Remove dependency on SD/SPIFFS from CertStore (#4760)

Due to popular demand, remove the hardcoded dependency on SPIFFS
or SD from the CertStore by factoring out the file interface into
a new class (CertStoreFile) that the user will need to implement
as a thin wrapper around either a SPIFFS.file or a SD.file

Combine the downloaded certificates into a UNIX "ar" archive
and parse that on-the-fly to allow easy inspection and creation
of the Cert Store database.

Examples updated with a new certificate downloader that creates
the certs.ar archive and with a single sample that can be built
for either SPIFFS or SD with a #define.  Users can copy the
implementation of the CertStoreFile they need to their own code
as it is self-contained.

Also move the CertStore to the BearSSL namespace and remove the
suffix and separate SPIFFS/SD sources.

Remove the "deep+" change from the CI build as well (no special
options needed on any PIO or makefile build).

We'll revisit the filesystem wrapper for 2.5.0, hopefully having a
unified template for both filesystem usage at a global level.  For
current users, be aware the interface may change (simplify!) in
release 2.5.0.

Fixes #4740

libraries/ESP8266WiFi/src/CertStoreBearSSL.h

@@ -21,40 +21,69 @@
 #define _CERTSTORE_BEARSSL_H
 
 #include <Arduino.h>
+#include <BearSSLHelpers.h>
 #include <bearssl/bearssl.h>
 
-// Virtual base class for the certificate stores, which allow use
+// Base class for the certificate stores, which allow use
 // of a large set of certificates stored on SPIFFS of SD card to
 // be dynamically used when validating a X509 certificate
 
-// Templates for child classes not possible due to the difference in SD
-// and FS in terms of directory parsing and interating.  Dir doesn't
-// exist in SD, everything is a file (which might support get-next-entry()
-// or not).
+namespace BearSSL {
 
-// This class should not be instantiated directly, only via its children.
-class CertStoreBearSSL {
+// Subclass this and provide virtual functions appropriate for your storage.
+// Required because there are conflicting definitions for a "File" in the
+// Arduino setup, and there is no simple way to work around the minor
+// differences.
+// See the examples for implementations to use in your own code.
+//
+// NOTE: This virtual class may migrate to a templated model in a future
+// release.  Expect some changes to the interface, no matter what, as the
+// SD and SPIFFS filesystem get unified.
+class CertStoreFile {
   public:
-    CertStoreBearSSL() {}
-    virtual ~CertStoreBearSSL() {}
+    CertStoreFile() {};
+    virtual ~CertStoreFile() {};
 
-    // Preprocess the certs from the flash, returns number parsed
-    virtual int initCertStore(const char *dir) = 0;
+    // The main API
+    virtual bool open(bool write=false) = 0;
+    virtual bool seek(size_t absolute_pos) = 0;
+    virtual ssize_t read(void *dest, size_t bytes) = 0;
+    virtual ssize_t write(void *dest, size_t bytes) = 0;
+    virtual void close() = 0;
+};
+
+
+class CertStore {
+  public:
+    CertStore() { };
+    ~CertStore() { };
+
+    // Set the file interface instances, do preprocessing
+    int initCertStore(CertStoreFile *index, CertStoreFile *data);
 
     // Installs the cert store into the X509 decoder (normally via static function callbacks)
-    virtual void installCertStore(br_x509_minimal_context *ctx) = 0;
+    void installCertStore(br_x509_minimal_context *ctx);
 
   protected:
-    // The binary format of the pre-computed file
+    CertStoreFile *_index = nullptr;
+    CertStoreFile *_data = nullptr;
+    BearSSLX509List *_x509 = nullptr;
+
+    // These need to be static as they are callbacks from BearSSL C code
+    static const br_x509_trust_anchor *findHashedTA(void *ctx, void *hashed_dn, size_t len);
+    static void freeHashedTA(void *ctx, const br_x509_trust_anchor *ta);
+
+    // The binary format of the index file
     class CertInfo {
     public:
       uint8_t sha256[32];
-      char    fname[64];
+      uint32_t offset;
+      uint32_t length;
     };
+    static CertInfo _preprocessCert(uint32_t length, uint32_t offset, const void *raw);
+
+};
 
-    CertInfo preprocessCert(const char *fname, const void *raw, size_t sz);
-    static br_x509_trust_anchor *makeTrustAnchor(const void *der, size_t der_len, const CertInfo *ci);
-    static void freeTrustAnchor(const br_x509_trust_anchor *ta);
 };
 
 #endif