    /// The certificate chain, key and metadata last saved here, if any.
    pub fn certificate(&self) -> Result<Option<(String, String, CertMeta)>, StorageError> {
        let cert_path = self.dir.join(CERT_FILE);
        if !cert_path.is_file() {
            return Ok(None);
        }
        let cert_pem = self.read_string(CERT_FILE)?;
        let key_pem = self.read_string(KEY_FILE)?;
        let meta = self.read_json(META_FILE)?.ok_or_else(|| StorageError::Io {
            path: self.dir.join(META_FILE),
            source: io::Error::new(io::ErrorKind::NotFound, "cert.pem exists without meta.json"),
        })?;
        Ok(Some((cert_pem, key_pem, meta)))
    }

    /// Persists a certificate chain, its key and metadata, each `0600`.
    ///
    /// All three are staged beside their final paths before any is renamed
    /// into place (see `Staged`), so a save that fails leaves the previous
    /// set untouched, and a crash leaves every file whole: its old contents
    /// or its new ones, never empty or cut short. `meta.json` is renamed
    /// last, so its presence means the key and certificate beside it were
    /// both written in full. The renames are three steps, not one: a crash
    /// between them can leave a new key beside the old certificate, or a
    /// certificate with no `meta.json`. The next bootstrap finds that set
    /// unusable and orders a new certificate.
    pub fn save_certificate(
        &self,
        cert_pem: &str,
        key_pem: &str,
        meta: &CertMeta,
    ) -> Result<(), StorageError> {
        let key = Staged::new(&self.dir.join(KEY_FILE), key_pem.as_bytes())?;
        let cert = Staged::new(&self.dir.join(CERT_FILE), cert_pem.as_bytes())?;
        let meta = Staged::json(&self.dir.join(META_FILE), meta)?;
        key.commit()?;
        cert.commit()?;
        meta.commit()
    }

    fn read_string(&self, name: &str) -> Result<String, StorageError> {
        let path = self.dir.join(name);
        fs::read_to_string(&path).map_err(|source| StorageError::Io { path, source })
    }

    fn read_json<T: serde::de::DeserializeOwned>(
        &self,
        name: &str,
    ) -> Result<Option<T>, StorageError> {
        self.read_json_at(&self.dir.join(name))
    }

    fn read_json_at<T: serde::de::DeserializeOwned>(
        &self,
        path: &Path,
    ) -> Result<Option<T>, StorageError> {
        let path = path.to_owned();
        if !path.is_file() {
            return Ok(None);
        }
        let text = fs::read_to_string(&path).map_err(|source| StorageError::Io {
            path: path.clone(),
            source,
        })?;
        serde_json::from_str(&text)
            .map(Some)
            .map_err(|source| StorageError::Parse { path, source })
    }
}

/// The local certificate authority's own certificate and key, in a
/// directory of their own.
///
/// One directory per machine rather than per data directory: a developer
/// trusts this certificate once, and a second server started with a second
/// `--data` must present leaves the same trusted authority signed.
#[derive(Debug, Clone)]
pub struct CaStore {
    dir: PathBuf,
}

impl CaStore {
    /// Opens `dir`, creating it `0700` if absent and tightening it if it
    /// already existed.
    pub fn open(dir: &Path) -> Result<Self, StorageError> {
        create_dir(dir)?;
        Ok(Self {
            dir: dir.to_owned(),
        })
    }

    /// Where the certificate sits, whether or not it has been generated
    /// yet. This is the file a developer trusts, so it has a path even
    /// before it has contents.
    pub fn certificate_path(&self) -> PathBuf {
        self.dir.join(CA_FILE)
    }

    /// The authority last saved here, as `(certificate, key)`, both PEM.
    ///
    /// A key with no certificate, or the reverse, is `None`: the pair is
    /// useless by halves, and the caller's answer to both is the same.
    pub fn load(&self) -> Result<Option<(String, String)>, StorageError> {
        let cert_path = self.certificate_path();
        let key_path = self.dir.join(CA_KEY_FILE);
        if !cert_path.is_file() || !key_path.is_file() {
            return Ok(None);
        }
        Ok(Some((
            read_string_at(&cert_path)?,
            read_string_at(&key_path)?,
        )))
    }

