import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
private SignatureStatus verifySignatureForTrustedAuthority(DirectoryServer trustedAuthority, DirectorySignature signature) {
	final KeyCertificate certificate = trustedAuthority.getCertificateByFingerprint(signature.getSigningKeyDigest());
	if(certificate == null) {
		logger.fine("Missing certificate for signing key: "+ signature.getSigningKeyDigest());
		addRequiredCertificateForSignature(signature);
		return SignatureStatus.STATUS_NEED_CERTS;
	}
	if(certificate.isExpired()) {
		return SignatureStatus.STATUS_FAILED;
	}
	
	final TorPublicKey signingKey = certificate.getAuthoritySigningKey();
	final HexDigest d = (signature.useSha256()) ? signingHash256 : signingHash;
	if(!signingKey.verifySignature(signature.getSignature(), d)) {
		logger.warning("Signature failed on consensus for signing key: "+ signature.getSigningKeyDigest());
		return SignatureStatus.STATUS_FAILED;
	}
	return SignatureStatus.STATUS_VERIFIED;
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
private void loadCertificates(ByteBuffer buffer) {
	final DocumentParser<KeyCertificate> parser = parserFactory.createKeyCertificateParser(buffer);
	final DocumentParsingResult<KeyCertificate> result = parser.parse();
	if(testResult(result, "certificates")) {
		for(KeyCertificate cert: result.getParsedDocuments()) {
			addCertificate(cert);
		}
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public void addCertificate(KeyCertificate certificate) {
	synchronized(TrustedAuthorities.getInstance()) {
		final boolean wasRequired = removeRequiredCertificate(certificate);
		final DirectoryServer as = TrustedAuthorities.getInstance().getAuthorityServerByIdentity(certificate.getAuthorityFingerprint());
		if(as == null) {
			logger.warning("Certificate read for unknown directory authority with identity: "+ certificate.getAuthorityFingerprint());
			return;
		}
		as.addCertificate(certificate);
		
		if(consensusWaitingForCertificates != null && wasRequired) {
			
			switch(consensusWaitingForCertificates.verifySignatures()) {
			case STATUS_FAILED:
				consensusWaitingForCertificates = null;
				return;
				
			case STATUS_VERIFIED:
				addConsensusDocument(consensusWaitingForCertificates, false);
				consensusWaitingForCertificates = null;
				return;

			case STATUS_NEED_CERTS:
				requiredCertificates.addAll(consensusWaitingForCertificates.getRequiredCertificates());
				return;
			}
		}
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
private boolean removeRequiredCertificate(KeyCertificate certificate) {
	final Iterator<RequiredCertificate> it = requiredCertificates.iterator();
	while(it.hasNext()) {
		RequiredCertificate r = it.next();
		if(r.getSigningKey().equals(certificate.getAuthoritySigningKey().getFingerprint())) {
			it.remove();
			return true;
		}
	}
	return false;
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public void storeCertificates() {
	synchronized(TrustedAuthorities.getInstance()) {
		final List<KeyCertificate> certs = new ArrayList<KeyCertificate>();
		for(DirectoryServer ds: TrustedAuthorities.getInstance().getAuthorityServers()) {
			certs.addAll(ds.getCertificates());
		}
		store.writeDocumentList(CacheFile.CERTIFICATES, certs);
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public boolean parse(DocumentParsingResultHandler<KeyCertificate> resultHandler) {
	this.resultHandler = resultHandler;
	startNewCertificate();
	try {
		fieldParser.processDocument();
		return true;
	} catch(TorParsingException e) {
		resultHandler.parsingError(e.getMessage());
		return false;
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public KeyCertificate getCertificateByFingerprint(HexDigest fingerprint) {
	for(KeyCertificate kc: getCertificates()) {
		if(kc.getAuthoritySigningKey().getFingerprint().equals(fingerprint)) {
			return kc;
		}
	}
	return null;
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public List<KeyCertificate> getCertificates() {
	synchronized(certificates) {
		purgeExpiredCertificates();
		purgeOldCertificates();
		return new ArrayList<KeyCertificate>(certificates);
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
private void purgeExpiredCertificates() {
	Iterator<KeyCertificate> it = certificates.iterator();
	while(it.hasNext()) {
		KeyCertificate elem = it.next();
		if(elem.isExpired()) {
			it.remove();
		}
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
private void purgeOldCertificates() {
	if(certificates.size() < 2) {
		return;
	}
	final KeyCertificate newest = getNewestCertificate();
	final Iterator<KeyCertificate> it = certificates.iterator();
	while(it.hasNext()) {
		KeyCertificate elem = it.next();
		if(elem != newest && isMoreThan48HoursOlder(newest, elem)) {
			it.remove();
		}
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
private KeyCertificate getNewestCertificate() {
	KeyCertificate newest = null;
	for(KeyCertificate kc : certificates) {
		if(newest == null || getPublishedMilliseconds(newest) > getPublishedMilliseconds(kc)) {
			newest = kc;
		}
	}
	return newest;
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public void addCertificate(KeyCertificate certificate) {
	if(!certificate.getAuthorityFingerprint().equals(v3Ident)) {
		throw new IllegalArgumentException("This certificate does not appear to belong to this directory authority");
	}
	synchronized(certificates) {
		certificates.add(certificate);
	}
}
 

import com.subgraph.orchid.KeyCertificate; //导入依赖的package包/类
public void run() {
	try {
		for(KeyCertificate c: downloader.downloadKeyCertificates(directory.getRequiredCertificates())) {
			directory.addCertificate(c);
		}
		directory.storeCertificates();
	} catch (DirectoryRequestFailedException e) {
		logger.warning("Failed to download key certificates: "+ e.getMessage());
	} finally {
		isDownloadingCertificates = false;
	}
}