report: add support for optionally signing reports

These signatures can be provided by arbitrary Varlink backends symlinked
into /run/systemd/report/sign.

Also add a proper Varlink IDL for the upload interface, since we are
extended it now.

src/shared/meson.build

@@ -241,6 +241,8 @@ shared_sources = files(
         'varlink-io.systemd.PCRExtend.c',
         'varlink-io.systemd.PCRLock.c',
         'varlink-io.systemd.Repart.c',
+        'varlink-io.systemd.Report.Signer.c',
+        'varlink-io.systemd.Report.Uploader.c',
         'varlink-io.systemd.Resolve.c',
         'varlink-io.systemd.Resolve.Hook.c',
         'varlink-io.systemd.Resolve.Monitor.c',

src/shared/varlink-io.systemd.Report.Signer.c

@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "varlink-io.systemd.Report.Signer.h"
+
+static SD_VARLINK_DEFINE_METHOD(
+                Sign,
+                SD_VARLINK_FIELD_COMMENT("The digest of the data to sign."),
+                SD_VARLINK_DEFINE_INPUT(digest, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("The digest algorithm used for the digest field above. For now this is always SHA256, but this might be changed eventually."),
+                SD_VARLINK_DEFINE_INPUT(algorithm, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("An array of signature objects"),
+                SD_VARLINK_DEFINE_OUTPUT(data, SD_VARLINK_OBJECT, SD_VARLINK_ARRAY));
+
+SD_VARLINK_DEFINE_INTERFACE(
+                io_systemd_Report_Signer,
+                "io.systemd.Report.Signer",
+                SD_VARLINK_INTERFACE_COMMENT("Backend API for signing reports. This interface shall be implemented by services linked into /run/systemd/report.sign/."),
+                SD_VARLINK_SYMBOL_COMMENT("Sign a report, identified by a digest. This may return zero, one or more signatures, as appropriate. For example some backend might have multiple keys or algorithms available, that are appropriate, in which case it can generate multiple signatures."),
+                &vl_method_Sign);

src/shared/varlink-io.systemd.Report.Signer.h

@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink-idl.h"
+
+extern const sd_varlink_interface vl_interface_io_systemd_Report_Signer;

src/shared/varlink-io.systemd.Report.Uploader.c

@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "varlink-io.systemd.Report.Uploader.h"
+
+static SD_VARLINK_DEFINE_METHOD(
+                Upload,
+                SD_VARLINK_FIELD_COMMENT("Report data as JSON variant. Either this field or reportData (below) have to be specified. This mode is used if signing is not used, and hence a precise binary formatting of the JSON data is not relevant."),
+                SD_VARLINK_DEFINE_INPUT(report, SD_VARLINK_OBJECT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Report data in Base64. Either this field or report (above) have to be specified. This mode is used if signing is enabled, as a precise binary formatting of the JSON data is important to authenticate the signature. This data contains a JSON-SEQ compliant stream of objects, the first being the report, the following ones signature objects."),
+                SD_VARLINK_DEFINE_INPUT(reportData, SD_VARLINK_STRING, SD_VARLINK_NULLABLE));
+
+SD_VARLINK_DEFINE_INTERFACE(
+                io_systemd_Report_Uploader,
+                "io.systemd.Report.Uploader",
+                SD_VARLINK_INTERFACE_COMMENT("Backend API for uploading reports. This interface shall be implemented by services linked into /run/systemd/report.upload/"),
+                SD_VARLINK_SYMBOL_COMMENT("Upload a report now."),
+                &vl_method_Upload);

src/shared/varlink-io.systemd.Report.Uploader.h

@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink-idl.h"
+
+extern const sd_varlink_interface vl_interface_io_systemd_Report_Uploader;