NLnetLabs · partim · Jul 10, 2026 · Jul 10, 2026
diff --git a/src/api/roa.rs b/src/api/roa.rs
@@ -223,7 +223,7 @@ impl fmt::Display for RoaPayload {
 
 impl fmt::Debug for RoaPayload {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "RoaPayload({})", &self)
+        write!(f, "RoaPayload({})", self)
     }
 }
 
@@ -793,7 +793,7 @@ impl fmt::Display for TypedPrefix {
 
 impl fmt::Debug for TypedPrefix {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", &self)
+        write!(f, "{}", self)
     }
 }
 
@@ -906,7 +906,7 @@ impl fmt::Display for Ipv4Prefix {
 
 impl fmt::Debug for Ipv4Prefix {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", &self)
+        write!(f, "{}", self)
     }
 }
 
@@ -1011,7 +1011,7 @@ impl fmt::Display for Ipv6Prefix {
 
 impl fmt::Debug for Ipv6Prefix {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", &self)
+        write!(f, "{}", self)
     }
 }
 
@@ -1080,7 +1080,7 @@ impl fmt::Display for AsNumber {
 
 impl fmt::Debug for AsNumber {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", &self)
+        write!(f, "{}", self)
     }
 }
 

diff --git a/src/api/rta.rs b/src/api/rta.rs
@@ -38,7 +38,7 @@ pub struct RtaContentRequest {
 
 impl fmt::Display for RtaContentRequest {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        writeln!(f, "resources: {}", &self.resources)?;
+        writeln!(f, "resources: {}", self.resources)?;
         writeln!(
             f,
             "validity, {}-{}",

diff --git a/src/api/status.rs b/src/api/status.rs
@@ -151,7 +151,7 @@ impl From<(&'static str, &'static str)> for ErrorResponse {
 
 impl fmt::Display for ErrorResponse {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", &serde_json::to_string(&self).unwrap())
+        write!(f, "{}", serde_json::to_string(&self).unwrap())
     }
 }
 
diff --git a/src/commons/crypto/signing/signers/kmip/signer.rs b/src/commons/crypto/signing/signers/kmip/signer.rs
@@ -713,7 +713,7 @@ impl KmipSigner {
         if !matches!(algorithm, PublicKeyFormat::Rsa) {
             return Err(SignerError::KmipError(format!(
                 "Algorithm {:?} not supported while creating key",
-                &algorithm
+                algorithm
             )));
         }
 
@@ -924,7 +924,7 @@ impl KmipSigner {
         if let Err(err) = &res {
             warn!(
                 "[{}] Failed to destroy KMIP public key '{}': {}",
-                self.name, &kmip_key_pair_ids.public_key_id, err
+                self.name, kmip_key_pair_ids.public_key_id, err
             );
         }
 
@@ -942,7 +942,7 @@ impl KmipSigner {
                 deactivated = false;
                 warn!(
                     "[{}] Failed to revoke KMIP private key '{}': {}",
-                    self.name, &kmip_key_pair_ids.private_key_id, err
+                    self.name, kmip_key_pair_ids.private_key_id, err
                 );
             }
 
@@ -966,7 +966,7 @@ impl KmipSigner {
             if let Err(err) = &res3 {
                 warn!(
                     "[{}] Failed to destroy KMIP private key '{}': {}",
-                    self.name, &kmip_key_pair_ids.private_key_id, err
+                    self.name, kmip_key_pair_ids.private_key_id, err
                 );
             }
 

diff --git a/src/commons/crypto/signing/signers/pkcs11/signer.rs b/src/commons/crypto/signing/signers/pkcs11/signer.rs
@@ -938,8 +938,8 @@ impl Pkcs11Signer {
         if !matches!(algorithm, PublicKeyFormat::Rsa) {
             return Err(SignerError::Pkcs11Error(format!(
                 "Algorithm {:?} not supported while creating key",
-                &algorithm
-            )))?;
+                algorithm
+            )).into());
         }
 
