misc updates and improvements

[0x416e746f6e]

this PR:

• makes detect() functions (that auto-determine platform) and AttestedCertificateResolver::new() non-async so that they could be used outside tokio
• implements builder pattern for cert resolver/verifier
• implements pubkey allow-lists for self-signed certs
• switches to non-async verify_attestation_sync() in the context of blocking verify_attestation_binding()
• renames primary_name to subject in the context of TLS cert related functions
• enables using pre-determined key-pairs for attestation certs
• re-exports rcgen to avoid version collisions when the downstream needs to access rcgen
• other minor fixes

[ameba23]

🥇 Great to have these fixes.

Re: passing in keypair - i would lean towards having its as an Option and generating if not given. But don't feel too strongly.

Re: blocking API for attestation generation - i agree this makes sense as things are right now. But as mentioned here i would consider actually switching to async quote generation via configfs-tsm. Happy to merge this as-is and have that discussion later.

[0x416e746f6e]

Re: passing in keypair - i would lean towards having its as an Option and generating if not given. But don't feel too strongly.

implemented builder patterns for cert resolver and verifier. using predefined key-pair is now optional (as well as bunch of other things)

[ameba23]

💯 Great improvements.

The builder pattern especially is a big improvement.

We should document that if calling attestation generation from a tokio runtime users of the library should use spawn_blocking. But since that was already the case i consider it not directly relevant to this PR.

[ameba23]

Maybe put the duration in a constant at the top of the file

[ameba23]

I think this is a slight behavior change - the default path is to use public webpki roots as well as self-signed, whereas before it was only self-signed.

I don't think this is bad, but maybe worth mentioning in a doccomment somewhere.

[0x416e746f6e]

I updated this with b322582:

• we now have separate toggle with_accepting_self_signed_certs() that allows use of self-signed certs
• and with_root_cert_store() that allows setting up private CA

by default the verifier uses webpki-roots's store with public CAs and has self-signed certs disabled => this is useful when the server/client use public CA signed certs.

with_accepting_self_signed_certs() and with_root_cert_store() are mutually exclusive

so, basically there are 3 modes:

• default, public CA based
• private CA
• self-signed

b.t.w. all 3 can also allow-list leaf-cert's pubkeys.

l.m.k. w.d.y.t.