    /// Persists the authority's certificate and key, both `0600`.
    ///
    /// The key is committed first and the certificate last, so a crash
    /// between them leaves a key with no certificate — which [`Self::load`]
    /// reads as nothing saved, and the next start replaces.
    pub fn save(&self, cert_pem: &str, key_pem: &str) -> Result<(), StorageError> {
        let key = Staged::new(&self.dir.join(CA_KEY_FILE), key_pem.as_bytes())?;
        let cert = Staged::new(&self.certificate_path(), cert_pem.as_bytes())?;
        key.commit()?;
        cert.commit()
    }
}

/// Reads a file this crate wrote, naming it if it cannot be read.
fn read_string_at(path: &Path) -> Result<String, StorageError> {
    fs::read_to_string(path).map_err(|source| StorageError::Io {
        path: path.to_owned(),
        source,
    })
}

/// Serialises `value` and writes it `0600` at `path`, replacing whatever was
/// there in one step.
fn write_json_at<T: serde::Serialize>(path: &Path, value: &T) -> Result<(), StorageError> {
    Staged::json(path, value)?.commit()
}

/// The single path component `zone`'s certificate directory is named after:
/// the hostname, lowercased, with nothing that could escape the directory it
/// is joined onto.
fn zone_directory_component(zone: &str) -> Result<String, StorageError> {
    let component = zone.trim().to_ascii_lowercase();
    let usable = !component.is_empty()
        && component != "."
        && component != ".."
        && !component.starts_with('.')
        && component
            .chars()
            .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '-' || c == '_');
    if !usable {
        return Err(StorageError::InvalidZone {
            zone: zone.to_owned(),
        });
    }
    Ok(component)
}

/// A file's next contents, written and synced beside its final path but not
/// yet renamed over it.
///
/// The shape `didbot-pds`'s write-ahead log gives its compaction: the
/// replacement is built whole, `0600`, at a scratch path, and one
/// `rename(2)` makes it the file. A crash before the rename leaves the old
/// file as it was, plus a scratch file the next write removes; a crash after
/// it leaves the new one. The directory is synced after the rename, because
/// on most filesystems a rename that has not been durably recorded in its
/// parent can be undone by a power cut that kept the file it pointed at.
///
/// Dropped without [`commit`](Self::commit), it removes its scratch file, so
/// a save that fails partway leaves no private key under a name nothing
/// reads.
struct Staged {
    scratch: PathBuf,
    path: PathBuf,
    committed: bool,
}

impl Staged {
    /// Writes `contents`, `0600`, to a scratch file beside `path`.
    fn new(path: &Path, contents: &[u8]) -> Result<Self, StorageError> {
        let scratch = scratch_path(path);
        // A scratch file left by a write that died is removed rather than
        // reused: `create_new` below is what guarantees the mode, and
        // `rename(2)` carries the source's mode with it, so a leftover at a
        // loose mode would widen the file it replaced.
        match fs::remove_file(&scratch) {
            Ok(()) => {}
            Err(err) if err.kind() == io::ErrorKind::NotFound => {}
            Err(source) => return Err(io_error(&scratch, source)),
        }
        let mut options = fs::OpenOptions::new();
        options.write(true).create_new(true);
        #[cfg(unix)]
        {
            use std::os::unix::fs::OpenOptionsExt;
            options.mode(FILE_MODE);
        }
        let mut file = options
            .open(&scratch)
            .map_err(|source| io_error(&scratch, source))?;
        let staged = Self {
            scratch,
            path: path.to_owned(),
            committed: false,
        };
        io::Write::write_all(&mut file, contents)
            .map_err(|source| io_error(&staged.scratch, source))?;
        file.sync_all()
            .map_err(|source| io_error(&staged.scratch, source))?;
        Ok(staged)
    }

    /// Serialises `value` and stages it beside `path`.
    fn json<T: serde::Serialize>(path: &Path, value: &T) -> Result<Self, StorageError> {
        let text = serde_json::to_string_pretty(value).map_err(|source| StorageError::Parse {
            path: path.to_owned(),
            source,
        })?;
        Self::new(path, text.as_bytes())
    }

    /// Renames the scratch file over its final path, and makes that durable.
    fn commit(mut self) -> Result<(), StorageError> {
        fs::rename(&self.scratch, &self.path).map_err(|source| io_error(&self.scratch, source))?;
        self.committed = true;
        sync_dir(self.path.parent().unwrap_or_else(|| Path::new(".")))
    }
}

impl Drop for Staged {
    fn drop(&mut self) {
        if !self.committed {
            let _ = fs::remove_file(&self.scratch);
        }
    }
}

