bazel: add build files for go (#1186)

* build: correct toolchain order
* build: gazelle-update-repos
* build: use pregenerated proto for dependencies
* update bazeldnf
* deps: tpm simulator
* Update Google trillian module
* cli: add stamping as alternative build info source
* bazel: add go_test wrappers, mark special tests and select testing deps
* deps: add libvirt deps
* deps: go-libvirt patches
* deps: cloudflare circl patches
* bazel: add go_test wrappers, mark special tests and select testing deps
* bazel: keep gazelle overrides
* bazel: cleanup bazelrc
* bazel: switch CMakeLists.txt to use bazel
* bazel: fix injection of version information via stamping
* bazel: commit all build files
* dev-docs: document bazel usage
* deps: upgrade zig-cc for go 1.20
* bazel: update Perl for macOS arm64 & Linux arm64 support
* bazel: use static perl toolchain for OpenSSL
* bazel: use static protobuf (protoc) toolchain
* deps: add git and go to nix deps

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

.bazelrc

@@ -1,16 +1,48 @@
+# share bazel cache between checkouts of the same project
+# and keep old build caches around for longer
+build --disk_cache=~/.cache/shared_bazel_action_cache
+build --repository_cache=~/.cache/shared_bazel_repository_cache
+
+# better caching / reproducibility
+build --incompatible_strict_action_env=true
+build --experimental_output_directory_naming_scheme=diff_against_baseline
+
+# disable automatic toolchain detection for C/C++
 build --incompatible_enable_cc_toolchain_resolution
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
-build --platforms @zig_sdk//libc_aware/platform:linux_amd64_gnu.2.34
+
+# disable automatic toolchain detection for Java
 build --incompatible_use_toolchain_resolution_for_java_rules
 build --java_runtime_version=pinned_remotejdk_11
 build --tool_java_runtime_version=pinned_remotejdk_11
-build --experimental_output_directory_naming_scheme=diff_against_baseline
-test --java_runtime_version=pinned_remotejdk_11
-test --tool_java_runtime_version=pinned_remotejdk_11
-test --incompatible_use_toolchain_resolution_for_java_rules
-test --experimental_output_directory_naming_scheme=diff_against_baseline
 
+# inject version information into binaries
+build --stamp --workspace_status_command=tools/workspace_status
+
+# strip binaries for better reproducibility
+build --strip=always
+
+# set build mode to opt by default (better reproducibility and performance)
+build --compilation_mode=opt
+
+# compile for linux_amd64 by default (this is the target for any binaries that go into the cluster)
+build --platforms @zig_sdk//libc_aware/platform:linux_amd64_gnu.2.34
+
+# enable tpm simulator for tests
+test --//bazel/settings:tpm_simulator
+
+# disable test caching (rerun all test cases even if they passed before)
+test --cache_test_results=no
+
+# bazel config for debug builds
+build:debug --compilation_mode=dbg --strip=never
+
+# bazel configs to explicitly target a platform
+build:host --platforms @local_config_platform//:host
 build:linux_amd64 --platforms @zig_sdk//libc_aware/platform:linux_amd64_gnu.2.34
 build:linux_arm64 --platforms @zig_sdk//libc_aware/platform:linux_arm64_gnu.2.34
 build:linux_amd64_static --platforms @zig_sdk//libc_aware/platform:linux_amd64_musl
 build:linux_arm64_static --platforms @zig_sdk//libc_aware/platform:linux_arm64_musl
+
+# bazel config to explicitly disable stamping (hide version information at build time)
+build:nostamp --nostamp --workspace_status_command=

.github/actions/build_bootstrapper/action.yml

@@ -16,7 +16,7 @@ runs:
       run: |
         echo "::group::Build the bootstrapper"
         mkdir -p build && cd build
-        cmake ..
+        cmake -DBAZEL:STRING=bazelisk ..
         make bootstrapper
         mv -n bootstrapper "${{ inputs.outputPath }}"
         echo "::endgroup::"

.github/actions/build_cli/action.yml

@@ -45,9 +45,9 @@ runs:
         cd build
         if [ ${{ inputs.enterpriseCLI }} == 'true' ]
         then
-          cmake -DCLI_BUILD_TAGS:STRING=enterprise ..
+          cmake -DBAZEL:STRING=bazelisk -DCLI_BUILD_TAGS:STRING=enterprise ..
         else
-          cmake ..
+          cmake -DBAZEL:STRING=bazelisk ..
         fi
         GOOS=${{ inputs.targetOS }} GOARCH=${{ inputs.targetArch }} make cli
         cp constellation constellation-${{ inputs.targetOS }}-${{ inputs.targetArch }}

.github/actions/build_debugd/action.yml

@@ -17,7 +17,7 @@ runs:
         echo "::group::Build debugd"
         homedir="$(getent passwd $(id -u) | cut -d ":" -f 6)"
         mkdir -p build && cd build
-        cmake ..
+        cmake -DBAZEL:STRING=bazelisk ..
         export GOCACHE=${homedir}/.cache/go-build
         export GOPATH=${homedir}/go
         export GOMODCACHE=${homedir}/.cache/go-mod

