bump rcgen to 0.14.2

[Bravo555]

Proposed changes

Recent versions of rcgen contain nice features, so I decided to bump the crate and fix all breaking changes first before our usage of it is expanded by the pkcs11 create key PR.

Relevant features:

• 0.13.0
  • P521 support
  • The API used to create/issue key pairs, certificates, certificate signing requests (CSRs), and certificate revocation lists (CRLs) has been restructured to emphasize consistency and avoid common errors with serialization. (better to fix breaking changes ASAP)
  • Support for using aws-lc-rs in fips mode
• 0.13.1
  • Several improvements to the capabilities available when working with certificate signing requests
    • Enable signing without private key
• 0.14.0
  • better remote signing API (RemoteKeyPair changed to SigningKey)

Also we'd like to move from RSA PKCS#1 v1.5, which is vulnerable to Marvin Attack to RSA PSS signatures for signing the CSRs, which new versions of rcgen may add in the future.

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
• Documentation Update (if none of the other choices apply)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

Checklist

• I have read the CONTRIBUTING doc
• I have signed the CLA (in all commits with git commit -s. You can activate automatic signing by running just prepare-dev once)
• I ran just format as mentioned in CODING_GUIDELINES
• I used just check as mentioned in CODING_GUIDELINES
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Further comments

[codecov]

Codecov Report

Attention: Patch coverage is 80.19802% with 20 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/common/certificate/src/lib.rs	74.60%	10 Missing and 6 partials ⚠️
crates/core/tedge_agent/src/http_server/actor.rs	73.33%	0 Missing and 4 partials ⚠️

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Robot Results

✅ Passed	❌ Failed	⏭️ Skipped	Total	Pass %	⏱️ Duration
666	0	3	666	100	1h50m19.304957999s

[didier-wenzek]

Just to confirm.

Previously, the certificate was protected under Zeroizing. Now this protection has been narrowed under the signing_key in the case there is actually a private key in memory. This makes sense. However, can you confirm that, with version 0.14, rcgen::Certificate no more contains data to zeroize on drop?

[Bravo555]

Indeed, wrapping rcgen::Certificate with Zeroizing<> generates the following error:

error[E0277]: the trait bound `rcgen::Certificate: zeroize::DefaultIsZeroes` is not satisfied
   --> crates/common/certificate/src/lib.rs:250:18
    |
250 |     certificate: Zeroizing<rcgen::Certificate>,
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `zeroize::DefaultIsZeroes` is not implemented for `rcgen::Certificate`
    |

And in 0.14 only rcgen::KeyPair implements Zeroize, which makes sense because it's the only thing holding sensitive data.

[didier-wenzek]

Approved