Allow remote input of policy

[alexandref75]

Allowing remote download of a policy in a empty (not configured) Veracruz simplifies the use of Veracruz in the cloud.

[dominic-mulligan-arm]

So, thinking of the provisioning process, we would have something like:

1. The Veracruz instance is brought up on the host's machine.
2. At a later date, the policy is provided by somebody.
3. The program and data providers, specified by the policy provided above, can now provision their secrets.

But: in step (2) above, is there any need to constrain who can supply the policy? I suppose in the case where everybody can query the policy in force by contacting the Veracruz runtime there's strictly no need for that. However, this introduces a requirement for more communication between participants and runtime during the provisioning process (and another opportunity for a participant to back out of the computation, if they think something is amiss, again complicating the provisioning flow). An alternative would be to split the policy into "early configuration" and "late configuration". Then:

1. The Veracruz instance is brought up on the host's machine, using a minimal policy that consists only of "early configuration" options, namely details of who exactly is allowed to provide the rest of the policy,
2. The policy provider, as specified above, then provides the "late configuration" options, filling in the rest of the policy. In particular, they specify who can contribute data inputs and the program,
3. The program and data providers, specified by the policy provided above, can now provision their secrets.

What do you think, @alexandref75?

[alexandref75]

@dominic-mulligan-arm The solution is interesting but it implies that we would have a policy for loading the final policy. We should have better names since I assume that policies are immutable after loaded and now we have 2 separate policies.

[dominic-mulligan-arm]

Yes, I agree that "policy" is not a good term, and it's arguably the case that it was never a good term given how overloaded that phrase is. How about "early parameters" and "late parameters". The "early parameters" specify who can provide the "late parameters", which describe in turn who can provide the data and program.

[alexandref75]

Coming from outside I do not see calling Veracruz configuration as policy confusing. Maybe a suggestion is using two different names. One defines who (if remote) is authorized and from where the second (what we call Veracruz policy now) can be obtained.