.github/actions/build_disk_mapper/action.yml

@@ -16,7 +16,7 @@ runs:
       run: |
         echo "::group::Build the disk-mapper"
         mkdir -p build && cd build
-        cmake ..
+        cmake -DBAZEL:STRING=bazelisk ..
         make disk-mapper
         mv -n disk-mapper "${{ inputs.outputPath }}"
         echo "::endgroup::"

.github/actions/build_upgrade_agent/action.yml

@@ -16,7 +16,7 @@ runs:
       run: |
         echo "::group::Build the upgrade-agent"
         mkdir -p build && cd build
-        cmake ..
+        cmake -DBAZEL:STRING=bazelisk ..
         make upgrade-agent
         mv -n upgrade-agent "${{ inputs.outputPath }}"
         echo "::endgroup::"

.github/workflows/test-bazel.yml

@@ -7,11 +7,13 @@ on:
       - main
       - "release/**"
     paths:
+      - "*.go"
       - "**.bzl"
       - "**.bazel"
       - ".github/workflows/test-bazel.yml"
   pull_request:
     paths:
+      - "*.go"
       - "**.bzl"
       - "**.bazel"
       - ".github/workflows/test-bazel.yml"
@@ -26,6 +28,13 @@ jobs:
         with:
           ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
 
-      - name: Run bazel test
+      - name: Run buildifier and gazelle test
         shell: bash
-        run: bazelisk test --test_output=all ...
+        run: |
+          bazelisk test //:buildifier-check
+          bazelisk run //:gazelle-check
+
+      # TODO(malt3): Find workflows to run bazel unit tests
+      # - name: Run unit tests
+      #   shell: bash
+      #   run: bazelisk test --test_output=all ...

.github/workflows/test-integration.yml

@@ -39,7 +39,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y libcryptsetup12 libcryptsetup-dev
 
       - name: Create and populate build folder
-        run: mkdir build && cd build && cmake ..
+        run: mkdir build && cd build && cmake -DBAZEL:STRING=bazelisk ..
 
       # Runs all test targets starting with "integration-"
       - name: Integration Tests

.github/workflows/test-unittest.yml

@@ -42,7 +42,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y libcryptsetup12 libcryptsetup-dev libvirt-dev
 
       - name: Create and populate build folder
-        run: mkdir build && cd build && cmake ..
+        run: mkdir build && cd build && cmake -DBAZEL:STRING=bazelisk ..
 
       - name: Unit Tests
         working-directory: build

.gitignore

@@ -58,6 +58,7 @@ __pycache__/
 
 # Bazel
 bazel-*
+tools/pseudo-version
 
 # bazeldnf
 .bazeldnf/

3rdparty/bazel/com_github_cloudflare_circl/dh_x25519_BUILD_bazel.orig

@@ -0,0 +1,47 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "x25519",
+    srcs = [
+        "curve.go",
+        "curve_amd64.go",
+        "curve_amd64.h",
+        "curve_amd64.s",
+        "curve_generic.go",
+        "curve_noasm.go",
+        "doc.go",
+        "key.go",
+        "table.go",
+    ],
+    importpath = "github.com/cloudflare/circl/dh/x25519",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//math/fp25519",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:amd64": [
+            "@org_golang_x_sys//cpu",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":x25519",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "x25519_test",
+    srcs = [
+        "curve_test.go",
+        "key_test.go",
+    ],
+    data = glob(["testdata/**"]),
+    embed = [":x25519"],
+    deps = [
+        "//internal/conv",
+        "//internal/test",
+        "//math/fp25519",
+    ],
+)

3rdparty/bazel/com_github_cloudflare_circl/dh_x25519_BUILD_bazel.patch

@@ -0,0 +1,12 @@
+--- dh/x25519/BUILD.bazel
++++ dh/x25519/BUILD.bazel
+@@ -13,6 +13,9 @@
+         "key.go",
+         "table.go",
+     ],
++    embed = [
++        "//math/fp25519:headers",
++    ],
+     importpath = "github.com/cloudflare/circl/dh/x25519",
+     visibility = ["//visibility:public"],
+     deps = [

3rdparty/bazel/com_github_cloudflare_circl/dh_x25519_BUILD_bazel.want

@@ -0,0 +1,50 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "x25519",
+    srcs = [
+        "curve.go",
+        "curve_amd64.go",
+        "curve_amd64.h",
+        "curve_amd64.s",
+        "curve_generic.go",
+        "curve_noasm.go",
+        "doc.go",
+        "key.go",
+        "table.go",
+    ],
+    embed = [
+        "//math/fp25519:headers",
+    ],
+    importpath = "github.com/cloudflare/circl/dh/x25519",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//math/fp25519",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:amd64": [
+            "@org_golang_x_sys//cpu",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":x25519",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "x25519_test",
+    srcs = [
+        "curve_test.go",
+        "key_test.go",
+    ],
+    data = glob(["testdata/**"]),
+    embed = [":x25519"],
+    deps = [
+        "//internal/conv",
+        "//internal/test",
+        "//math/fp25519",
+    ],
+)