         let mech = Mechanism::RsaPkcsKeyPairGen;
@@ -1135,7 +1135,7 @@ impl Pkcs11Signer {
             1 => Ok(results[0]),
             _ => Err(KeyError::Signer(SignerError::Pkcs11Error(format!(
                 "More than one {} found with id {}",
-                &human_key_class, cka_id_hex_str
+                human_key_class, cka_id_hex_str
             )))),
         }
     }

diff --git a/src/commons/error.rs b/src/commons/error.rs
@@ -163,7 +163,7 @@ impl Display for ApiAuthError {
             | ApiAuthError::ApiAuthTransientError(err)
             | ApiAuthError::ApiAuthSessionExpired(err)
             | ApiAuthError::ApiInsufficientRights(err) => {
-                write!(f, "{}", &err)
+                write!(f, "{err}")
             }
         }
     }

diff --git a/src/commons/queue.rs b/src/commons/queue.rs
@@ -499,7 +499,7 @@ mod tests {
                         None,
                         ScheduleMode::FinishOrReplaceExisting,
                     ).unwrap();
-                    println!("> Scheduled job {}", &name);
+                    println!("> Scheduled job {}", name);
                 }
             });
         });

diff --git a/src/daemon/http/auth/authorizer.rs b/src/daemon/http/auth/authorizer.rs
@@ -255,7 +255,7 @@ impl Authorizer {
     pub async fn authenticate_request(
         &self, request: &HyperRequest
     ) -> (AuthInfo, Option<Token>) {
-        trace!("Determining actor for request {:?}", &request);
+        trace!("Determining actor for request {:?}", request);
 
         // Try the legacy provider first, if any.
         let authenticate_res = match &self.legacy_provider {
@@ -307,7 +307,7 @@ impl Authorizer {
         let user = self.primary_provider.login(request).await?;
 
         if log_enabled!(log::Level::Trace) {
-            trace!("User logged in: {:?}", &user);
+            trace!("User logged in: {:?}", user);
         } else {
             info!("User logged in: {}, role: {}", user.id(), user.role());
         }

diff --git a/src/daemon/http/auth/crypt.rs b/src/daemon/http/auth/crypt.rs
@@ -57,8 +57,7 @@ impl NonceState {
         let mut sender_unique: [u8; 4] = [0; 4];
         openssl::rand::rand_bytes(&mut sender_unique).map_err(|err| {
             Error::Custom(format!(
-                "Unable to generate a random sender id: {}",
-                &err
+                "Unable to generate a random sender id: {}", err
             ))
         })?;
 
@@ -120,7 +119,7 @@ pub(crate) fn encrypt(
         plaintext,
         &mut tag,
     )
-    .map_err(|err| Error::Custom(format!("Encryption error: {}", &err)))?;
+    .map_err(|err| Error::Custom(format!("Encryption error: {}", err)))?;
 
     let mut payload =
         Vec::with_capacity(nonce.len() + tag.len() + cipher_text.len());
@@ -158,7 +157,7 @@ pub(crate) fn decrypt(
     )
     .map_err(|err| {
         ApiAuthError::ApiInvalidCredentials(
-            format!("Decryption error: {}", &err)
+            format!("Decryption error: {}", err)
         )
     })
 }

diff --git a/src/daemon/http/auth/providers/openid_connect/provider.rs b/src/daemon/http/auth/providers/openid_connect/provider.rs
@@ -263,7 +263,7 @@ impl AuthProvider {
 
         info!(
             "OpenID Connect: Discovering provider details using issuer {}",
-            &issuer.as_str()
+            issuer.as_str()
         );
 
