Self-transparent code update

[maxtropets]

The final item for #7401's self-transparency section.

TL;DR

• this's currently an optional add-on for MST use case only, so the w-flow below is MST use case
• operators can now set a code update policy
• policy is a fallback if host_data isn't allowed explicitly
• to update, operator register a signed statement for the security policy (host_data) in the target MST instance
• a transparent statement (SCITT-compliant) is provided by a joinee
• transparent statement is verified by primary, and only let through if the enclosed CCF receipt(s) is self-signed

Don't forget before merging

• add a changelog entry

[Copilot]

Pull request overview

This PR implements self-transparent code updates for CCF's MST (Multi-party Secure Transparency) use case. It enables operators to set a JavaScript-based code update policy that validates transparent statements (SCITT-compliant COSE envelopes) containing self-signed CCF receipts. When a node attempts to join with untrusted host_data, the system can fall back to verifying a transparent statement that proves the code was registered in a trusted transparency log (the CCF service itself).

Changes:

• Adds infrastructure for transparent code update policy stored in KV and evaluated via JavaScript
• Introduces transparent statement verification that validates COSE signatures, DID:x509 issuer resolution, and self-issued CCF receipts
• Extends node join protocol to accept optional code_transparent_statement_path configuration
• Adds sample application endpoints for registering and retrieving transparent statements with embedded receipts

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
tests/infra/remote.py	Adds code_transparent_statement_path parameter to test infrastructure
tests/infra/node.py	Propagates code_transparent_statement_path to node setup
tests/infra/network.py	Adds code_transparent_statement_path to network configuration
tests/infra/consortium.py	Adds governance methods for setting/removing code update policy
tests/config.jinja	Adds conditional code_transparent_statement_path to join config
tests/code_update.py	Implements comprehensive test for code update policy feature (but comments out all existing tests)
src/node/rpc/*.h	Extends verify_quote interface to accept code_transparent_statement and network_identity_subsystem
src/node/quote.cpp	Implements verify_code_transparent_statement with signature, policy, and receipt verification
src/node/js_policy.h	New file implementing JavaScript policy evaluation for code updates
src/node/cose_common.h	Refactors CWT claims structure, adds Sign1ProtectedHeader and decode functions
src/crypto/cose_utils.h	Extracts parse_x5chain utility for reuse across codebase
src/host/*.cpp/.h	Adds code_transparent_statement_path configuration support
samples/apps/logging/logging.cpp	Adds endpoints for registering and retrieving transparent statements
samples/constitutions/default/actions.js	Adds governance actions for code update policy management
include/ccf/service/tables/code_update_policy.h	New table definition for code update policy storage
include/ccf/node/*.h	Updates startup config and quote verification interface
doc/schemas/*.json	Updates OpenAPI and host config schemas

[Copilot]

Pull request overview

Copilot reviewed 37 out of 37 changed files in this pull request and generated 5 comments.