3rdparty/bazel/com_github_cloudflare_circl/dh_x448_BUILD_bazel.orig

@@ -0,0 +1,47 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "x448",
+    srcs = [
+        "curve.go",
+        "curve_amd64.go",
+        "curve_amd64.h",
+        "curve_amd64.s",
+        "curve_generic.go",
+        "curve_noasm.go",
+        "doc.go",
+        "key.go",
+        "table.go",
+    ],
+    importpath = "github.com/cloudflare/circl/dh/x448",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//math/fp448",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:amd64": [
+            "@org_golang_x_sys//cpu",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":x448",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "x448_test",
+    srcs = [
+        "curve_test.go",
+        "key_test.go",
+    ],
+    data = glob(["testdata/**"]),
+    embed = [":x448"],
+    deps = [
+        "//internal/conv",
+        "//internal/test",
+        "//math/fp448",
+    ],
+)

3rdparty/bazel/com_github_cloudflare_circl/dh_x448_BUILD_bazel.patch

@@ -0,0 +1,12 @@
+--- dh/x448/BUILD.bazel
++++ dh/x448/BUILD.bazel
+@@ -13,6 +13,9 @@
+         "key.go",
+         "table.go",
+     ],
++    embed = [
++        "//math/fp448:headers",
++    ],
+     importpath = "github.com/cloudflare/circl/dh/x448",
+     visibility = ["//visibility:public"],
+     deps = [

3rdparty/bazel/com_github_cloudflare_circl/dh_x448_BUILD_bazel.want

@@ -0,0 +1,50 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "x448",
+    srcs = [
+        "curve.go",
+        "curve_amd64.go",
+        "curve_amd64.h",
+        "curve_amd64.s",
+        "curve_generic.go",
+        "curve_noasm.go",
+        "doc.go",
+        "key.go",
+        "table.go",
+    ],
+    embed = [
+        "//math/fp448:headers",
+    ],
+    importpath = "github.com/cloudflare/circl/dh/x448",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//math/fp448",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:amd64": [
+            "@org_golang_x_sys//cpu",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":x448",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "x448_test",
+    srcs = [
+        "curve_test.go",
+        "key_test.go",
+    ],
+    data = glob(["testdata/**"]),
+    embed = [":x448"],
+    deps = [
+        "//internal/conv",
+        "//internal/test",
+        "//math/fp448",
+    ],
+)

3rdparty/bazel/com_github_cloudflare_circl/math_fp25519_BUILD_bazel.patch

@@ -0,0 +1,28 @@
+--- math/fp25519/BUILD.bazel
++++ math/fp25519/BUILD.bazel
+@@ -1,4 +1,4 @@
+-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
++load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_source", "go_test")
+
+ go_library(
+     name = "fp25519",
+@@ -22,6 +22,14 @@
+     }),
+ )
+
++go_source(
++    name = "headers",
++    srcs = [
++        "fp_amd64.h",
++    ],
++    visibility = ["//visibility:public"],
++)
++
+ alias(
+     name = "go_default_library",
+     actual = ":fp25519",
+@@ -37,3 +45,4 @@
+         "//internal/test",
+     ],
+ )
++

3rdparty/bazel/com_github_cloudflare_circl/math_fp448_BUILD_bazel.orig

@@ -0,0 +1,42 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "fp448",
+    srcs = [
+        "fp.go",
+        "fp_amd64.go",
+        "fp_amd64.h",
+        "fp_amd64.s",
+        "fp_generic.go",
+        "fp_noasm.go",
+    ],
+    importpath = "github.com/cloudflare/circl/math/fp448",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//internal/conv",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:amd64": [
+            "@org_golang_x_sys//cpu",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":fp448",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "fp448_test",
+    srcs = [
+        "edgecases_test.go",
+        "fp_test.go",
+    ],
+    embed = [":fp448"],
+    deps = [
+        "//internal/conv",
+        "//internal/test",
+    ],
+)

3rdparty/bazel/com_github_cloudflare_circl/math_fp448_BUILD_bazel.patch

@@ -0,0 +1,23 @@
+--- math/fp448/BUILD.bazel
++++ math/fp448/BUILD.bazel
+@@ -1,4 +1,4 @@
+-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
++load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_source", "go_test")
+
+ go_library(
+     name = "fp448",
+@@ -22,6 +22,14 @@
+     }),
+ )
+
++go_source(
++    name = "headers",
++    srcs = [
++        "fp_amd64.h",
++    ],
++    visibility = ["//visibility:public"],
++)
++
+ alias(
+     name = "go_default_library",
+     actual = ":fp448",

