mtca: add sequencing

This is a partial implementation: it doesn't really write to tile storage,
or calculate realistic hashes.

In Loop(), take the current contents of the pool, "sequence" them by increasing
the tree size and generating a fake root hash randomly, and write a new
checkpoint row.

Add a new table, `latestCheckpoints`. This has a single row per log, referring
to the latest checkpoint. This allows us to take an exclusive lock while signing
to prevent signing split views.

Author: jsha

.gitignore

@@ -55,3 +55,4 @@ test/secrets/mtpublisher_dburl
 test/secrets/revoker_dburl
 test/secrets/sa_dburl
 test/secrets/sa_ro_dburl
+test/secrets/mtca1_dburl

cmd/boulder-mtca/main.go

@@ -4,12 +4,16 @@ package notmain
 
 import (
 	"context"
+	"database/sql"
+	"errors"
 	"flag"
 	"os"
 
 	"github.com/jmhodges/clock"
 
+	"github.com/letsencrypt/borp"
 	"github.com/letsencrypt/boulder/cmd"
+	"github.com/letsencrypt/boulder/config"
 	bgrpc "github.com/letsencrypt/boulder/grpc"
 	"github.com/letsencrypt/boulder/issuance"
 	mtca "github.com/letsencrypt/boulder/mtca"
@@ -22,12 +26,17 @@ type Config struct {
 
 		GRPCMTCA *cmd.GRPCServerConfig
 
+		DB cmd.DBConfig
+
 		// Issuer holds the configuration for a single MTCA instance with a single mtcaID.
 		// We run a separate process for each issuer.
 		// TODO: the issuance package parses the CA certificate as a self-signed X.509
 		// certificate, but per MTC draft, a CA SHOULD be represented by an RFC 9925
 		// unsigned certificate: https://www.rfc-editor.org/rfc/rfc9925.html.
 		Issuer issuance.IssuerConfig
+
+		// SequencingPeriod controls how frequently the MTCA sequences a batch and signs a checkpoint.
+		SequencingPeriod config.Duration `validate:"required"`
 	}
 
 	Syslog        cmd.SyslogConfig
@@ -38,6 +47,9 @@ func main() {
 	grpcAddr := flag.String("addr", "", "gRPC listen address override")
 	debugAddr := flag.String("debug-addr", "", "Debug server address override")
 	configFile := flag.String("config", "", "File path to the configuration file for this service")
+	initLog := flag.Bool("init-log", false, "Initialize log metadata in the database and exit")
+	initLogForTest := flag.Bool("init-log-for-test", false, "For testing: initialize log metadata if not already initialized, then serve")
+
 	flag.Parse()
 	if *configFile == "" {
 		flag.Usage()
@@ -67,14 +79,39 @@ func main() {
 	issuer, err := issuance.LoadIssuer(c.MTCA.Issuer, clk)
 	cmd.FailOnError(err, "Loading issuer")
 
-	mtcaImpl := mtca.New(issuer)
+	url, err := c.MTCA.DB.URL()
+	cmd.FailOnError(err, "Reading DB URL")
+	db, err := sql.Open("mysql", url)
+	cmd.FailOnError(err, "Opening DB")
+	dbMap := &borp.DbMap{Db: db, Dialect: borp.MySQLDialect{}}
+
+	mtcaImpl, err := mtca.New(issuer, dbMap, logger)
+	cmd.FailOnError(err, "Building MTCA")
+
+	if *initLog {
+		err = mtcaImpl.InitLog(context.Background())
+		cmd.FailOnError(err, "Initializing log")
+		return
+	}
+	if *initLogForTest {
+		err = mtcaImpl.InitLog(context.Background())
+		if err != nil && !errors.Is(err, mtca.ErrIssuanceLogAlreadyInitialized) {
+			cmd.FailOnError(err, "Initializing MTC log DB for test")
+		}
+	}
 
 	srv := bgrpc.NewServer(c.MTCA.GRPCMTCA, logger).Add(
 		&mtcapb.MTCA_ServiceDesc, mtcaImpl)
 
 	start, err := srv.Build(tlsConfig, scope, clk)
 	cmd.FailOnError(err, "Unable to setup MTCA gRPC server")
 
+	ctx, cancel := context.WithCancel(context.Background())
+	// Cancel will be called after start() returns, which happens after GracefulStop() returns.
+	// That means all inflight RPCs will be done, which means the last of the pool has been sequenced.
+	defer cancel()
+	go mtcaImpl.Loop(ctx, c.MTCA.SequencingPeriod.Duration)
+
 	cmd.FailOnError(start(), "MTCA gRPC service failed")
 }