metropolis/test: create swtpm TPMs at runtime instead of compile time
The generated TPM data is random (it contains generated cryptographic
keys) so we really shouldn't be building it with Bazel.
Instead, let's create it at runtime for e2e tests, and also actually
generate separate TPM data per node with a common issuer for all.
Moving the logic out of //metropolis/node also feels deserved, as this
is all squarely in test territory.
Change-Id: I257ee54c88ede685ba3faf573282b0f9228b10e8
Reviewed-on: https://review.monogon.dev/c/monogon/+/3132
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/test/launch/cluster/BUILD.bazel b/metropolis/test/launch/cluster/BUILD.bazel
index 89f7a7a..efa04cb 100644
--- a/metropolis/test/launch/cluster/BUILD.bazel
+++ b/metropolis/test/launch/cluster/BUILD.bazel
@@ -7,15 +7,19 @@
"insecure_key.go",
"metroctl.go",
"prefixed_stdio.go",
+ "swtpm.go",
],
data = [
"//metropolis/node:image",
- "//metropolis/node:swtpm_data",
"//metropolis/test/ktest:linux-testing",
"//metropolis/test/nanoswitch:initramfs",
+ "//metropolis/test/swtpm/certtool",
+ "//metropolis/test/swtpm/swtpm_cert",
"//third_party/edk2:firmware",
"@com_github_bonzini_qboot//:qboot-bin",
"@swtpm",
+ "@swtpm//:swtpm_localca",
+ "@swtpm//:swtpm_setup",
],
importpath = "source.monogon.dev/metropolis/test/launch/cluster",
visibility = ["//visibility:public"],