3rdparty/bazel/com_github_cloudflare_circl/math_fp448_BUILD_bazel.want

@@ -0,0 +1,50 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_source", "go_test")
+
+go_library(
+    name = "fp448",
+    srcs = [
+        "fp.go",
+        "fp_amd64.go",
+        "fp_amd64.h",
+        "fp_amd64.s",
+        "fp_generic.go",
+        "fp_noasm.go",
+    ],
+    importpath = "github.com/cloudflare/circl/math/fp448",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//internal/conv",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:amd64": [
+            "@org_golang_x_sys//cpu",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+go_source(
+    name = "headers",
+    srcs = [
+        "fp_amd64.h",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":fp448",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "fp448_test",
+    srcs = [
+        "edgecases_test.go",
+        "fp_test.go",
+    ],
+    embed = [":fp448"],
+    deps = [
+        "//internal/conv",
+        "//internal/test",
+    ],
+)

3rdparty/bazel/com_github_google_go_tpm_tools/com_github_google_go_tpm_tools.need

@@ -0,0 +1,26 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "internal",
+    srcs = [
+        "doc.go",
+        "internal_cgo.go",
+        "internal_cross.go",
+    ],
+    cgo = True,
+    cdeps = select({
+        "@//bazel/settings:tpm_simulator_enabled": ["//simulator/ms-tpm-20-ref:ms_tpm_20_ref"],
+        "//conditions:default": ["@//3rdparty/bazel/com_github_google_go_tpm_tools/placeholder:ms_tpm_20_ref_disabled"],
+    }),
+    copts = [
+        "-fno-sanitize=all",  # relax sanitizer checks for this test-only dependency
+    ],
+    importpath = "github.com/google/go-tpm-tools/simulator/internal",
+    visibility = ["//simulator:__subpackages__"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":internal",
+    visibility = ["//simulator:__subpackages__"],
+)

3rdparty/bazel/com_github_google_go_tpm_tools/com_github_google_go_tpm_tools.orig

@@ -0,0 +1,92 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "internal",
+    srcs = [
+        "doc.go",
+        "include.c",
+        "internal_cgo.go",
+        "internal_cross.go",
+    ],
+    cgo = True,
+    clinkopts = select({
+        "@io_bazel_rules_go//go/platform:darwin": [
+            "-L/usr/local/opt/openssl/lib",
+        ],
+        "@io_bazel_rules_go//go/platform:ios": [
+            "-L/usr/local/opt/openssl/lib",
+        ],
+        "//conditions:default": [],
+    }),
+    copts = [
+        "-DALG_SHA512=ALG_YES",
+        "-DCERTIFYX509_DEBUG=NO",
+        "-DCOMPILER_CHECKS=DEBUG",
+        "-DDEBUG=YES",
+        "-DECC_NIST_P224=YES",
+        "-DECC_NIST_P521=YES",
+        "-DMAX_CONTEXT_SIZE=1360",
+        "-DRUNTIME_SIZE_CHECKS=DEBUG",
+        "-DSIMULATION=NO",
+        "-DUSE_DA_USED=NO",
+        "-DVTPM=NO -DSIMULATION=NO -DUSE_DA_USED=NO",
+        "-I simulator/ms-tpm-20-ref/Samples/Google",
+        "-I simulator/ms-tpm-20-ref/TPMCmd/tpm/include",
+        "-I simulator/ms-tpm-20-ref/TPMCmd/tpm/include/prototypes",
+        "-I simulator/ms-tpm-20-ref/TPMCmd/tpm/src",
+        "-Wno-deprecated-declarations",
+        "-Wno-missing-braces -Wno-empty-body -Wno-unused-variable -Wno-uninitialized",
+        "-std=gnu11 -Wall -Wformat-security -fPIC",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:aix": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:android": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:darwin": [
+            "-I/usr/local/opt/openssl/include",
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:dragonfly": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:freebsd": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:illumos": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:ios": [
+            "-I/usr/local/opt/openssl/include",
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:js": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:linux": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:netbsd": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:openbsd": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:plan9": [
+            "-fstack-protector-all",
+        ],
+        "@io_bazel_rules_go//go/platform:solaris": [
+            "-fstack-protector-all",
+        ],
+        "//conditions:default": [],
+    }),
+    importpath = "github.com/google/go-tpm-tools/simulator/internal",
+    visibility = ["//simulator:__subpackages__"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":internal",
+    visibility = ["//simulator:__subpackages__"],
+)

3rdparty/bazel/com_github_google_go_tpm_tools/com_github_google_go_tpm_tools.patch

