Implement Crypto Host Capability

[esosaoh]

Description

Fix #179

This PR implements the v1/is_certificate_trusted host capability as specified in here

Test

To test this pull request, you can run the following commands:

make e2e-tests

[jvanz]

@esosaoh check why the tests are failing.

[viccuad]

data must always be utf8, we should document it on the type here.

We could provide helper functions, but please skip if it feels too much and not language native:

export namespace CertificateUtils {
  export function fromString(certString: string, encoding: CertificateEncoding): Certificate {
    return {
      encoding,
      data: Array.from(new TextEncoder().encode(certString)), // always UTF-8
    };
  }

  export function toString(cert: Certificate): string {
    return new TextDecoder('utf-8').decode(Uint8Array.from(cert.data));
  }
}

[flavio]

Moreover, I think that number is not a good way to represent a list of u8. I think we should be using Uint8Array instead

[viccuad]

We should document here that:

cert is the certificate to verify.

cert_chain is a list of certs, ordered by trust usage (intermediates first, root last). If empty or missing, certificate is assumed trusted.

[viccuad]

I'm afraid the empty not_after is enough. In the case it is not provided, we need to construct a CertificateVerificationRequest without the not_after key instead, as the spec says "undefined", not "empty".

This is how it is implemented in other SDKs, for example on the Rust one, the field doesn't get serialized if it's a None:
https://github.com/kubewarden/policy-sdk-rust/blob/main/src/host_capabilities/mod.rs#L131

[viccuad]

Both cert_chain and not_after are optional, hence they may be missing from the JSON that a policy sends to the host.

It seems that the cert_chain may be a None or an empty list, but for the not_after we need to not provide it to skip it.

[viccuad]

We don't need to export this, it's a helper internal type.
This also allows us to build the Request as needed, given the optional cert_chain and not_after that can be missing.

[jvanz]

This PR is blocked by kubewarden/kwctl#1337

[flavio]

Moreover, I think that number is not a good way to represent a list of u8. I think we should be using Uint8Array instead

[jvanz]

@esosaoh kwctl with the fix to allowing the record and replay of the crypto host capabilities are release. Can you test it again?