Cannot override DeviceAttestationVerifier in Darwin commissioning flow

[tcarmelveilleux]

Problem

The API surface for Darwin commissioning flows prevents passing a Device Attestation Verifier equivalent that would allow arbitrary policy checks, and allow aggregation/saving of the DAC cert chain and attestation elements/signature, which are needed to do an end-to-end attestation flow if the CA resides off the device (e.g. if running a custom fabric in a multi-fabric situation with app on iOS with Matter framework). Similarly, this prevents having rules that simplify the usage/trust of development device attesattion credentials in a given fabric, where additional rules or validations may be needed.

Proposed Solution

• Allow providing a protocol implementation that is equivalent to DeviceAttestationVerifier::VerifyAttestationInformation API surface, if the default policy is insufficient.

[bzbarsky-apple]

@anush-apple @woody-apple FYI.

[woody-apple]

@tcarmelveilleux Can you provide an example API that would fit the needs here?

[woody-apple]

@tcarmelveilleux Anything remaining here that's needed? If so, we can move back into 1.0.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[woody-apple]

@tcarmelveilleux I believe the API needed is now complete, and working, correct? Please re-open if needed.