@@ -0,0 +1,91 @@
+--- simulator/internal/BUILD.bazel
++++ simulator/internal/BUILD.bazel
+@@ -4,83 +4,17 @@
+     name = "internal",
+     srcs = [
+         "doc.go",
+-        "include.c",
+         "internal_cgo.go",
+         "internal_cross.go",
+     ],
+     cgo = True,
+-    clinkopts = select({
+-        "@io_bazel_rules_go//go/platform:darwin": [
+-            "-L/usr/local/opt/openssl/lib",
+-        ],
+-        "@io_bazel_rules_go//go/platform:ios": [
+-            "-L/usr/local/opt/openssl/lib",
+-        ],
+-        "//conditions:default": [],
++    cdeps =  select({
++        "@//bazel/settings:tpm_simulator_enabled": ["//simulator/ms-tpm-20-ref:ms_tpm_20_ref"],
++        "//conditions:default": ["@//3rdparty/bazel/com_github_google_go_tpm_tools/placeholder:ms_tpm_20_ref_disabled"],
+     }),
+     copts = [
+-        "-DALG_SHA512=ALG_YES",
+-        "-DCERTIFYX509_DEBUG=NO",
+-        "-DCOMPILER_CHECKS=DEBUG",
+-        "-DDEBUG=YES",
+-        "-DECC_NIST_P224=YES",
+-        "-DECC_NIST_P521=YES",
+-        "-DMAX_CONTEXT_SIZE=1360",
+-        "-DRUNTIME_SIZE_CHECKS=DEBUG",
+-        "-DSIMULATION=NO",
+-        "-DUSE_DA_USED=NO",
+-        "-DVTPM=NO -DSIMULATION=NO -DUSE_DA_USED=NO",
+-        "-I simulator/ms-tpm-20-ref/Samples/Google",
+-        "-I simulator/ms-tpm-20-ref/TPMCmd/tpm/include",
+-        "-I simulator/ms-tpm-20-ref/TPMCmd/tpm/include/prototypes",
+-        "-I simulator/ms-tpm-20-ref/TPMCmd/tpm/src",
+-        "-Wno-deprecated-declarations",
+-        "-Wno-missing-braces -Wno-empty-body -Wno-unused-variable -Wno-uninitialized",
+-        "-std=gnu11 -Wall -Wformat-security -fPIC",
+-    ] + select({
+-        "@io_bazel_rules_go//go/platform:aix": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:android": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:darwin": [
+-            "-I/usr/local/opt/openssl/include",
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:dragonfly": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:freebsd": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:illumos": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:ios": [
+-            "-I/usr/local/opt/openssl/include",
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:js": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:linux": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:netbsd": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:openbsd": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:plan9": [
+-            "-fstack-protector-all",
+-        ],
+-        "@io_bazel_rules_go//go/platform:solaris": [
+-            "-fstack-protector-all",
+-        ],
+-        "//conditions:default": [],
+-    }),
++        "-fno-sanitize=all",  # relax sanitizer checks for this test-only dependency
++    ],
+     importpath = "github.com/google/go-tpm-tools/simulator/internal",
+     visibility = ["//simulator:__subpackages__"],
+ )

