feat(verification): get trusted root material and allow rotation

[jiparis]

This PR adds an endpoint to get the root material from the configured certificate authorities:

• Adds the possibility to have one signing authority and multiple previous CAs, useful for certificate rotation.
• Adds an endpoint (private) to get all root certificate (and chains) from the configured CAs
• Implemented for FileCA and EJBCA.

> buf curl --http2-prior-knowledge --protocol grpc  -H "Authorization: Bearer $CHAINLOOP_TOKEN" http://localhost:9000/controlplane.v1.SigningService/GetTrustedRoot
{
  "keys": {
    "2a522d9652e0933d2a1237c395bc116e012f86dffff13122da59f76e0d2abe27": {
      "certificates": [
        "-----BEGIN CERTIFICATE-----\nMI... ==\n-----END CERTIFICATE-----\n"
      ]
    },
    "e6b4419565f9ccab5c68d7a99d96722931d2d9a7d920c938fae46c45e25989d2": {
      "certificates": [
        "-----BEGIN CERTIFICATE-----\n... Q==\n-----END CERTIFICATE-----\n"
      ]
    }
  }
}

Chart changes:

✗ diff before.yaml after.yaml
445c445
<   generated_jws_hmac_secret: "THVVd1dBOFRrbw=="
---
>   generated_jws_hmac_secret: "R1NoTllaMkFsdQ=="
449,453c449,454
<     certificate_authority:
<       file_ca:
<         cert_path: "/ca_secrets/file_ca.cert"
<         key_path:  "/ca_secrets/file_ca.key"
<         key_pass: "foo"
---
>     certificate_authorities:
>       - issuer: true
>         file_ca:
>           cert_path: "/ca_secrets/file_ca.cert"
>           key_path:  "/ca_secrets/file_ca.key"
>           key_pass: "foo"
476c477
<       generated_jws_hmac_secret: "LuUwWA8Tko"
---
>       generated_jws_hmac_secret: "GShNYZ2Alu"
1613c1614
<         checksum/secret-config: 5befa75f8e0d765e8585f890d75547ca0c39eac815b31961619026e70b87ffd4
---
>         checksum/secret-config: fbe01695cfacff3e8e5a3954bffbae73d6b15a6452ea5c6bbd3ee39feedc35c2

Note that chart configuration doesn't support multiple CAs yet.

[migmartri]

Thanks @jiparis

[jiparis]

This is needed, since the new endpoint should be available for workflow run describe. This setting will make it public, but we might want to move it to its own service.

[migmartri]

I think it's fine since it can enable offline verification

[migmartri]

Thanks @jiparis

[migmartri]

I think it's fine since it can enable offline verification

[migmartri]

should we add the issuer option in the values.yaml file too? Or should we do it later on to support multiple CASs?

[jiparis]

Yes, I didn't want to disrupt current values.yaml. I would add it when we support multiple CAs.