tpm-enrol: pivot host enrolment to a Go binary, built out-of-VM

Replaces the shell/openssl-provider host enrolment (a35f2d6) with a static
Go + go-tpm binary, and moves BOTH host Go binaries out of the Packer VM.

fleet-enrol (files/enrol/, Go + go-tpm, no CGO):
  - talks to /dev/tpmrm0 DIRECTLY via transport.FromReadWriter(os.File) — no
    linuxtpm, so go-tpm is the only dep and there is NO tpm2-tools key-gen /
    openssl tpm2 provider / curl in the image (removes the biggest bench risk,
    the provider handle: key-ref).
  - ensures the ECDSA key @0x81010001, builds the CSR (crypto.Signer over the
    TPM key), POSTs CSR+context to the broker, shows the Plymouth fingerprint,
    polls /status, writes the leaf cert to NV 0x01800001.
  - tpmkey/ is an exported package so the TPM ceremony is tested against the
    go-tpm software simulator from a SEPARATE simtest/ module (CGO stays out of
    the shipped build). Transaction logic (mock broker) tested in-package.
  - deps pinned by go.sum (not vendored): the binary now builds on the CI
    runner, which has network — reproducible via pinned Go 1.26.4 + go.sum.

Out-of-VM build (decision): both fleet-enrol AND fleet-hostapi compile in the
CI "Build host Go binaries" step (Go 1.26.4, CGO off, -trimpath) and Packer
FILE-PROVISIONS the static binaries in. Dropped the in-VM `dnf install golang`
+ the 2d removal — the Rocky build image carries no Go toolchain / go-tpm tree.

Wiring:
  - tpm-enrol.sh: now a thin GATE (empty-NV check, pre-auth DHCP on en*,
    exec /usr/sbin/fleet-enrol, reboot-to-converge). module-setup.sh bundles the
    binary (asserted) + reverts the tpm2-openssl/curl installs.
  - diskless.pkr.hcl: file provisioners for both binaries; enrol installed to
    /usr/sbin before the initramfs build + fapolicyd-trusted; lsinitrd asserts
    fleet-enrol; dnf reverted to baseline (no tpm2-openssl/curl).
  - gitea-main-ci.yaml: Set up Go + build both binaries + run the simulator
    ceremony test, before packer validate.

TESTED here: transaction unit tests + the full TPM ceremony (key-gen -> persist
-> ECDSA sign -> CSR verify -> chunked NV write -> re-enrol) against the go-tpm
simulator. BENCH-VERIFY (real/swtpm, empty owner auth, pre-auth DHCP, Plymouth,
reboot-converge, prod HTTPS) tracked in docs/TODO.md #11.

files/dracut/95dot1x-macsec/module-setup.sh

@@ -7,12 +7,9 @@
 
 check() {
     require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
-    # Inline empty-NV enrolment (tpm-enrol.sh) needs the TPM key-gen + NV-write
-    # tools, curl (broker HTTP), and awk (JSON build). require them so a build
-    # that lacks tpm2-openssl / curl fails LOUDLY here rather than shipping a UKI
-    # that silently cannot enrol a fresh host.
-    require_binaries tpm2_createprimary tpm2_create tpm2_load tpm2_evictcontrol \
-        tpm2_nvdefine tpm2_nvwrite tpm2_readpublic curl awk || return 1
+    # First-boot ENROLMENT is the out-of-VM fleet-enrol Go binary (bundled in
+    # install()), which does key-gen/CSR/NV directly via go-tpm — so no tpm2-tools
+    # key-gen / openssl provider / curl are required in the initramfs here.
     return 0
 }
 
@@ -43,24 +40,22 @@ install() {
     inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid nmcli \
         grep sed cut tr sha256sum sleep mkdir nvme
 
