[yeetypete]

Allow adding a TPM 2.0 to ephemeral bcvk VMs, emulated by swtpm:

• --tpm attaches an ephemeral TPM. Its state is discarded with the container.

swtpm runs inside the container from the host's /usr, just like virtiofsd. QEMU attaches it as a tpm-tis device (tpm-tis-device on aarch64). This is the same tpm model bcvk libvirt run uses.

Added test_run_ephemeral_tpm which checks if the emulated TPM shows up under /dev/tpmrm0.

Assisted-by: AI

[yeetypete]

Just for some more context on how this can be used for some e2e verified boot testing:

1. You create an "installer vm" with bcvk ephemeral --tpm-state DIR with a mounted empty disk.
2. Inside you set up the disk with LUKS and TPM and call bootc install to-filesystem on it.
3. After creating a disk in the installer VM a 2nd vm can boot it reusing the previous TPM's state and unlock the disk unattended. This can be a systemd-vmspawn vm, etc.

The idea is that this emulates how you might set up a bare-metal device where the installer and the booted system post-install see the same TPM.

[cgwalters]

For virtiofsd at least we should have always been using --fd to avoid any polling at all.

Something to improve in a followup

[cgwalters]

While this is the conservative default, I would argue to turn this on by default on supported architectures in the future

[yeetypete]

Yeah it'll depend on swtpm being installed on the host but that should be easy to check.