sa: add schema for MTC operations

sa/db/00-create-databases.sql

@@ -2,3 +2,6 @@ CREATE DATABASE boulder_sa;
 CREATE DATABASE incidents_sa;
 CREATE DATABASE boulder_sa_next;
 CREATE DATABASE incidents_sa_next;
+
+-- ISRG(44947) dev-reserved(4) MTCA1(1) logs(0) 44
+CREATE DATABASE mtcmeta_44947_4_1_0_44;

sa/db/01-boulder_sa_next.sql

@@ -1,7 +1,7 @@
 -- For easy diffability, the main part of this schema
 -- should be identical with 01-boulder_sa.sql. Any differences
 -- for the "next" schema should be expressed as ALTER TABLE
--- commands at the end of the file.
+-- or CREATE TABLE commands at the end of the file.
 USE boulder_sa_next;
 
 CREATE TABLE `authz2` (
@@ -247,3 +247,10 @@ CREATE TABLE `serials` (
 ALTER TABLE `certificateStatus` DROP COLUMN `subscriberApproved`;
 ALTER TABLE `certificateStatus` DROP COLUMN `LockCol`;
 ALTER TABLE `revokedCertificates` ADD KEY `serial` (`serial`);
+
+ALTER TABLE `orders`
+  ADD COLUMN `isMTC` bool NOT NULL DEFAULT FALSE,
+  ADD COLUMN `mtcaID` varchar(255) DEFAULT NULL,
+  ADD COLUMN `mtcSerialNumber` bigint(20) unsigned DEFAULT NULL,
+  -- checkpointSubtreeID is a reference to the `checkpointSubtrees` table
+  ADD COLUMN `checkpointSubtreeID` bigint(20) DEFAULT NULL;

sa/db/01-mtca.sql

@@ -0,0 +1,40 @@
+USE mtcmeta_44947_4_1_0_44;
+
+CREATE TABLE `checkpoints` (
+    `id` bigint(20) NOT NULL AUTO_INCREMENT,
+    -- ASCII-format OID relative to 1.3.6.1.4.1
+    -- https://tlswg.org/tls-trust-anchor-ids/draft-ietf-tls-trust-anchor-ids.html#name-trust-anchor-identifiers
+    -- https://ietf-plants-wg.github.io/merkle-tree-certs/draft-ietf-plants-merkle-tree-certs.html#ca-ids
+    -- This is redundant with the database/keyspace name and will be used for extra checks to ensure
+    -- configuration errors can't result in using the wrong database/keyspace.
+    `mtcLogID` varchar(255) NOT NULL,
+    `mtcaSignature` mediumblob NOT NULL,
+    -- For simplicity we start out with a hardcoded assumption of one mirror signature,
+    -- the planned CQRP requirement. If requirements increase we can add more fields.
+    -- `mirrorID` is an ASCII-format OID relative to 1.3.6.1.4.1.
+    -- Note: these two fields start empty and are filled later.
+    `mirrorID` varchar(255),
+    `mirrorSignature` mediumblob,
+
+    -- Signed-over data: https://ietf-plants-wg.github.io/merkle-tree-certs/draft-ietf-plants-merkle-tree-certs.html#section-5.3.1
+    -- Note that `log_origin` and `cosigner_name` in the link above are derived from `mtcLogID` and `mirrorID` respectively.
+    -- Also, for checkpoint signatures start == 0 and end == tree size.
+    `treeSize` bigint(20) unsigned NOT NULL,
+    `rootHash` binary(32) NOT NULL,
+
+    `created` datetime DEFAULT current_timestamp(),
+    PRIMARY KEY (`id`),
+    KEY `mtcLogID_treeSize` (`mtcLogID`, `treeSize`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_general_ci;
+
+CREATE TABLE `landmarks` (
+    `id` bigint(20) NOT NULL AUTO_INCREMENT,
+    -- ASCII-format OID relative to 1.3.6.1.4.1
+    `mtcLogID` varchar(255) NOT NULL,
+    `landmarkNumber` bigint(20) unsigned NOT NULL,
+    `treeSize` bigint(20) unsigned NOT NULL,
+    `created` datetime DEFAULT current_timestamp(),
+    PRIMARY KEY (`id`),
+    KEY `mtcLogID_landmarkNumber` (`mtcLogID`, `landmarkNumber`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_general_ci;
+

sa/vtschema/boulder_sa_next/vschema.json

@@ -24,6 +24,9 @@
     "registrations": { "column_vindexes": [ { "column": "id", "name": "xxhash" } ] },
     "replacementOrders": { "column_vindexes": [ { "column": "serial", "name": "xxhash" } ] },
     "revokedCertificates": { "column_vindexes": [ { "column": "serial", "name": "xxhash" } ] },
-    "serials": { "column_vindexes": [ { "column": "serial", "name": "xxhash" } ] }
+    "serials": { "column_vindexes": [ { "column": "serial", "name": "xxhash" } ] },
+    "checkpoints": { "column_vindexes": [ { "column": "id", "name": "xxhash" } ] },
+    "checkpointSubtrees": { "column_vindexes": [ { "column": "id", "name": "xxhash" } ] },
+    "landmarks": { "column_vindexes": [ { "column": "id", "name": "xxhash" } ] }
   }
 }

sa/vtschema/mtcmeta_44947_4_1_0_44/vschema.json

@@ -0,0 +1,12 @@
+{
+  "sharded":true,
+  "vindexes": {
+    "xxhash": {
+      "type": "xxhash"
+    }
+  },
+  "tables": {
+    "checkpoints": { "column_vindexes": [ { "column": "id", "name": "xxhash" } ] },
+    "landmarks": { "column_vindexes": [ { "column": "id", "name": "xxhash" } ] }
+  }
+}