-    # Inline empty-NV enrolment (tpm-enrol.sh): TPM key-gen + NV-write tools, the
-    # EK read (device context), curl (broker HTTP), awk (JSON), wc, and reboot.
-    inst_multiple tpm2_createprimary tpm2_create tpm2_load tpm2_evictcontrol \
-        tpm2_nvdefine tpm2_nvundefine tpm2_nvwrite tpm2_readpublic \
-        tpm2_createek tpm2_flushcontext curl awk wc reboot systemctl
-
-    # TSS libraries that the tpm2 tools + the openssl tpm2 provider dlopen.
-    inst_libdir_file "libtss2-*"
-    # openssl tpm2 PROVIDER (tpm2-openssl): openssl req signs the CSR with the
-    # TPM key via `-provider tpm2 -key handle:0x…`. tpm2-tss alone is NOT enough
-    # — the provider .so is what exposes the handle: key ref. require_binaries
-    # can't see a provider, so assert the .so landed (else enrolment CSR fails).
-    inst_libdir_file "ossl-modules/tpm2.so"
-    if [ -z "$(find "${initdir}" -name 'tpm2.so' -path '*ossl-modules*' 2>/dev/null)" ]; then
-        derror "95dot1x-macsec: openssl tpm2 provider (ossl-modules/tpm2.so) missing — install tpm2-openssl"
+    # Inline empty-NV enrolment: the gate hook (tpm-enrol.sh) drives networking +
+    # reboot; the actual key-gen/CSR/broker/NV work is the out-of-VM fleet-enrol
+    # binary (Go + go-tpm, static — talks to /dev/tpmrm0 directly, no tpm2-tools /
+    # openssl provider / curl needed). reboot: the hook reboots to converge into
+    # the secure path after writing the cert to NV.
+    inst_multiple reboot
+    if [ -x /usr/sbin/fleet-enrol ]; then
+        inst_simple /usr/sbin/fleet-enrol /usr/sbin/fleet-enrol
+    else
+        derror "95dot1x-macsec: /usr/sbin/fleet-enrol missing — build it out-of-VM (CI 'Build host Go binaries') before the initramfs build"
         return 1
     fi
 
+    # TSS libraries that tpm2_nvread (secure-path NV read) dlopens.
+    inst_libdir_file "libtss2-*"
+
     # Fleet-generic supplicant config + RADIUS CA
     inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
     inst_simple /etc/dot1x/radius-ca.pem             /etc/dot1x/radius-ca.pem

files/dracut/95dot1x-macsec/tpm-enrol.sh

@@ -1,73 +1,47 @@
 #!/bin/bash
 # tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
 #
-# INLINE empty-NV enrolment (docs/tpm-enrolment-design.md, "inline single-UKI").
-# The production UKI auto-detects a host with NO client cert in TPM NV and, in
-# that case ONLY, branches into first-time identity enrolment:
-#   1. generate a signing key IN the TPM, persist at 0x81010001 (if absent)
-#   2. build a CSR with that key via the openssl tpm2 provider (key never leaves)
-#   3. pre-auth DHCP on the PHYSICAL NIC (plaintext L2 — same pre-auth permit the
-#      firmware used to fetch the UKI; there is no macsec/identity yet)
-#   4. POST CSR + device context to the enrolment broker; show the returned
-#      fingerprint on the Plymouth splash for an admin to cross-check + approve
-#   5. poll until APPROVED, write the issued cert (DER) to NV 0x01800001
-#   6. REBOOT — the next boot finds the cert present and runs the normal secure
-#      path (this hook exits 0 immediately when a cert is already present).
+# INLINE empty-NV enrolment GATE (docs/tpm-enrolment-design.md). On a secure
+# build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
+# physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
+# which generates the key/CSR, talks to the broker, shows the Plymouth
+# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS
+# into the normal secure path. It is a no-op when a cert is already present
+# (normal boot — dot1x-macsec-up.sh reads NV) or under rd.dot1x=0 (test path).
 #
-# Empty-NV and the normal secure path are MUTUALLY EXCLUSIVE (a host with no cert
-# cannot do 802.1X→MACsec→NVMe at all), so this never interleaves with — or
-# reorders — the load-bearing secure boot sequence (invariant #2). Enrolment is
-# gated to the secure build (skipped under rd.dot1x=0) because the open/test path
-# has no trustworthy device identity to enrol (design open-question).
+# The crypto/HTTP/NV work lives in the binary (testable, TPM-direct); this hook
+# owns only the boot-environment concerns: the empty-NV gate, the pre-auth DHCP
+# (which the secure-mode nm-unmanaged.sh otherwise withholds from en*), and the
+# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so
+# this never reorders the load-bearing boot sequence (invariant #2).
 
