store keys as pem instead of s-expression

[hannesm]

Dear valued opam-health-check authors and maintainers,

thanks to @reynir mirage/mirage-crypto#208 (comment) I got aware that your application uses the "convert a RSA key to s-expression" from mirage-crypto-pk. Now, this is a feature we'd like to remove from the next version.

What this PR provides is a possible migration. I'm not sure how opam-health-check is deployed and how the key material is generated / copied / provided.

What this PR does:

• on the key generation and writing of key files, it uses PEM (PKCS8) instead of s-expressions
• on the key reading (decoding) side, it first tries to decode as s-expression and if that fails as PEM

Now, depending on the deployment and desired use, of course there can as well be a utility that goes through the key directory (on the server) and convert all from s-expression to pem. But are keys actually copied around to client machines and used there? If yes, these of course should as well be updated / converted.

Please let me know what you think about a migration. I start this PR and discussion early that you have the least trouble once the next mirage-crypto release is done.

Thanks for reading.

[mtelvers]

Thank you for opening this PR. The distribution of these keys is very limited; we could regenerate new keys in PEM format or do a one-time conversion of the keys from s-expression to PEM. Opam-health-check can be updated to expect PEM format keys only.

let () =
  let key = Mirage_crypto_pk.Rsa.priv_of_sexp (Sexplib.Sexp.load_sexp Sys.argv.(1)) in
  let key_pem = X509.Private_key.encode_pem (`RSA key) in
  let pem = Cstruct.to_string key_pem in
  let oc = open_out Sys.argv.(1) in
  Printf.fprintf oc "%s" pem;
  close_out oc;

[hannesm]

Thanks @mtelvers, indeed your migration code should mostly work -- I'd open a second file for writing and then move the second to the first to avoid truncation / power failure inconsistency / thinking about failure mode when the new stuff to be written is smaller than the old stuff that was in the file...