[e2e] Add VM attestation test interacting with RKPD
This CL adds an e2e test that interacts with RKPD and the real
RKP server. It checks the two major stages of pVM attestation:
- AVF key provisioning triggered with RKPD.
The CSRs generated by the RKP VM are sent to the real RKP server
for attestation.
- VM attestation.
RKP VM validates the VM requesting attestation and returns a
certificate chain covering the public key of a key pair owned by
the VM.
The test checks the final attestation certificate chain and asks
the VM to sign a message with the attestation key, to ensure that
the VM holds the correct key pair. It runs on an RKPD variation
that has permissions to run a VM.
The test target AvfRkpdVmAttestationTestApp is forked from
RkpdAppIntegrationTests with additional setup to check VM
attestation. It will run on a real device in avf-presubmit in the
future as VM attestation is not supported on cuttlefish.
The test has been added to avf busytown config in cl/614975596.
Bug: 325610326
Test: atest AvfRkpdVmAttestationTestApp
Change-Id: Ia6f52d60327be706c6c0c439ed59255358379b13
diff --git a/TEST_MAPPING b/TEST_MAPPING
index ec9042c..5b0c000 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -62,6 +62,9 @@
// TODO(b/325610326): Add this target to presubmit once there is enough
// SLO data for it.
"name": "AvfRkpdAppIntegrationTests"
+ },
+ {
+ "name": "AvfRkpdVmAttestationTestApp"
}
],
"postsubmit": [