Integration coverage for TPM attestation

[jsnctl]

SPIRE makes use of a TPM simulator (https://github.com/spiffe/spire/blob/main/test/tpmsimulator/simulator.go) for whitebox unit testing of the tpm_devid plugin. This is useful as it provides an ephemeral TPM fake that runs quickly with the test suite and covers both attestation and session management primitives.

However, this is limited to the tpm_devid plugin only and does not exercise the SPIFFE external plugin spire-tpm-plugin (or any plugins that might be added in the future).

There's also something of a maintenance burden on having our own TPM2.0 compliant simulator (although perhaps this isn't a huge problem given the likely operations the Agent uses).

An improvement here could be to begin to add test coverage at the integration level by using a software TPM - something like swtpm. This is an approach used by TPM-centric projects like Keylime, and e.g. library code for TPM2.0 bindings in Rust.

Happy to contribute with this, but wanted to raise for opinions before submitting any diff

[sorindumitru]

Thanks @jsnctl for bringing this up. We would welcome a contribution to replace our home grown TPM simulator with a better supported software TPM.