3rdparty/bazel/com_github_google_go_tpm_tools/include.orig.c

@@ -0,0 +1,207 @@
+// Go's CGO build system is very primitive (to put it politely). It can include
+// headers from any location, but can only compile sources in the same directory
+// as the Go code. Thus to allow us to use the Mircosoft code as a submodule, we
+// have to textually include all of the sources into this file.
+
+#define _CRYPT_HASH_C_
+#define _X509_SPT_
+
+// Google sources
+#include "Clock.c"
+#include "Entropy.c"
+#include "NVMem.c"
+#include "Run.c"
+
+// Most of the sources can be included in any order. However, this file has to
+// be included first as it instantiates all of the libraries global variables.
+#include "support/Global.c"
+
+#include "X509/TpmASN1.c"
+#include "X509/X509_ECC.c"
+#include "X509/X509_RSA.c"
+#include "X509/X509_spt.c"
+#include "command/Asymmetric/ECC_Parameters.c"
+#include "command/Asymmetric/ECDH_KeyGen.c"
+#include "command/Asymmetric/ECDH_ZGen.c"
+#include "command/Asymmetric/EC_Ephemeral.c"
+#include "command/Asymmetric/RSA_Decrypt.c"
+#include "command/Asymmetric/RSA_Encrypt.c"
+#include "command/Asymmetric/ZGen_2Phase.c"
+#include "command/AttachedComponent/AC_GetCapability.c"
+#include "command/AttachedComponent/AC_Send.c"
+#include "command/AttachedComponent/AC_spt.c"
+#include "command/AttachedComponent/Policy_AC_SendSelect.c"
+#include "command/Attestation/Attest_spt.c"
+#include "command/Attestation/Certify.c"
+#include "command/Attestation/CertifyCreation.c"
+#include "command/Attestation/CertifyX509.c"
+#include "command/Attestation/GetCommandAuditDigest.c"
+#include "command/Attestation/GetSessionAuditDigest.c"
+#include "command/Attestation/GetTime.c"
+#include "command/Attestation/Quote.c"
+#include "command/Capability/GetCapability.c"
+#include "command/Capability/TestParms.c"
+#include "command/ClockTimer/ClockRateAdjust.c"
+#include "command/ClockTimer/ClockSet.c"
+#include "command/ClockTimer/ReadClock.c"
+#include "command/CommandAudit/SetCommandCodeAuditStatus.c"
+#include "command/Context/ContextLoad.c"
+#include "command/Context/ContextSave.c"
+#include "command/Context/Context_spt.c"
+#include "command/Context/EvictControl.c"
+#include "command/Context/FlushContext.c"
+#include "command/DA/DictionaryAttackLockReset.c"
+#include "command/DA/DictionaryAttackParameters.c"
+#include "command/Duplication/Duplicate.c"
+#include "command/Duplication/Import.c"
+#include "command/Duplication/Rewrap.c"
+#include "command/EA/PolicyAuthValue.c"
+#include "command/EA/PolicyAuthorize.c"
+#include "command/EA/PolicyAuthorizeNV.c"
+#include "command/EA/PolicyCommandCode.c"
+#include "command/EA/PolicyCounterTimer.c"
+#include "command/EA/PolicyCpHash.c"
+#include "command/EA/PolicyDuplicationSelect.c"
+#include "command/EA/PolicyGetDigest.c"
+#include "command/EA/PolicyLocality.c"
+#include "command/EA/PolicyNV.c"
+#include "command/EA/PolicyNameHash.c"
+#include "command/EA/PolicyNvWritten.c"
+#include "command/EA/PolicyOR.c"
+#include "command/EA/PolicyPCR.c"
+#include "command/EA/PolicyPassword.c"
+#include "command/EA/PolicyPhysicalPresence.c"
+#include "command/EA/PolicySecret.c"
+#include "command/EA/PolicySigned.c"
+#include "command/EA/PolicyTemplate.c"
+#include "command/EA/PolicyTicket.c"
+#include "command/EA/Policy_spt.c"
+#include "command/Ecdaa/Commit.c"
+#include "command/FieldUpgrade/FieldUpgradeData.c"
+#include "command/FieldUpgrade/FieldUpgradeStart.c"
+#include "command/FieldUpgrade/FirmwareRead.c"
+#include "command/HashHMAC/EventSequenceComplete.c"
+#include "command/HashHMAC/HMAC_Start.c"
+#include "command/HashHMAC/HashSequenceStart.c"
+#include "command/HashHMAC/MAC_Start.c"
+#include "command/HashHMAC/SequenceComplete.c"
+#include "command/HashHMAC/SequenceUpdate.c"
+#include "command/Hierarchy/ChangeEPS.c"
+#include "command/Hierarchy/ChangePPS.c"
+#include "command/Hierarchy/Clear.c"
+#include "command/Hierarchy/ClearControl.c"
+#include "command/Hierarchy/CreatePrimary.c"
+#include "command/Hierarchy/HierarchyChangeAuth.c"
+#include "command/Hierarchy/HierarchyControl.c"
+#include "command/Hierarchy/SetPrimaryPolicy.c"
