Cargo Delivery Authorisation issuer isn't rotated

[gnarea]

I forgot to call this out explicitly in the issues: We should rotate the self-issued certificate used in Cargo Delivery Authorisations.

Right now, we can only have exactly one as it's stored in a file that's generated the first time the app starts (and there's no rotation):

relaynet-gateway-android/app/src/main/java/tech/relaycorp/gateway/domain/LocalConfig.kt

Line 116 in 809ebbe

internal const val CDA_CERTIFICATE_FILE_NAME = "cda_local_gateway.certificate"

Instead, we should do what we've been doing with the other certificates:

• Generate a new one when the latest one is about to expire.
• Use the latest certificate in all signature-producing operations. In this case, only here:
  

  relaynet-gateway-android/app/src/main/java/tech/relaycorp/gateway/domain/courier/GenerateCCA.kt

  Lines 27 to 32 in 8f01a2b

  	val cda = issueDeliveryAuthorization(
  	publicGatewayPublicKey,
  	identityPrivateKey,
  	ZonedDateTime.now().plusSeconds(TTL.inSeconds.toLong()),
  	senderCertificate
  	)

• Use all the valid certificates in all signature-verification operations. In this case, only here:
  

  relaynet-gateway-android/app/src/main/java/tech/relaycorp/gateway/data/disk/CargoStorage.kt

  Line 30 in c56cc71

  cargo.validate(RecipientAddressType.PRIVATE, setOf(localConfig.getCargoDeliveryAuth()))

• Delete all expired certificates.

We probably want to reuse our FileCertificateStore and introduce a second instance to manage CDA issuers only. I think that'd require changing the FileCertificateStore class to take a path prefix (under the existing root), so that we avoid overriding files.

[sdsantos]

Tasks:

• Start using new version of FileCertificateStore
• Switch from regular FileStore to FileCertificateStore for storing CDAs
• Generate new CDA when we don't have any, or the one we have stored is about to expire
• Method to return the latest valid CDA and use it in all signature-producing operations
• Method to return all valid CDAs and use it in all signature-verification operations

[github-actions]

🎉 This issue has been resolved in version 1.6.0 🎉

The release is available on:

• v1.6.0
• GitHub release

Your semantic-release bot 📦🚀