Add support for loading and verifying signed Wasm modules.

[PiotrSikora]

Signed-off-by: Piotr Sikora [email protected]

[PiotrSikora]

cc @asraa

[mathetake]

can this be runtime-agnostic, or is there any V8-specific stuff here?

[mathetake]

This would add openssl dependency on proxy-wasm-cpp-host and I see that the logc can be runtime-agnostic by only using getCustomSection, so I would suggest that we move this logic to Envoy side. WDYT?

[mathetake]

at least I would like to have tests for this feature here.

[PiotrSikora]

This would add openssl dependency on proxy-wasm-cpp-host

We already have that dependency (in exports, for WASI random).

I see that the logc can be runtime-agnostic by only using getCustomSection

This is indeed runtime-agnostic, and it shoudn't be here.

Unfortunately, we have a lot of code duplication and runtime-agnostic code in runtime-specific implementations. At the very least, all bytecode parsing (getCustomSection, getStrippedSource, buildFunctionNameIndex), logic around precompiled modules and now this signature verification should be extracted to common utils.

Filled: #148

so I would suggest that we move this logic to Envoy side. WDYT?

There is absolutely no reason for this code to live in Envoy, which doesn't operate on the Wasm bytecode.

at least I would like to have tests for this feature here.

Agreed.

Note that this is mostly me "throwing the code over the wall", so that @asraa can use it as a base to implement this feature end-to-end in Envoy (including trusted public key configuration over xDS vs embedded in the binary at build-time as in this PR), so it's not expected to stay this way.

We can also wait until #148 is fixed before merging this.

[mathetake]

Right. Thanks for clarifying!

[PiotrSikora]

can this be runtime-agnostic, or is there any V8-specific stuff here?

Done, PTAL.

[mathetake]

Do you mind adding tests? 🙏

[PiotrSikora]

Do you mind adding tests? 🙏

I've made tests, but they require a new Rust tool for generating signatures, so I had to split Rust updates into #163, otherwise the PR was dominated by unrelated changes. Once that PR is merged, I'm going to push tests.

[mathetake]

Makes sense, thanks! let me have a look at 163.

[mathetake]

just merged #163 :)

[PiotrSikora]

@mathetake tests added and passed, PTAL.

[mathetake]

thanks!