Linux machine with a real vTPM#

For the break-test rows that need an actual TPM character device rather than swtpm over TCP.

swtpm covers the TPM behaviour, but two things live in the kernel driver and cannot be reached through it: that /dev/tpmrm0 is the right device to open, and what happens when something else holds the raw /dev/tpm0. Both decide whether the agent coexists with the other software on a workstation, and neither fails in testing — they fail on the one machine that also runs a disk-encryption tool.

Bring it up#

curl -Lo /var/tmp/noble-cloud.img \
    https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
testbed/linux-vtpm/seed.sh               # renders user-data.template, writes the seed ISO
sudo virsh define testbed/linux-vtpm/domain.xml
sudo virsh start nac-vtpm

seed.sh takes the authorised key from $SSH_AUTHORIZED_KEY or from your own ~/.ssh/*.pub, because the repository is the wrong place for one: a key committed here is one person's login on every machine anybody builds from this tree. Run it as yourself — it asks for sudo only to put the ISO where libvirt reads it.

Run the suite against the real device#

go test -c -o /tmp/keystore.test ./internal/keystore
scp /tmp/keystore.test nac@<ip>:/tmp/
ssh nac@<ip> 'sudo NAC_TEST_TPM_DEVICE=/dev/tpmrm0 /tmp/keystore.test -test.v'

NAC_TEST_TPM_DEVICE makes the whole TPM suite use the real device instead of starting swtpm. Two tests still start their own software TPM regardless — the substituted-machine case and the EK stability check need a second, different TPM, and a machine only has one.