o/devicestate,asserts: sign confdb-control assertions with the device key

[st3v3nmw]

The process to update a confdb-control assertion (see SD172 & SD186) looks like this:

1. Call /v2/confdbs with an action like delegate or revoke
2. The assertion is updated as required
3. The assertion is signed with the device key
4. The new revision of the assertion is acknowledged

This PR adds a method to devicestate.DeviceManager that can be used to sign confdb-control assertions.

Its usage would (roughly) look like:

daemon/api_confdbs:

func doDelegateOrRevoke(c *Command, r *http.Request, _ *auth.UserState) Response {
	// request validation
	[...]

	// the existing assertion is updated
	[...]
        groups = existingAs.Groups()
	revision = existingAs.Revision() + 1

	// lock device state
	state := c.d.overlord.State()
	state.Lock()
	defer state.Unlock()

	// sign the assertion
	deviceMgr := c.d.overlord.DeviceManager()
	newAs, err = deviceMgr.SignConfdbControl(groups, revision)

	// acknowledge the new revision
	client.Ack(asserts.Encode(newAs))
}

CC @miguelpires @pedronis

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.28%. Comparing base (24a0034) to head (37063a5).
Report is 29 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #14723      +/-   ##
==========================================
+ Coverage   78.20%   78.28%   +0.07%     
==========================================
  Files        1151     1153       +2     
  Lines      151396   152156     +760     
==========================================
+ Hits       118402   119114     +712     
- Misses      25662    25686      +24     
- Partials     7332     7356      +24     

Flag	Coverage Δ
unittests	78.28% <100.00%> (+0.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[miguelpires]

this can be locked down to only sign confdb-control assertions the way SignDeviceSessionRequest does... but we'd have to wait for #14705 to go in first.

I'd say that's the better approach. 14705 is close to landing anyway so it should be fine

[st3v3nmw]

I'd say that's the better approach. 14705 is close to landing anyway so it should be fine

Thanks. I'll refactor this after #14705 lands.

[miguelpires]

thanks, some comments

[miguelpires]

This is mentioned in AddMany's doc and we already call it above, so I don't think we need this comment

Suggested change

// AddMany panics on error, that's why we aren't c.Assert'ing anything

[miguelpires]

I don't think this requires a new interface, it's just a different implementation but the customSigner abstraction still works. We can add an RODatabase parameter to customSigner and have ConfdbControl implement that.

[st3v3nmw]

I've made the changes to customSigner.

[miguelpires]

The failing validation checks should be in individual tests. Maybe they can be in a single table test if doesn't make it too annoying to deal with the prerequisites for each case

[miguelpires]

lgtm, thank you