Policy-server cannot run `verify-image-signature` policy

[flavio]

Is there an existing issue for this?

• [X] I have searched the existing issues

Current Behavior

Under certain configurations policy-server/kwctl are not able to execute the verify-image-signatures policy.

The policy execution causes a runtime error.

More details about the failure matrix below

Expected Behavior

Policy execution doesn't cause issues

Steps To Reproduce

To keep things simple, these steps rely on kwctl

1. Use kwcl (see below for details about the version to use)
2. Checkout verify-image-signature source code
3. Switch to the appropriate version of verify-signature-images (see below for details)
4. make clean && make e2e-tests

Environment

This table describes the current state of working/non-working combinations.

Notes:

• VFI stands for verify-image-signatures
• Latest release of VFI is 0.2.8

Kubewarden version	VFI <= 0.2.8	VFI main
<= 1.6, 1.7.0-rc1	✅	❌
main	❌	✅

Anything else?

The issue is caused by a change done inside of the policy-sdk-rust repository, more specifically this commit.

The commit changes how the CertificateEncoding enum handles the certificate encoding used by the host capability v1/is_certificate_trusted.

A certificate object is defined in this way:

{
  # **mandatory**: Which encoding is used by the certificate
  # Either the string "Pem" or "Der".
  "encoding": string,
  # Actual certificate
  # The certificate is UTF-8 encoded.
  # It's an array of bytes of the unicode code pointers of a PEM/DER encoded
  # certificate string.
  "data": [byte(int), ..., byte(int)]
}

The change done to the rust SDK crate causes the code to expect the certificate encoding to be either pem or der (both lowercase). Older releases of this crate expected the values to be either Pem or Der. The rust SDK crate is used both by policy authors and by policy-server/kwctl (it's a transitive dependency of policy-evaluator).

The issue has been introduced starting from the 0.9.5 release of the Rust SDK, which is not yet consumed by any tagged release of policy-server/kwcl