+#include "command/Misc/PP_Commands.c"
+#include "command/Misc/SetAlgorithmSet.c"
+#include "command/NVStorage/NV_Certify.c"
+#include "command/NVStorage/NV_ChangeAuth.c"
+#include "command/NVStorage/NV_DefineSpace.c"
+#include "command/NVStorage/NV_Extend.c"
+#include "command/NVStorage/NV_GlobalWriteLock.c"
+#include "command/NVStorage/NV_Increment.c"
+#include "command/NVStorage/NV_Read.c"
+#include "command/NVStorage/NV_ReadLock.c"
+#include "command/NVStorage/NV_ReadPublic.c"
+#include "command/NVStorage/NV_SetBits.c"
+#include "command/NVStorage/NV_UndefineSpace.c"
+#include "command/NVStorage/NV_UndefineSpaceSpecial.c"
+#include "command/NVStorage/NV_Write.c"
+#include "command/NVStorage/NV_WriteLock.c"
+#include "command/NVStorage/NV_spt.c"
+#include "command/Object/ActivateCredential.c"
+#include "command/Object/Create.c"
+#include "command/Object/CreateLoaded.c"
+#include "command/Object/Load.c"
+#include "command/Object/LoadExternal.c"
+#include "command/Object/MakeCredential.c"
+#include "command/Object/ObjectChangeAuth.c"
+#include "command/Object/Object_spt.c"
+#include "command/Object/ReadPublic.c"
+#include "command/Object/Unseal.c"
+#include "command/PCR/PCR_Allocate.c"
+#include "command/PCR/PCR_Event.c"
+#include "command/PCR/PCR_Extend.c"
+#include "command/PCR/PCR_Read.c"
+#include "command/PCR/PCR_Reset.c"
+#include "command/PCR/PCR_SetAuthPolicy.c"
+#include "command/PCR/PCR_SetAuthValue.c"
+#include "command/Random/GetRandom.c"
+#include "command/Random/StirRandom.c"
+#include "command/Session/PolicyRestart.c"
+#include "command/Session/StartAuthSession.c"
+#include "command/Signature/Sign.c"
+#include "command/Signature/VerifySignature.c"
+#include "command/Startup/Shutdown.c"
+#include "command/Startup/Startup.c"
+#include "command/Symmetric/EncryptDecrypt.c"
+#include "command/Symmetric/EncryptDecrypt2.c"
+#include "command/Symmetric/EncryptDecrypt_spt.c"
+#include "command/Symmetric/HMAC.c"
+#include "command/Symmetric/Hash.c"
+#include "command/Symmetric/MAC.c"
+#include "command/Testing/GetTestResult.c"
+#include "command/Testing/IncrementalSelfTest.c"
+#include "command/Testing/SelfTest.c"
+#include "command/Vendor/Vendor_TCG_Test.c"
+#include "crypt/AlgorithmTests.c"
+#include "crypt/BnConvert.c"
+#include "crypt/BnMath.c"
+#include "crypt/BnMemory.c"
+#include "crypt/CryptCmac.c"
+#include "crypt/CryptDes.c"
+#include "crypt/CryptEccData.c"
+#include "crypt/CryptEccKeyExchange.c"
+#include "crypt/CryptEccMain.c"
+#include "crypt/CryptEccSignature.c"
+#include "crypt/CryptHash.c"
+#include "crypt/CryptPrime.c"
+#include "crypt/CryptPrimeSieve.c"
+#include "crypt/CryptRand.c"
+#include "crypt/CryptRsa.c"
+#include "crypt/CryptSelfTest.c"
+#include "crypt/CryptSmac.c"
+#include "crypt/CryptSym.c"
+#include "crypt/CryptUtil.c"
+#include "crypt/PrimeData.c"
+#include "crypt/RsaKeyCache.c"
+#include "crypt/Ticket.c"
+#include "crypt/ossl/TpmToOsslDesSupport.c"
+#include "crypt/ossl/TpmToOsslMath.c"
+#include "crypt/ossl/TpmToOsslSupport.c"
+#include "events/_TPM_Hash_Data.c"
+#include "events/_TPM_Hash_End.c"
+#include "events/_TPM_Hash_Start.c"
+#include "events/_TPM_Init.c"
+#include "main/CommandDispatcher.c"
+#include "main/ExecCommand.c"
+#include "main/SessionProcess.c"
+#include "subsystem/CommandAudit.c"
+#include "subsystem/DA.c"
+#include "subsystem/Hierarchy.c"
+#include "subsystem/NvDynamic.c"
+#include "subsystem/NvReserved.c"
+#include "subsystem/Object.c"
+#include "subsystem/PCR.c"
+#include "subsystem/PP.c"
+#include "subsystem/Session.c"
+#include "subsystem/Time.c"
+#include "support/AlgorithmCap.c"
+#include "support/Bits.c"
+#include "support/CommandCodeAttributes.c"
+#include "support/Entity.c"
+#include "support/Handle.c"
+#include "support/IoBuffers.c"
+#include "support/Locality.c"
+#include "support/Manufacture.c"
+#include "support/Marshal.c"
+#include "support/MathOnByteBuffers.c"
+#include "support/Memory.c"
+#include "support/Power.c"
+#include "support/PropertyCap.c"
+#include "support/Response.c"
+#include "support/ResponseCodeProcessing.c"
+#include "support/TpmFail.c"
+#include "support/TpmSizeChecks.c"