         // Contact the OpenID Connect: identity provider discovery endpoint to
@@ -583,7 +583,7 @@ impl AuthProvider {
 
         trace!(
             "OpenID Connect: Revoking token for user: \"{}\"",
-            &session.user_id
+            session.user_id
         );
         trace!("OpenID Connect: Submitting RFC-7009 section 2 Token Revocation request");
         let lock_guard = self.get_connection().await.map_err(|err| {
@@ -668,7 +668,7 @@ impl AuthProvider {
 
         debug!(
             "OpenID Connect: Refreshing token for user: \"{}\"",
-            &session.user_id
+            session.user_id
         );
         trace!("OpenID Connect: Submitting RFC-6749 section 6 Access Token Refresh request");
 
@@ -789,7 +789,7 @@ impl AuthProvider {
                     Ok(parsed_cookies) => {
                         trace!(
                             "OpenID Connect: parsed cookies={:?}",
-                            &parsed_cookies
+                            parsed_cookies
                         );
                         // Even with the helper crate we have to do some
                         // work... Why doesn't it
@@ -925,7 +925,7 @@ impl AuthProvider {
                 "OpenID Connect: CSRF token mismatch",
                 Some(&format!(
                     "cookie CSRF hash={:?}, request CSRF hash={:?}",
-                    &cookie_csrf_hash,
+                    cookie_csrf_hash,
                     request_csrf_hash.to_vec()
                 )),
             )),
@@ -1465,7 +1465,7 @@ impl AuthProvider {
 
         let (authorize_url, _csrf_state, _nonce) = request.url();
 
-        debug!("OpenID Connect: Login URL will be {:?}", &authorize_url);
+        debug!("OpenID Connect: Login URL will be {:?}", authorize_url);
 
         let res_body = authorize_url.as_str().as_bytes().to_vec();
         let mut res = HttpResponse::text_no_cache(res_body).into_response();
@@ -1872,7 +1872,7 @@ impl AuthProvider {
 
         trace!(
             "Telling Lagosta to direct the user to logout at: {}",
-            &go_to_url
+            go_to_url
         );
         Ok(HttpResponse::text_no_cache(go_to_url.into()))
     }

diff --git a/src/daemon/http/auth/session.rs b/src/daemon/http/auth/session.rs
@@ -65,7 +65,7 @@ impl<S> ClientSession<S> {
                     trace!(
                         "Login session status check: user_id={}, \
                          status={:?}, max age={} secs, cur age={} secs",
-                        &self.user_id, &status, max_age_secs, cur_age_secs
+                        self.user_id, status, max_age_secs, cur_age_secs
                     );
 
                     return status;
@@ -166,7 +166,7 @@ impl<S> LoginSessionCache<S> {
             secrets
         };
 
-        debug!("Creating token for session: {:?}", &session);
+        debug!("Creating token for session: {:?}", session);
 
         let session_json_str =
             serde_json::to_string(&session).map_err(|err| {
@@ -231,7 +231,7 @@ impl<S> LoginSessionCache<S> {
     ) -> Result<ClientSession<S>, ApiAuthError>
     where S: Clone + DeserializeOwned {
         if let Some(session) = self.lookup_session(&token).await {
-            trace!("Session cache hit for session id {}", &session.user_id);
+            trace!("Session cache hit for session id {}", session.user_id);
             return Ok(session);
         }
         else {
@@ -262,7 +262,7 @@ impl<S> LoginSessionCache<S> {
 
         trace!(
             "Session cache miss, deserialized session id {}",
-            &session.user_id
+            session.user_id
         );
 
         if add_to_cache {

diff --git a/src/daemon/http/dispatch/auth.rs b/src/daemon/http/dispatch/auth.rs
@@ -74,7 +74,7 @@ mod multi_user {
         request.check_get()?;
 
         trace!(
-            "Authentication callback invoked: {:?}", &request.hyper()
+            "Authentication callback invoked: {:?}", request.hyper()
         );
 
         let (server, request) = request.proceed_raw();
@@ -121,9 +121,9 @@ mod multi_user {
 
