feat(agent): device identity enrollment and channel

.github/workflows/ci.yml

@@ -337,6 +337,14 @@ jobs:
         env:
           AWS_LC_SYS_NO_ASM: true
 
+      - name: Root-only tests
+        if: ${{ matrix.os == 'linux' }}
+        # Cargo builds as the runner user and runs only the test binary as root, so no build output is owned by root.
+        # UNTESTED: the test binary runs as root.
+        # A root-only test run without root skips and passes, so after changing this step, check that its log has no SKIP line.
+        run: |
+          cargo test --locked --target ${{ matrix.target }} --config "target.${{ matrix.target }}.runner='sudo'" -p device-key --lib root_only_
+
       - name: Show sccache stats
         if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
         shell: pwsh
@@ -1341,6 +1349,28 @@ jobs:
         run: dotnet test utils/dotnet/GatewayUtils.sln
         shell: pwsh
 
+      - name: Build agent channel package
+        run: ./crates/agent-channel-proto/dotnet/build.ps1
+        shell: pwsh
+
+  agent-identity-vectors:
+    name: Agent Identity test vectors
+    runs-on: ubuntu-latest
+    needs: [preflight]
+
+    steps:
+      - name: Checkout ${{ github.repository }}
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+
+      # The vectors are recomputed with an independent library, so that an error in them can't pass into every implementation that agrees with them.
+      - name: Verify the vectors
+        run: |
+          python3 -m venv "$RUNNER_TEMP/vectors"
+          "$RUNNER_TEMP/vectors/bin/pip" install --quiet --disable-pip-version-check cryptography==50.0.2
+          "$RUNNER_TEMP/vectors/bin/python" -I docs/agent-identity/verify_vectors.py
+          "$RUNNER_TEMP/vectors/bin/python" -I docs/agent-identity/verify_vectors.py --self-test
   agent-installer-event-log-tests:
     name: Agent installer Event Log lifecycle tests
     runs-on: windows-2022
@@ -1617,7 +1647,7 @@ jobs:
   success:
     name: Success
     if: ${{ always() }}
-    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, oracle-markers, oracle-markers-tests, skill-links, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, gateway-service-account-tests, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, agent-installer-event-log-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
+    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, oracle-markers, oracle-markers-tests, skill-links, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, gateway-service-account-tests, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, agent-identity-vectors, agent-installer-event-log-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-libraries.yml

@@ -40,7 +40,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        library: [ dotnet-client, dotnet-subscriber, utils, pedm-dotnet-client ]
+        library: [ dotnet-client, dotnet-subscriber, utils, pedm-dotnet-client, agent-channel ]
         include:
           - library: dotnet-client
             libpath: ./devolutions-gateway/openapi/dotnet-client
@@ -50,6 +50,8 @@ jobs:
             libpath: ./utils/dotnet
           - library: pedm-dotnet-client
             libpath: ./crates/devolutions-pedm/openapi/dotnet-client
+          - library: agent-channel
+            libpath: ./crates/agent-channel-proto/dotnet
 
     steps:
       - name: Check out ${{ github.repository }}