fix: send_device_attestation yields challenge status

[christianhoelzl]

The pull request extends the function send_device_attestation. It yields the ChallengeStatus instead of an empty success result. This is useful to check if the attestation object was validated by the ACME CA immediately after sending the attestation object.

[djc]

LGTM -- is this from a spec change, or just a different kind of testing?

[christianhoelzl]

This is from a different kind of testing with a real CA (Step CA), not from a spec change.

[djc]

Okay. I think it would be good to add some testing for this stuff. In an ideal world, it would be nice to get support for this draft into Pebble -- do you think that's something that could be in scope for you?

[christianhoelzl]

Tough question. That could be in scope. I thought about automated testing for a while now and there a some options:

• One is to extend Pebble (as device-attest-01 is not in scope of Lets Encrypt, this might never become upstream).
• Another option is to extend instant-acme testing with Step CA (this is heavy).
• A third option is to have a basic Rust based ACME server in instant-acme (another huge effort).

[djc]

Forking Pebble doesn't seem appealing, I don't think adding a custom Rust-based ACME server would help if we build it.

Would be good if you can file an issue against Pebble to at least ask if they'd be open to supporting it (and linking that here).

[cpu]

As mentioned in https://github.com/djc/instant-acme/pull/255/changes#r2799709957 I think this is semver breaking, but I don't think it's worth bumping our minor version or leaving it broken. I suspect adoption is very low and provided we mark this stuff experimental it feels like the right-trade off to ignore semver and fix it.

[christianhoelzl]

To mark the device-attest as experimental, I could add a bullet "* Device attestation support is experimental" to the section Liminations in the README.md. Or better add this sentence to the struct DeviceAttestation and method send_device_attestation?

[cpu]

I like the idea of doing it both in README and in the related rustdoc of the types/functions.

[cpu]

Thanks, LGTM mod the rust fmt CI failure.