/// Where `path`'s replacement is built: `<name>.tmp` in the same directory,
/// so the rename that finishes it never crosses a filesystem.
fn scratch_path(path: &Path) -> PathBuf {
    let mut name = path
        .file_name()
        .map(std::ffi::OsStr::to_os_string)
        .unwrap_or_default();
    name.push(".tmp");
    path.with_file_name(name)
}

/// Syncs a directory entry, so a rename cannot be undone by a power cut.
fn sync_dir(dir: &Path) -> Result<(), StorageError> {
    // Not every platform lets a directory be opened as a file. Where it does
    // not, the rename is as durable as that platform makes it and there is
    // nothing further to do here.
    match fs::File::open(dir) {
        Ok(handle) => handle.sync_all().map_err(|source| io_error(dir, source)),
        Err(_) => Ok(()),
    }
}

fn io_error(path: &Path, source: io::Error) -> StorageError {
    StorageError::Io {
        path: path.to_owned(),
        source,
    }
}

/// Creates `dir` `0700` if absent, and tightens it to `0700` if it was
/// already there — the fix `didbot-pds`'s write-ahead log made for the same
/// reason, applied here because this crate cannot call that one.
fn create_dir(dir: &Path) -> Result<(), StorageError> {
    if dir.is_dir() {
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            fs::set_permissions(dir, fs::Permissions::from_mode(DIR_MODE)).map_err(|source| {
                StorageError::Io {
                    path: dir.to_owned(),
                    source,
                }
            })?;
        }
        return Ok(());
    }
    let mut builder = fs::DirBuilder::new();
    builder.recursive(true);
    #[cfg(unix)]
    {
        use std::os::unix::fs::DirBuilderExt;
        builder.mode(DIR_MODE);
    }
    builder.create(dir).map_err(|source| StorageError::Io {
        path: dir.to_owned(),
        source,
    })
}

#[cfg(all(test, unix))]
mod tests {
    use super::*;
    use std::os::unix::fs::PermissionsExt;

    #[test]
    fn creates_the_directory_0700() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        let mode = fs::metadata(tmp.path().join("tls"))
            .unwrap()
            .permissions()
            .mode()
            & 0o777;
        assert_eq!(mode, DIR_MODE);
        drop(store);
    }

    #[test]
    fn tightens_a_directory_that_already_existed_wide_open() {
        let tmp = tempdir();
        let dir = tmp.path().join("tls");
        fs::create_dir_all(&dir).unwrap();
        fs::set_permissions(&dir, fs::Permissions::from_mode(0o755)).unwrap();

        CertStore::open(tmp.path()).unwrap();

        let mode = fs::metadata(&dir).unwrap().permissions().mode() & 0o777;
        assert_eq!(mode, DIR_MODE);
    }

    #[test]
    fn certificate_files_are_0600() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        let meta = CertMeta {
            directory_url: "https://example.invalid/directory".into(),
            issued_at: time::OffsetDateTime::now_utc(),
        };
        store.save_certificate("cert", "key", &meta).unwrap();

        for name in [CERT_FILE, KEY_FILE, META_FILE] {
            let mode = fs::metadata(tmp.path().join("tls").join(name))
                .unwrap()
                .permissions()
                .mode()
                & 0o777;
            assert_eq!(mode, FILE_MODE, "{name} should be 0600");
        }
    }

    /// A key file that was already on disk at a loose mode — restored from a
    /// backup, copied into place by hand, or written by a build from before
    /// the mode was set — is replaced by the next write with one created
    /// `0600`.
    #[test]
    fn a_key_file_that_was_already_loose_is_tightened_by_the_next_write() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        let meta = CertMeta {
            directory_url: "https://example.invalid/directory".into(),
            issued_at: time::OffsetDateTime::now_utc(),
        };
        store.save_certificate("cert", "key", &meta).unwrap();

        let key = tmp.path().join("tls").join(KEY_FILE);
        fs::set_permissions(&key, fs::Permissions::from_mode(0o644)).unwrap();

        store
            .save_certificate("cert", "a renewed key", &meta)
            .unwrap();

        let mode = fs::metadata(&key).unwrap().permissions().mode() & 0o777;
        assert_eq!(
            mode, FILE_MODE,
            "the private key is mode {mode:04o}; every local account can read it"
        );
    }

