And update those crates that were making use of it. Later we will also
use it in some other crates.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

I broke some of the compute-pcrs' lib APIs, so apart from just pointing
into a newer commit, we also need to tweak a couple of things here and
there.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

trustee tests were relying on some values that didn't hold any TPMEvent
or any PCR value that related to them.

This commit turns those dummy values into something that are closer to
something we could expect in reality.

The main reason to do this is that the compute-pcrs logic does not like
empty event PCRs, as it's based on that to reconstruct them.

This goes against the purpose of a unit test, as we should actually mock
that external part so as not to rely on it, but decided this was simpler
at least as an initial proposal.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

Update trustee reference values with all possible combinations between
approved PCR values, not just those that come directly from image PCRs.

This computes reference values for possible stages during node updates
in which a node could be booting some components from image A and some
other from image B.

This commit also adds a test to check that pcr4 is well covered in front
of bootloader and kernel updates. The test is closer to an integration
test than to an unit-test as it relies on values that are close to real
values, and how the compute-pcrs lib's combine_images processes them.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

Support the possibility of generating CRs for multiple approved images.
These are stored sepparately in different yaml files.

This changes the way trusted-cluster-gen names approved_image_cr.yaml
files, as it's not just one, but many of them that can be marshalled.
That's why test dependencies are updated to also be able to handle
multiple approved image CRs.

As we now deal with multiple images, and "coreos" is a bit to vague in
that case, approved-images now accept both the image reference and a
name, so we can identify them easily. Instead of calling "coreos" to the
existing one, we now call it "coreos-approved-primary".

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

Refactor the logic that was verifying expected image pcrs in
test_image_pcrs_configmap_updates as a method of TestContext.

It also slightly changes the logic of the poller to stop when the length
of pcrs equals the one expected.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

The compute pcrs job was computing pcr7 based on the guest OS
information. However, PCR7 is mainly affected by the EFI variables,
which are configured by the platform, or virtualization host.

As we lack a proper way to retrieve the EFI vars of the platform that
nodes are running on, we don't attest pcr7, so we should just not
compute it.

This commit removes the bits that computed pcr7 in the compute-pcrs job
and those that checked it during integration tests. It leaves the test
logic covering pcr7 in operator/src/trustee.rs as it should be agnostic
to whatever pcr prediction comes in.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

These could be used by other tests too. Make it a macro so it can be
reused, and define a few more macros for standard TPMEvents and PCR
values that are constant across integration tests at the moment, such as
PCR7 and PCR14.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

Add an integration test in which 2 approved images with different
bootloader and kernel are added to the cluster. This emulates the
situation in which a coreos image could be undergoing a bootloader and
kernel update.

The test checks that 2 images are added to the image pcr config map, and
then checks that the reference values contain all possible pcr4
combinations. pcr7 and pcr14 are constant in this case, so there are not
combinations possible (apart from the original value).

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

The logic checking that the image-pcrs configmap was populated moved
into using await_condition instead of a poller. Some conditions were
checked twice inside of the actual condition and subsequent assertions.
This commit removes those assertions in favor of the await call.

Moreover, it makes more sense from a stability point of view to wait for
the whole condition to happen, as it could be the case that a Nth image
is approved, and we run all the assertions (and fail) because only one
of the N images was found in the configmap. This way, the tests will
wait until the expected images of all approved images are present.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

Some integration tests might run on more approved images. Find which it
is based on the test file then pre-pull it.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>
Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>

This help not hitting some test timeouts due to images not being pulled
quickly enough.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>

Covering the primary and secondary approved images and also possible
combinations between the two of them.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>