 type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
 
-# One enrol attempt per boot. The stamp is set only once we COMMIT to enrolling
-# (NV confirmed empty) — not on entry — so the "cert present"/skip paths stay
-# re-runnable across repeated settled invocations, matching dot1x-macsec-up.sh
-# (which likewise stamps only on a terminal decision).
 STAMP=/run/dot1x/.enrol-done
 [ -e "$STAMP" ] && exit 0
 mkdir -p /run/dot1x
-
 export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
 
-ply()    { plymouth update --status="$1" 2>/dev/null || true; }
-plymsg() { plymouth message --text="$1"  2>/dev/null || true; }
-
 # --- skip conditions --------------------------------------------------------
-# Test path: no real identity to enrol; leave the open-port boot untouched.
-if [ "$(getarg rd.dot1x=)" = "0" ]; then
-    exit 0
-fi
-# Explicit opt-out (e.g. a provisioning-UKI variant handling enrol elsewhere).
+[ "$(getarg rd.dot1x=)" = "0" ] && exit 0                 # test path: no identity to enrol
 if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
-    info "tpm-enrol: disabled by rd.fleet.enrol=0"
-    exit 0
+    info "tpm-enrol: disabled by rd.fleet.enrol=0"; exit 0
 fi
 
 # --- knobs (override on the kernel cmdline) ---------------------------------
 NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
-HANDLE=$(getarg rd.fleet.enrol.handle=); [ -n "$HANDLE" ] || HANDLE=0x81010001
-CN=$(getarg rd.fleet.enrol.cn=); [ -n "$CN" ] || CN=fleet-host
 ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
 NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
-# Human-approval wait. Generous but bounded: an abandoned enrol must not hang the
-# box forever (it drops to emergency, where the missing cert is diagnosable).
-WAITTMO=$(getarg rd.fleet.enrol.timeout=); [ -n "$WAITTMO" ] || WAITTMO=1800
 
 # Wait briefly for the TPM resource-manager device so an early settle (before the
 # TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
 i=0
 while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
-if [ ! -e /dev/tpmrm0 ]; then
-    warn "tpm-enrol: /dev/tpmrm0 absent — no TPM; leaving to the secure path"
-    exit 0
-fi
+[ -e /dev/tpmrm0 ] || { warn "tpm-enrol: no TPM (/dev/tpmrm0) — leaving to the secure path"; exit 0; }
 
-# --- 0. already enrolled? then this is a normal boot — get out of the way ----
-# A present, non-empty NV cert means identity exists; dot1x-macsec-up.sh (next
-# hook) reads it and runs the secure path. Only an EMPTY/undefined NV enrols.
+# --- already enrolled? then this is a normal boot — do NOT touch the network -
+# (Bringing up en* here would fight the secure path, which needs it UNMANAGED for
+# wpa_supplicant. So gate on NV BEFORE any network action.)
 if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
    && [ -s /run/dot1x/nvprobe.der ]; then
     info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
@@ -75,11 +49,9 @@ if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
     exit 0
 fi
 
-# Committed to enrolling — set the once-per-boot lock now.
+# Committed to enrolling — one attempt per boot.
 : > "$STAMP"
 warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
-ply enrol-active
-plymsg "TPM enrolment: contacting fleet…"
 
 # NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
 NIC=$(getarg rd.dot1x.if=)
@@ -92,31 +64,7 @@ if [ -z "$NIC" ]; then
 fi
 [ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
 