    #[test]
    fn round_trips_a_saved_certificate() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        let meta = CertMeta {
            directory_url: "https://example.invalid/directory".into(),
            issued_at: time::OffsetDateTime::now_utc(),
        };
        store
            .save_certificate("the-cert", "the-key", &meta)
            .unwrap();

        let (cert, key, read_meta) = store.certificate().unwrap().unwrap();
        assert_eq!(cert, "the-cert");
        assert_eq!(key, "the-key");
        assert_eq!(read_meta.directory_url, meta.directory_url);
    }

    #[test]
    fn no_certificate_is_none_not_an_error() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        assert!(store.certificate().unwrap().is_none());
    }

    /// A write that died before its rename leaves a scratch file beside the
    /// real one, at whatever mode and length it had reached. Reads never see
    /// it, and the next save replaces it rather than renaming it into place.
    #[test]
    fn a_scratch_file_left_by_a_dead_write_neither_hides_nor_replaces_the_pair() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        let meta = CertMeta {
            directory_url: "https://example.invalid/directory".into(),
            issued_at: time::OffsetDateTime::now_utc(),
        };
        store
            .save_certificate("the-cert", "the-key", &meta)
            .unwrap();

        let key = tmp.path().join("tls").join(KEY_FILE);
        let leftover = scratch_path(&key);
        fs::write(&leftover, "half of a k").unwrap();
        fs::set_permissions(&leftover, fs::Permissions::from_mode(0o644)).unwrap();

        let (cert, key_pem, _) = store.certificate().unwrap().unwrap();
        assert_eq!((cert.as_str(), key_pem.as_str()), ("the-cert", "the-key"));

        store
            .save_certificate("the-cert", "a renewed key", &meta)
            .unwrap();

        let (_, key_pem, _) = store.certificate().unwrap().unwrap();
        assert_eq!(key_pem, "a renewed key");
        let mode = fs::metadata(&key).unwrap().permissions().mode() & 0o777;
        assert_eq!(
            mode, FILE_MODE,
            "the leftover's mode {mode:04o} travelled with the rename"
        );
        assert!(
            !leftover.exists(),
            "a committed save leaves no scratch file"
        );
    }

    /// A save that cannot finish must not touch the files a restart boots
    /// from. Staging the metadata is made to fail here — its scratch path is
    /// taken by a directory, which cannot be removed as a file or created as
    /// one — after the key and certificate were both staged, and the pair on
    /// disk is the one from before.
    #[test]
    fn a_save_that_fails_leaves_the_previous_pair_untouched() {
        let tmp = tempdir();
        let store = CertStore::open(tmp.path()).unwrap();
        let meta = CertMeta {
            directory_url: "https://example.invalid/directory".into(),
            issued_at: time::OffsetDateTime::now_utc(),
        };
        store
            .save_certificate("the-cert", "the-key", &meta)
            .unwrap();

        let dir = tmp.path().join("tls");
        fs::create_dir(scratch_path(&dir.join(META_FILE))).unwrap();

        store
            .save_certificate("a renewed cert", "a renewed key", &meta)
            .unwrap_err();

        let (cert, key, _) = store.certificate().unwrap().unwrap();
        assert_eq!((cert.as_str(), key.as_str()), ("the-cert", "the-key"));
        for name in [CERT_FILE, KEY_FILE] {
            assert!(
                !scratch_path(&dir.join(name)).exists(),
                "{name}'s scratch file outlived the save that failed"
            );
        }
    }

    fn tempdir() -> TempDir {
        TempDir::new()
    }

    /// A minimal self-cleaning temp directory, so this crate does not take a
    /// `tempfile` dependency just for these tests.
    struct TempDir(PathBuf);

    impl TempDir {
        fn new() -> Self {
            let mut dir = std::env::temp_dir();
            let unique = format!(
                "didbot-tls-test-{}-{}",
                std::process::id(),
                std::time::SystemTime::now()
                    .duration_since(std::time::UNIX_EPOCH)
                    .unwrap()
                    .as_nanos()
            );
            dir.push(unique);
            fs::create_dir_all(&dir).unwrap();
            Self(dir)
        }

        fn path(&self) -> &Path {
            &self.0
        }
    }

    impl Drop for TempDir {
        fn drop(&mut self) {
            let _ = fs::remove_dir_all(&self.0);
        }
    }
}