browser extension for enclave verification

[brenzi]

timeboxed: explore using substrate-connect/smoldot

observations:

• substrate-connect CAN support parachains : support custom parachain network paritytech/substrate-connect#1520
  • yarn dev:demo will sync the asset hub on westend in the browser (without using extension)

• for clarification of substrate-connect
  • smoldot is the lightclient
  • substrate-connect is the js wrapper for smoldot for web pages
  • substrate-connect also ships a browser extension: the goal is that the state of the light client db can be used across different dapps/webpages with low latency. the extension is no standalone light client. it's just a cache for block headers. it needs a dapp page to sync. For our enclave case where the user visits the enclave https server directly, that's not optimal, because the enclave would need to serve the dapp. possible, but not sure if that makes sense
• promising, to get TLS certificate info (firefox >62 only, incl android): https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/getSecurityInfo
  • example: https://github.com/mdn/webextensions-examples/tree/main/root-cert-stats
  • only works with this fix: Broken root-cert-stats due to var -> let change mdn/webextensions-examples#536
• Challenge: the extension can only get the info if the browser accepts the certificate, so we can't use self-signed as now, but we'd need at least let's encrypt certificates for the enclave (where the enclave signing key has to be the pubkey for the certificate