Service endorsements as COSE during DR

[maxtropets]

Return COSE service identity endorsements chain in historical TX receipts.

Tasks

Beta Give feedback

1. COSE-sign previous service key when DR finishes (UPD - actually, when DR is started, because that's where we store a new cert and a pointer to a prev one, I think it's the only valid option)
2. Include the endorsements chain in TxReceiptImpl
3. Update the receipts documentation (probably create a historical-smth page under Architecture block)

[maxtropets]

@achamayou @eddyashton, regarding the services with lots of DRs, shall we introduce a new request parameter to ask for the endorsements chain explicitly?

Possible options

• I want the full chain
• I want a shortened chain (not really sure how, create a chain digest or smth?, or counter-sign only the original service identity at the time of TX in question, as we do for current endorsements)
• I don't want a chain

[achamayou]

@maxtropets we can do, but the chain should only get substantial if you ask for receipts that are many DRs ago. If you ask for recent receipts, it'll still be short. Having an option to skip endorsements definitely makes sense, and an endpoint to just get the chain (or even the chain in a tx range).

Proposal:

GET /node/receipt | x-ms-ccf-txid: 5.578 => receipt + full chain
GET /node/receipt?asof=now | x-ms-ccf-txid: 5.578 => receipt + full chain
GET /node/receipt?asof=7.999 | x-ms-ccf-txid: 5.578 => receipt + chain from 5.578 to the latest identity as of 7.999
GET /node/receipt?asof=5.578 | x-ms-ccf-txid: 5.578 => receipt + no chain

[achamayou]

@maxtropets we should have an endpoint that takes a historical service identity, and returns the chain of endorsements up to the current service, if found, and a clear message otherwise. This will be useful for users who have large amounts of receipts, and want to quickly check/confirm that a new service endorses them.

We also want a CDDL schema of the endorsements, with an automatic test, and Merkle root chaining as discussed.