Windows support

[emillon]

Closes #14

On Windows, the root certificates are available in the system store named "ROOT". The corresponding certificate contexts hold a DER encoding of the certificates, which is exposed through a C external.

See https://docs.microsoft.com/en-us/windows/win32/seccrypto/example-c-program-listing-the-certificates-in-a-store

[dra27]

The cons cells aren't tagged correctly, but for lists I'd use the low-level allocation functions

[hannesm]

Thanks for your work @emillon. It would be nice if you could add a GitHub action CI that executes the build and test on Windows. (an example yaml file is available at https://github.com/mirage/mirage-crypto/blob/main/.github/workflows/windows.yml).

[hannesm]

FWIW, I don't think that we need the PEM formatted certificates (getting DER and decoding is fine) -- as indicated by the open tasks. I'm in favor to setup CI and merge and release this PR.

[emillon]

OK! I haven't thought everything fully, this is why I marked this as WIP. I'll let you know when that can be reviewed.

For the github action, it won't work well if I'm adding it in this PR (when the PR is from a fork, it's the action from main that's used to test the PR) so I'll do this first in another PR and rebase this one.

[emillon]

This is now ready for review.

The list of certificates that are returned correspond to the ones in the list of Trusted Root Certificate Authorities:

About encoding: certificate contexts have an implicit certificate encoding type. At the moment, the only one is X509_ASN_ENCODING, but I still added a check to make sure we're not trying to decode as DER something that's not supposed to be. An alternative would be to call a C function to encode directly as PEM (ignoring how the context is encoded).

[hannesm]

Thanks @emillon, to me this looks fine. The only question I have whether the flags.sexp dance is required to pass ldflags depending on the os (in other words: is there a way to do this without a temporary file?).

[emillon]

Thanks @emillon, to me this looks fine. The only question I have whether the flags.sexp dance is required to pass ldflags depending on the os (in other words: is there a way to do this without a temporary file?).

There are some alternatives (reading from flags.%{os_type} and adding rules to support all os types; writing the flags file from an executable instead of dune rules), but nothing that skips the temporary file.

[hannesm]

looks fine (thanks for taking your time to answer my questions), feel free to merge and release to opam-repository.

[emillon]

Thanks!