-# --- 1. persistent TPM signing key (create only if absent) ------------------
-if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
-    info "tpm-enrol: creating TPM signing key, persisting at $HANDLE"
-    if ! { tpm2_createprimary -C o -G ecc -g sha256 -c /run/dot1x/primary.ctx >/dev/null \
-        && tpm2_create -C /run/dot1x/primary.ctx -G ecc256:ecdsa-sha256 \
-             -u /run/dot1x/key.pub -r /run/dot1x/key.priv >/dev/null \
-        && tpm2_load -C /run/dot1x/primary.ctx -u /run/dot1x/key.pub \
-             -r /run/dot1x/key.priv -c /run/dot1x/key.ctx >/dev/null \
-        && tpm2_evictcontrol -C o -c /run/dot1x/key.ctx "$HANDLE" >/dev/null; }; then
-        warn "tpm-enrol: failed to create/persist TPM key at $HANDLE"
-        plymsg "TPM enrolment FAILED (key generation)"; exit 1
-    fi
-else
-    info "tpm-enrol: reusing existing persistent key at $HANDLE"
-fi
-
-# --- 2. CSR with the TPM key (private key never leaves the TPM) -------------
-if ! openssl req -new -provider tpm2 -provider default \
-        -key "handle:$HANDLE" -subj "/O=fleet/CN=$CN" \
-        -out /run/dot1x/enrol.csr 2>/run/dot1x/enrol.err; then
-    warn "tpm-enrol: CSR generation failed (openssl tpm2 provider?): $(cat /run/dot1x/enrol.err 2>/dev/null)"
-    plymsg "TPM enrolment FAILED (CSR / tpm2 provider)"; exit 1
-fi
-
-# --- 3. pre-auth network on the PHYSICAL NIC --------------------------------
+# --- pre-auth network on the PHYSICAL NIC -----------------------------------
 # Secure-mode nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own it),
 # but there is no supplicant yet — so explicitly hand the NIC to NM for a
 # plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
@@ -131,100 +79,28 @@ while [ "$i" -lt "$NETTMO" ]; do
 done
 if [ "$i" -ge "$NETTMO" ]; then
     warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
-    plymsg "TPM enrolment FAILED (no network)"; exit 1
+    plymouth message --text="TPM enrolment FAILED (no network)" 2>/dev/null || true
+    exit 1
 fi
-info "tpm-enrol: pre-auth lease on $NIC; reaching broker at $ENROL_URL"
+info "tpm-enrol: pre-auth lease on $NIC; handing off to fleet-enrol ($ENROL_URL)"
 
