fix(initdata): harden cert validation and improve validate UX

[bpradipt]

Cert validation changes:

• Reject all non-CA certificates (CA:TRUE required for trust anchors); leaf certs with SAN+serverAuth were previously accepted in error
• Reject SHA-1 and MD5 signed certificates
• Reject RSA keys shorter than 1024 bits
• Reject certificates with unknown critical extensions
• Consolidate error message: validateCACert now emits the user-friendly "not a CA certificate" message directly; validateCerts removed (dead code)

validate command UX:

• Command now prints all diagnostics to stderr itself; Cobra error machinery is silenced surgically inside RunE (after flag parsing) so unknown-flag errors still print normally
• Exit code 0 = passed, 1 = validation failed or input error
• SilenceUsage on root command prevents usage block on operational errors

Test and fixture updates:

• Regenerate fixtures: valid-with-both.toml now uses two CA certs; valid-with-leaf-cert.toml replaced by invalid-leaf-cert.toml
• Add tests for SHA-1, MD5, weak RSA key, and unknown critical extensions
• Update validate tests to assert on stderr content

[Copilot]

Pull request overview

This PR tightens initdata embedded certificate validation to treat all embedded cert fields as trust anchors (CA-only), while also adjusting initdata validate CLI behavior to emit user-facing diagnostics directly and standardize exit codes. It also refreshes fixtures and tests to cover the new validation rules.

Changes:

• Enforce CA-only embedded certificate validation and reject weak/unsafe certificate properties (e.g., SHA-1/MD5, weak RSA keys, unknown critical extensions).
• Update initdata validate UX to print diagnostics itself and return consistent exit codes without Cobra duplicating error output.
• Regenerate/replace test fixtures and expand tests to assert on stderr and new rejection cases.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates documentation of initdata validation rules for embedded certificates.
cmd/root.go	Sets root Cobra command SilenceUsage to avoid usage dumps on operational errors.
cmd/initdata/validate.go	Adjusts validate command messaging/exit behavior and updates validation description text.
cmd/initdata/validate_test.go	Updates tests to capture/assert stderr output and new CA-only behavior.
cmd/initdata/common.go	Hardens CA certificate validation (weak sig algs, RSA size, critical extensions) and removes leaf-cert validation logic.
cmd/initdata/common_test.go	Reworks tests to reflect CA-only rules and adds coverage for newly rejected cert properties.
cmd/initdata/testdata/valid-with-leaf-cert.toml	Removes fixture that previously (incorrectly) treated a leaf cert as valid.
cmd/initdata/testdata/valid-with-ca-cert.toml	Regenerates CA fixture certificate material.
cmd/initdata/testdata/valid-with-both.toml	Updates fixture to use CA certs in both embedded cert positions.
cmd/initdata/testdata/invalid-leaf-no-san.toml	Regenerates invalid leaf fixture certificate material.
cmd/initdata/testdata/invalid-leaf-cert.toml	Adds new fixture representing a “well-formed” leaf cert that must now be rejected.
cmd/initdata/testdata/invalid-expired-cert.toml	Regenerates expired cert fixture material.
cmd/initdata/testdata/gen/main.go	Updates fixture generator to produce two CA certs and the new leaf-invalid fixture.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

cmd/initdata/common.go:178

• validateCertsBySource returns an error prefixed with "cert validation failed:\n ...". Since runValidate already prints its own "Validation failed:" header and then prints each failure line, this produces redundant headers and awkward indentation for multi-line cert errors. Consider having validateCertsBySource return just the per-cert diagnostics (without its own "cert validation failed" wrapper), or return a slice/typed error so runValidate can format consistently.

// validateCertsBySource applies CA certificate rules to each embedded cert and
// includes the source field in error messages so the user can locate the
// problematic cert. All initdata cert fields are trust anchor positions —
// only CA certificates (CA:TRUE, keyCertSign) are accepted.
func validateCertsBySource(entries []certEntry) error {
	var errs []string
	for _, e := range entries {
		if err := validateCACert(e.cert); err != nil {
			errs = append(errs, fmt.Sprintf("%s: %s", e.source, err.Error()))
		}
	}
	if len(errs) > 0 {
		return fmt.Errorf("cert validation failed:\n  %s", strings.Join(errs, "\n  "))
	}