tpmdevid

Overview ¶

Provisions a software TPM (swtpm) with the credentials the tpm_devid nodeattestor expects, and writes them where the agent and server configs point.

It mirrors what test/tpmsimulator does for the unit tests, but drives a real TPM over a socket instead of an in-process simulator, so the integration suite exercises the same code path an operator would. The templates and the NV index are taken from SPIRE itself rather than restated here: the agent regenerates the endorsement key from client.DefaultEKTemplateRSA() and reads its certificate from tpmutil.EKCertificateHandleRSA at attestation time, so anything provisioned under different parameters would fail to attest.

Usage:

go run provision.go -tpm-socket <path> -agent-dir <dir> -server-dir <dir>