         Ok(format!(
             "/ui/login?token={}&id={}&attributes={}",
-            &url_encode(user.token())?,
-            &url_encode(user.id())?,
-            &url_encode(attributes)?,
+            url_encode(user.token())?,
+            url_encode(user.id())?,
+            url_encode(attributes)?,
         ))
     }
 }

diff --git a/src/daemon/http/response.rs b/src/daemon/http/response.rs
@@ -360,7 +360,7 @@ impl HttpResponse {
     ) {
         let header_name = const { HeaderName::from_static("authorization") };
         let header_value = match HeaderValue::from_maybe_shared(
-            Bytes::from(format!("Bearer {}", &token))
+            Bytes::from(format!("Bearer {}", token))
         ) {
             Ok(value) => value,
             Err(_) => {

diff --git a/src/daemon/http/server.rs b/src/daemon/http/server.rs
@@ -136,9 +136,7 @@ impl RequestLogger {
 
         trace!(
             "Request: method={} path={} headers={:?}",
-            &req_method,
-            &req_path,
-            &req.headers()
+            req_method, req_path, req.headers()
         );
 
         RequestLogger {

diff --git a/src/server/ca/certauth.rs b/src/server/ca/certauth.rs
@@ -1306,7 +1306,7 @@ impl CertAuth {
                 "Updating resource class name mapping for\
                  child '{}, but parent does not have any resource class \
                  called '{}', or at least not yet.",
-                 child_handle, &mapping.name_in_parent
+                 child_handle, mapping.name_in_parent
             );
         }
 
@@ -1907,7 +1907,7 @@ impl CertAuth {
 
             info!(
                 "Updating Entitlements for CA: {}, Removing RC: {}",
-                &self.handle, &rcn
+                self.handle, rcn
             );
 
             res.push(CertAuthEvent::ResourceClassRemoved {
@@ -2079,7 +2079,7 @@ impl CertAuth {
             )? {
                 info!(
                     "Started key roll for ca: {}, rc: {}, under parent: {}",
-                    &self.handle,
+                    self.handle,
                     rcn,
                     rc.parent_handle()
                 );
@@ -2104,7 +2104,7 @@ impl CertAuth {
             )? {
                 info!(
                     "Activated key for ca: {}, rc: {}, under parent: {}",
-                    &self.handle,
+                    self.handle,
                     rcn,
                     rc.parent_handle()
                 );
@@ -2128,7 +2128,7 @@ impl CertAuth {
 
         info!(
             "Finished key roll for ca: {}, rc: {}, under parent: {}",
-            &self.handle,
+            self.handle,
             rcn,
             my_rc.parent_handle()
         );

diff --git a/src/server/ca/manager.rs b/src/server/ca/manager.rs
@@ -775,7 +775,7 @@ impl CaManager {
         actor: &Actor,
         krill: &KrillRuntime,
     ) -> KrillResult<ParentResponse> {
-        info!("CA '{}' process add child request: {}", &ca, &req);
+        info!("CA '{}' process add child request: {}", ca, req);
         if ca.as_str() != TA_NAME {
             self.process_ca_command(ca.clone(), actor,
                 CertAuthCommandDetails::ChildAdd(

diff --git a/src/server/ca/publishing.rs b/src/server/ca/publishing.rs
@@ -572,7 +572,7 @@ impl CaObjects {
         let hours = timing.publish_hours_before_next();
         let mut required = false;
 
-        for (_, resource_class_objects) in self.classes.iter_mut() {
+        for resource_class_objects in self.classes.values_mut() {
             if force || resource_class_objects.requires_re_issuance(hours) {
                 required = true;
                 resource_class_objects.reissue(timing, signer)?;

diff --git a/src/upgrades/data_migration.rs b/src/upgrades/data_migration.rs
@@ -47,8 +47,8 @@ pub fn migrate(
     info!("-----------------------------------------------------------");
     info!("STEP 1: Copy data");
     info!("");
-    info!("From: {}", &config.storage_uri);
-    info!("  To: {}", &target_storage.default_uri());
+    info!("From: {}", config.storage_uri);
+    info!("  To: {}", target_storage.default_uri());
     info!("-----------------------------------------------------------");
     info!("");