feat(cli): support inline CA certificates in gRPC connections

Store CA certificate content (base64-encoded) in config instead of file
paths, enabling portable configurations across environments. The gRPC
connection layer now accepts CA content directly via WithCAContent option.

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

app/cli/cmd/config_save.go

@@ -29,6 +29,9 @@ func newConfigSaveCmd() *cobra.Command {
 			skipActionOptsInit: trueString,
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
+			// Process CA flags - read file contents and encode to base64 if needed
+			processCAFlag(confOptions.controlplaneCA)
+			processCAFlag(confOptions.CASCA)
 			return viper.WriteConfig()
 		},
 	}

app/cli/cmd/root.go

@@ -18,6 +18,7 @@ package cmd
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"os"
@@ -123,8 +124,13 @@ func NewRootCmd(l zerolog.Logger) *cobra.Command {
 				grpcconn.WithInsecure(apiInsecure()),
 			}
 
-			if caFilePath := viper.GetString(confOptions.controlplaneCA.viperKey); caFilePath != "" {
-				opts = append(opts, grpcconn.WithCAFile(caFilePath))
+			if caValue := viper.GetString(confOptions.controlplaneCA.viperKey); caValue != "" {
+				// Check if it's a file path or base64/PEM content
+				if grpcconn.IsFilePath(caValue) {
+					opts = append(opts, grpcconn.WithCAFile(caValue))
+				} else {
+					opts = append(opts, grpcconn.WithCAContent(caValue))
+				}
 			}
 
 			controlplaneURL := viper.GetString(confOptions.controlplaneAPI.viperKey)
@@ -495,3 +501,25 @@ func isAPITokenPreferred(cmd *cobra.Command) bool {
 func getConfigDir(appName string) string {
 	return filepath.Join(xdg.ConfigHome, appName)
 }
+
+// processCAFlag reads CA file content and encodes it to base64 if value is a file path
+func processCAFlag(opt *confOpt) {
+	value := viper.GetString(opt.viperKey)
+	if value == "" {
+		return
+	}
+
+	// If it's a file path, read and encode
+	if grpcconn.IsFilePath(value) {
+		content, err := os.ReadFile(value)
+		if err != nil {
+			// Log warning but don't fail
+			logger.Warn().Err(err).Str("file", value).Msg("Failed to read CA file")
+			return
+		}
+
+		// Store base64-encoded content in viper (will be persisted by config save)
+		encoded := base64.StdEncoding.EncodeToString(content)
+		viper.Set(opt.viperKey, encoded)
+	}
+}

app/cli/pkg/action/action.go

@@ -142,7 +142,12 @@ func getCASBackend(ctx context.Context, client pb.AttestationServiceClient, work
 
 	opts := []grpcconn.Option{grpcconn.WithInsecure(casConnectionInsecure)}
 	if casCAPath != "" {
-		opts = append(opts, grpcconn.WithCAFile(casCAPath))
+		// Check if it's a file path or base64/PEM content
+		if grpcconn.IsFilePath(casCAPath) {
+			opts = append(opts, grpcconn.WithCAFile(casCAPath))
+		} else {
+			opts = append(opts, grpcconn.WithCAContent(casCAPath))
+		}
 	}
 
 	artifactCASConn, err := grpcconn.New(casURI, result.Token, opts...)

pkg/grpcconn/grpcconn.go

@@ -18,8 +18,10 @@ package grpcconn
 import (
 	"context"
 	"crypto/x509"
+	"encoding/base64"
 	"fmt"
 	"os"
+	"strings"
 
 	grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/retry"
 	"google.golang.org/grpc"
@@ -29,6 +31,7 @@ import (
 
 type newOptionalArg struct {
 	caFilePath string
+	caContent  string
 	insecure   bool
 	orgName    string
 }
@@ -41,6 +44,13 @@ func WithCAFile(caFilePath string) Option {
 	}
 }
 
+// WithCAContent sets the CA certificate content (PEM format or base64-encoded)
+func WithCAContent(content string) Option {
+	return func(opt *newOptionalArg) {
+		opt.caContent = content
+	}
+}
+
 func WithInsecure(insecure bool) Option {
 	return func(opt *newOptionalArg) {
 		opt.insecure = insecure
@@ -83,7 +93,13 @@ func New(uri, authToken string, opt ...Option) (*grpc.ClientConn, error) {
 			return nil, err
 		}
 
-		if optionalArgs.caFilePath != "" {
+		// Load CA from content if provided (takes precedence)
+		if optionalArgs.caContent != "" {
+			if err = appendCAFromContent(optionalArgs.caContent, certsPool); err != nil {
+				return nil, fmt.Errorf("failed to load CA from content: %w", err)
+			}
+		} else if optionalArgs.caFilePath != "" {
+			// Fallback to file path for backward compatibility
 			if err = appendCAFromFile(optionalArgs.caFilePath, certsPool); err != nil {
 				return nil, fmt.Errorf("failed to load CA cert: %w", err)
 			}
@@ -116,6 +132,27 @@ func appendCAFromFile(path string, certsPool *x509.CertPool) error {
 	return nil
 }
 
+func appendCAFromContent(content string, certsPool *x509.CertPool) error {
+	var pemContent []byte
+
+	// Try to decode as base64 first
+	decoded, err := base64.StdEncoding.DecodeString(content)
+	if err == nil && len(decoded) > 0 {
+		// Successfully decoded as base64
+		pemContent = decoded
+	} else {
+		// Not base64, assume it's PEM content directly
+		pemContent = []byte(content)
+	}
+
+	// Append to cert pool
+	if ok := certsPool.AppendCertsFromPEM(pemContent); !ok {
+		return fmt.Errorf("failed to append CA cert to pool")
+	}
+
+	return nil
+}
+
 type tokenAuth struct {
 	token    string
 	insecure bool
@@ -140,3 +177,30 @@ func (t tokenAuth) GetRequestMetadata(_ context.Context, _ ...string) (map[strin
 func (t tokenAuth) RequireTransportSecurity() bool {
 	return !t.insecure
 }
+
+// IsFilePath checks if a value looks like a file path (vs base64/PEM content).
+// It returns true if the value appears to be a file path, false if it appears to be content.
+func IsFilePath(value string) bool {
+	// Check if value looks like a file path
+	// If it starts with /, ./, ../, or ~/, it's a path
+	// If it contains a newline, it's likely PEM content
+	// If it's valid base64 without path separators, assume it's content
+
+	if strings.HasPrefix(value, "/") ||
+		strings.HasPrefix(value, "./") ||
+		strings.HasPrefix(value, "../") ||
+		strings.HasPrefix(value, "~/") {
+		return true
+	}
+
+	if strings.Contains(value, "\n") {
+		return false // PEM content
+	}
+
+	// Check if file exists
+	if _, err := os.Stat(value); err == nil {
+		return true
+	}
+
+	return false
+}