Caching support for VCEK certificates

[lmilleri]

VCEK certificates can be fetched in 3 ways:
(1) from the attestation report (it seems not safe to rely on this option)
(2) from local directory (depending on the processor generation):

└── etc
    └── kbs
        └── snp
            └── ek
                ├── genoa
                ├── milan
                └── turin

(3) from the AMD KDS (this option is not viable for disconnected environments)

[bpradipt]

The path can be a const.

[bpradipt]

I think iterator is an idiomatic way in rust for these things. I asked copilot for an iterator implementation for this and it returned the following

let cert_data = fs::read_dir(&vcek_dir)?
        // 1. Filter out directory entries that are errors.
        .filter_map(Result::ok)
        // 2. Keep only entries that are files.
        .filter(|entry| entry.path().is_file())
        // 3. Try to read and parse each file, returning the raw data and parsed cert.
        //    This filters out files that can't be read or parsed.
        .filter_map(|entry| {
            let path = entry.path();
            let data = fs::read(&path).ok()?; // .ok() converts Result to Option
            let cert = Certificate::from_bytes(&data).ok()?;
            Some((data, cert, path)) // Pass data, cert, and path along
        })
        // 4. Find the first one that successfully verifies the report.
        .find(|(_data, cert, path)| {
            match (cert, report).verify() {
                Ok(_) => {
                    log::info!("Found VCEK certificate that verifies report: {}", path.display());
                    true
                }
                Err(e) => {
                    log::debug!("Certificate {} does not verify report: {}", path.display(), e);
                    false
                }
            }
        });

    // 5. Handle the result of the `find` operation.
    match cert_data {
        Some((data, _cert, _path)) => Ok(data),
        None => bail!(
            "No VCEK certificate found in {} that verifies the report",
            vcek_dir.display()
        ),
    }

Most likely you'll need to adapt it.

[bpradipt]

/lgtm