Add Certify example to the CI checks.

[Superhepper]

The certify example was not added to the CI checks in #599 because it could not be run without failing. It would be good if this could be corrected.

[mcr]

Yes, I noticed it is now failing with:
[2025-12-13T00:45:17Z ERROR tss_esapi::constants::property_tag] value = 303 did not match any PropertyTag.

it was working a few weeks ago. I'm using it has a reference for some other work, and I became convinced the RSA and Nist256 versions did not work. So I started inverstigating. I will bisect.

[mcr]

I have bisected back to 603f6cd when certify.rs was added. Same complaint about PropertyTag! WTF.
tpm-tss2 was version 3.2.2 at the time, so I recompiled that. Same.
Maybe my swtpm had some issue, I killed, cleared it and restarted. Same.
I'm doing:

$swdir/src/swtpm_setup/swtpm_setup --tpm "$swdir/src/swtpm/swtpm socket --log level=9" --tpmstate $dir  --tpm2 --create-ek-cert --create-platform-cert  --allow-signing --write-ek-cert-files .

Maybe I'm manufacturing wrong for this case.

to manufacture it, running this from the swtpm build directory, using swtpm. I see a typo in an error message upstream.

I'm now building 0.7.4 from source in case that's an issue?! I feel certain I saw this work a few weeks ago.

Wondering if william.brown@suse.com @Firstyear has an opinion.

[Firstyear]

No strong ideas/opinions here - when I wrote the examples I tested them all against swtpm to ensure they work.

mkdir /tmp/swtpm-localca
mkdir /tmp/tpmdir

cat << EOF > /tmp/swtpm-setup.conf
# Program invoked for creating certificates
create_certs_tool= /usr/bin/swtpm_localca
create_certs_tool_config = /tmp/swtpm-localca.conf
create_certs_tool_options = /etc/swtpm-localca.options
# Comma-separated list (no spaces) of PCR banks to activate by default
active_pcr_banks = sha1,sha256
EOF

cat << EOF > /tmp/swtpm-localca.conf
statedir =   /tmp/swtpm-localca
signingkey = /tmp/swtpm-localca/signkey.pem
issuercert = /tmp/swtpm-localca/issuercert.pem
certserial = /tmp/swtpm-localca/certserial
EOF

swtpm_setup --tpm2 \
    --config /tmp/swtpm-setup.conf \
    --tpm-state /tmp/tpmdir \
    --createek --decryption --create-ek-cert \
    --create-platform-cert \
    --display

swtpm socket --tpm2 \
    --tpmstate dir=/tmp/tpmdir \
    --flags startup-clear \
    --ctrl type=tcp,port=2322 \
    --server type=tcp,port=2321 \
    --daemon

export TCTI="swtpm:host=localhost,port=2321"

cargo run --example certify ....

These are the steps I have documented that I tested with previously - I can't actually test right now because of an unrelated build issue that i'm seeing.

[mcr]

Having been through more code, I think that 303 is a new return/capability, and that the pub enum PropertyTag has to be an open enum (accept unknown values via Other(u16) or some such). The swtpm 0.7 has a new ability which the code does not know about.

[mcr]

No strong ideas/opinions here - when I wrote the examples I tested them all against swtpm to ensure they work.

mkdir /tmp/swtpm-localca
mkdir /tmp/tpmdir

Very similar to my script.

[mcr]

Should one really have to activate sha256? I made sure I had this in the config just now, but same difference.

# Comma-separated list (no spaces) of PCR banks to activate by default
active_pcr_banks = sha1,sha256

[Firstyear]

Shouldn't be needed for certify.

[mstrug]

I came across same issue with PropertyTag undefined values. We are trying to get capabilities:

context.get_capability(CapabilityType::TpmProperties, 0, 64)

from software TPM emulator (swtpm 0.11.0 built locally with libtpms latest master).
Swtpm returns additional capabilities: TPM_PT_FIRMWARE_SVN 303, TPM_PT_FIRMWARE_MAX_SVN 304
https://github.com/stefanberger/libtpms/blob/master/src/tpm2/TpmTypes.h#L809
defined in https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-2-Version-184_pub.pdf not handled in rust-tss-esapi current version. Proposed PR #607 should fix that, alternatively it is enough to update the enum with latest values from spec.

[Superhepper]

I came across same issue with PropertyTag undefined values. We are trying to get capabilities:

context.get_capability(CapabilityType::TpmProperties, 0, 64)

from software TPM emulator (swtpm 0.11.0 built locally with libtpms latest master). Swtpm returns additional capabilities: TPM_PT_FIRMWARE_SVN 303, TPM_PT_FIRMWARE_MAX_SVN 304 https://github.com/stefanberger/libtpms/blob/master/src/tpm2/TpmTypes.h#L809 defined in https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-2-Version-184_pub.pdf not handled in rust-tss-esapi current version. Proposed PR #607 should fix that, alternatively it is enough to update the enum with latest values from spec.

Good find I will add the missing property tags that was added in 1p83 version of the specification and some missing conversion tests.

See #609 and #608

[mcr]

Good find I will add the missing property tags that was added in 1p83 version of the specification and some missing conversion tests.

See #609 and #608

yes, so adding the missing ones is good, but assuming that new ones might get added due to firmware updates on a TPM (or a new swtpm deployed under a VM), then we will run into this again... so we need to be able to tolerate when new tags are returned.
#607 tries to do that in an open way.

Another less good way would be to just ignore property tags that we do not know about. I think it's an array returned from the TPM, so just skip them: this would be justified because if the current code doesn't know about those properties, it can't use them. OTH, someone might want to just list/dump them.