-# --- device context (advisory; helps the admin recognise the device) --------
-MAC=$(cat "/sys/class/net/$NIC/address" 2>/dev/null)
-DMI_UUID=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null)
-DMI_SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null)
-EK_HASH=""
-if tpm2_createek -G ecc -u /run/dot1x/ek.pub -c /run/dot1x/ek.ctx >/dev/null 2>&1; then
-    EK_HASH=$(sha256sum /run/dot1x/ek.pub 2>/dev/null | cut -d' ' -f1)
-    tpm2_flushcontext /run/dot1x/ek.ctx >/dev/null 2>&1 || true
-fi
-
-# --- 4. POST the CSR + context ----------------------------------------------
-# JSON body, no jq in the initramfs: escape the PEM (newlines -> \n, quotes) with
-# awk and interpolate. curl uses the fleet CA for an https endpoint.
-CSR_ESC=$(awk 'BEGIN{ORS=""}{gsub(/\\/,"\\\\");gsub(/"/,"\\\"");printf "%s\\n",$0}' /run/dot1x/enrol.csr)
-printf '{"csr":"%s","context":{"mac":"%s","dmi_uuid":"%s","dmi_serial":"%s","ek_hash":"%s"}}' \
-    "$CSR_ESC" "$MAC" "$DMI_UUID" "$DMI_SERIAL" "$EK_HASH" > /run/dot1x/enrol-req.json
-
-CURL_TLS=()
-case "$ENROL_URL" in https:*) CURL_TLS=(--cacert /etc/dot1x/radius-ca.pem) ;; esac
-
-if ! curl -fsS "${CURL_TLS[@]}" -X POST "$ENROL_URL/request" \
-        -H 'Content-Type: application/json' --data @/run/dot1x/enrol-req.json \
-        -o /run/dot1x/enrol-resp.json 2>/run/dot1x/enrol.err; then
-    warn "tpm-enrol: broker /request failed: $(cat /run/dot1x/enrol.err 2>/dev/null)"
-    plymsg "TPM enrolment FAILED (broker unreachable)"; exit 1
-fi
-ENROL_ID=$(sed -n 's/.*"enrol_id":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
-FP=$(sed -n 's/.*"fingerprint":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
-if [ -z "$ENROL_ID" ]; then
-    warn "tpm-enrol: broker did not return an enrol_id: $(cat /run/dot1x/enrol-resp.json 2>/dev/null)"
-    plymsg "TPM enrolment FAILED (bad broker response)"; exit 1
-fi
-info "tpm-enrol: enrol_id=$ENROL_ID fingerprint=$FP"
-
-# --- 5. show the fingerprint + poll for approval ----------------------------
-# The fingerprint is PUBLIC (derived from the CSR public key) — displaying it is
-# allowed under invariant #1 (state, not a secret). An admin cross-checks it
-# against the broker's pending queue and approves.
-ply enrol-wait
-plymsg "APPROVE THIS DEVICE — code: $FP"
-
-i=0
-while [ "$i" -lt "$WAITTMO" ]; do
-    if curl -fsS "${CURL_TLS[@]}" "$ENROL_URL/status/$ENROL_ID" \
-            -o /run/dot1x/enrol-status.json 2>/dev/null; then
-        STATE=$(sed -n 's/.*"state":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-status.json)
-        case "$STATE" in
-            approved) break ;;
-            denied)   warn "tpm-enrol: enrolment DENIED by admin"
-                      plymsg "TPM enrolment DENIED"; exit 1 ;;
-            expired)  warn "tpm-enrol: enrolment request expired"
-                      plymsg "TPM enrolment EXPIRED — reboot to retry"; exit 1 ;;
-        esac
-    fi
-    sleep 5; i=$((i + 5))
-done
-if [ "${STATE:-}" != "approved" ]; then
-    warn "tpm-enrol: no approval within ${WAITTMO}s"
-    plymsg "TPM enrolment TIMED OUT"; exit 1
-fi
-
-# --- 6. write the issued cert to NV + reboot into the secure path -----------
-ply enrol-done
-plymsg "Enrolment approved — installing identity"
-# Extract the cert PEM (leaf first if a chain was returned), unescape \n.
-CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)","hostnqn":.*/\1/p' /run/dot1x/enrol-status.json)
-[ -n "$CERT_ESC" ] || CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)".*/\1/p' /run/dot1x/enrol-status.json)
-printf '%b' "$CERT_ESC" > /run/dot1x/enrol-cert.pem
-# Keep only the FIRST certificate (the leaf) for NV — the hostnqn/EAP identity.
-awk 'BEGIN{n=0} /BEGIN CERTIFICATE/{n++} n==1{print} /END CERTIFICATE/{if(n==1)exit}' \
-    /run/dot1x/enrol-cert.pem > /run/dot1x/enrol-leaf.pem
-if ! openssl x509 -in /run/dot1x/enrol-leaf.pem -outform DER \
-        -out /run/dot1x/enrol-leaf.der 2>/dev/null; then
-    warn "tpm-enrol: issued cert is not valid PEM"; plymsg "TPM enrolment FAILED (bad cert)"; exit 1
-fi
-SZ=$(wc -c < /run/dot1x/enrol-leaf.der)
-info "tpm-enrol: writing ${SZ}-byte cert to NV $NVINDEX"
-tpm2_nvundefine "$NVINDEX" -C o >/dev/null 2>&1 || true
-if ! { tpm2_nvdefine "$NVINDEX" -C o -s "$SZ" \
-         -a 'ownerread|ownerwrite|authread|authwrite' >/dev/null \
-    && tpm2_nvwrite "$NVINDEX" -C o -i /run/dot1x/enrol-leaf.der >/dev/null; }; then
-    warn "tpm-enrol: failed to write cert to NV $NVINDEX (TPM owner auth?)"
-    plymsg "TPM enrolment FAILED (NV write)"; exit 1
-fi
-
-SERIAL=$(openssl x509 -in /run/dot1x/enrol-leaf.pem -serial -noout 2>/dev/null | cut -d= -f2 | tr 'A-F' 'a-f')
-info "tpm-enrol: ENROLLED (cert serial $SERIAL). Rebooting into the secure path."
-plymsg "Enrolment complete — rebooting"
-sleep 2
-systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
-    { echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
-# Do not fall through to the secure path in this (pre-reboot) boot.
-exit 0
+# --- hand off to the enrolment binary ---------------------------------------
+# It drives the TPM (key/CSR/NV), the broker exchange, and the Plymouth
+# fingerprint. Exit 0 = enrolled (reboot to converge); 10 = already enrolled
+# (shouldn't reach here after the NV gate, but treat as normal boot); else fail.
+/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX"
+rc=$?
+case "$rc" in
+    0)
+        info "tpm-enrol: enrolled — rebooting into the secure path"
+        sleep 2
+        systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
+            { echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
+        exit 0 ;;
+    10)
+        info "tpm-enrol: fleet-enrol reports cert already present — normal boot"
+        exit 0 ;;
+    *)
+        warn "tpm-enrol: fleet-enrol failed (rc=$rc) — reboot to retry"
+        exit 1 ;;
+esac