3rdparty/bazel/com_github_google_go_tpm_tools/include.patch

@@ -0,0 +1,210 @@
+--- simulator/internal/include.c
++++ simulator/internal/include.c
+@@ -1,207 +0,0 @@
+-// Go's CGO build system is very primitive (to put it politely). It can include
+-// headers from any location, but can only compile sources in the same directory
+-// as the Go code. Thus to allow us to use the Mircosoft code as a submodule, we
+-// have to textually include all of the sources into this file.
+-
+-#define _CRYPT_HASH_C_
+-#define _X509_SPT_
+-
+-// Google sources
+-#include "Clock.c"
+-#include "Entropy.c"
+-#include "NVMem.c"
+-#include "Run.c"
+-
+-// Most of the sources can be included in any order. However, this file has to
+-// be included first as it instantiates all of the libraries global variables.
+-#include "support/Global.c"
+-
+-#include "X509/TpmASN1.c"
+-#include "X509/X509_ECC.c"
+-#include "X509/X509_RSA.c"
+-#include "X509/X509_spt.c"
+-#include "command/Asymmetric/ECC_Parameters.c"
+-#include "command/Asymmetric/ECDH_KeyGen.c"
+-#include "command/Asymmetric/ECDH_ZGen.c"
+-#include "command/Asymmetric/EC_Ephemeral.c"
+-#include "command/Asymmetric/RSA_Decrypt.c"
+-#include "command/Asymmetric/RSA_Encrypt.c"
+-#include "command/Asymmetric/ZGen_2Phase.c"
+-#include "command/AttachedComponent/AC_GetCapability.c"
+-#include "command/AttachedComponent/AC_Send.c"
+-#include "command/AttachedComponent/AC_spt.c"
+-#include "command/AttachedComponent/Policy_AC_SendSelect.c"
+-#include "command/Attestation/Attest_spt.c"
+-#include "command/Attestation/Certify.c"
+-#include "command/Attestation/CertifyCreation.c"
+-#include "command/Attestation/CertifyX509.c"
+-#include "command/Attestation/GetCommandAuditDigest.c"
+-#include "command/Attestation/GetSessionAuditDigest.c"
+-#include "command/Attestation/GetTime.c"
+-#include "command/Attestation/Quote.c"
+-#include "command/Capability/GetCapability.c"
+-#include "command/Capability/TestParms.c"
+-#include "command/ClockTimer/ClockRateAdjust.c"
+-#include "command/ClockTimer/ClockSet.c"
+-#include "command/ClockTimer/ReadClock.c"
+-#include "command/CommandAudit/SetCommandCodeAuditStatus.c"
+-#include "command/Context/ContextLoad.c"
+-#include "command/Context/ContextSave.c"
+-#include "command/Context/Context_spt.c"
+-#include "command/Context/EvictControl.c"
+-#include "command/Context/FlushContext.c"
+-#include "command/DA/DictionaryAttackLockReset.c"
+-#include "command/DA/DictionaryAttackParameters.c"
+-#include "command/Duplication/Duplicate.c"
+-#include "command/Duplication/Import.c"
+-#include "command/Duplication/Rewrap.c"
+-#include "command/EA/PolicyAuthValue.c"
+-#include "command/EA/PolicyAuthorize.c"
+-#include "command/EA/PolicyAuthorizeNV.c"
+-#include "command/EA/PolicyCommandCode.c"
+-#include "command/EA/PolicyCounterTimer.c"
+-#include "command/EA/PolicyCpHash.c"
+-#include "command/EA/PolicyDuplicationSelect.c"
+-#include "command/EA/PolicyGetDigest.c"
+-#include "command/EA/PolicyLocality.c"
+-#include "command/EA/PolicyNV.c"
+-#include "command/EA/PolicyNameHash.c"
+-#include "command/EA/PolicyNvWritten.c"
+-#include "command/EA/PolicyOR.c"
+-#include "command/EA/PolicyPCR.c"
+-#include "command/EA/PolicyPassword.c"
+-#include "command/EA/PolicyPhysicalPresence.c"
+-#include "command/EA/PolicySecret.c"
+-#include "command/EA/PolicySigned.c"
+-#include "command/EA/PolicyTemplate.c"
+-#include "command/EA/PolicyTicket.c"
+-#include "command/EA/Policy_spt.c"
+-#include "command/Ecdaa/Commit.c"
+-#include "command/FieldUpgrade/FieldUpgradeData.c"
+-#include "command/FieldUpgrade/FieldUpgradeStart.c"
+-#include "command/FieldUpgrade/FirmwareRead.c"
+-#include "command/HashHMAC/EventSequenceComplete.c"
+-#include "command/HashHMAC/HMAC_Start.c"
+-#include "command/HashHMAC/HashSequenceStart.c"
+-#include "command/HashHMAC/MAC_Start.c"
+-#include "command/HashHMAC/SequenceComplete.c"
+-#include "command/HashHMAC/SequenceUpdate.c"
+-#include "command/Hierarchy/ChangeEPS.c"
+-#include "command/Hierarchy/ChangePPS.c"
+-#include "command/Hierarchy/Clear.c"
+-#include "command/Hierarchy/ClearControl.c"
+-#include "command/Hierarchy/CreatePrimary.c"
+-#include "command/Hierarchy/HierarchyChangeAuth.c"
+-#include "command/Hierarchy/HierarchyControl.c"
+-#include "command/Hierarchy/SetPrimaryPolicy.c"
+-#include "command/Misc/PP_Commands.c"
+-#include "command/Misc/SetAlgorithmSet.c"
+-#include "command/NVStorage/NV_Certify.c"
+-#include "command/NVStorage/NV_ChangeAuth.c"
+-#include "command/NVStorage/NV_DefineSpace.c"
+-#include "command/NVStorage/NV_Extend.c"
+-#include "command/NVStorage/NV_GlobalWriteLock.c"
+-#include "command/NVStorage/NV_Increment.c"
+-#include "command/NVStorage/NV_Read.c"
+-#include "command/NVStorage/NV_ReadLock.c"
+-#include "command/NVStorage/NV_ReadPublic.c"
+-#include "command/NVStorage/NV_SetBits.c"
+-#include "command/NVStorage/NV_UndefineSpace.c"
+-#include "command/NVStorage/NV_UndefineSpaceSpecial.c"
+-#include "command/NVStorage/NV_Write.c"
+-#include "command/NVStorage/NV_WriteLock.c"
+-#include "command/NVStorage/NV_spt.c"
+-#include "command/Object/ActivateCredential.c"
+-#include "command/Object/Create.c"
+-#include "command/Object/CreateLoaded.c"
+-#include "command/Object/Load.c"
+-#include "command/Object/LoadExternal.c"
+-#include "command/Object/MakeCredential.c"
+-#include "command/Object/ObjectChangeAuth.c"
+-#include "command/Object/Object_spt.c"
+-#include "command/Object/ReadPublic.c"
+-#include "command/Object/Unseal.c"
+-#include "command/PCR/PCR_Allocate.c"
+-#include "command/PCR/PCR_Event.c"
+-#include "command/PCR/PCR_Extend.c"
+-#include "command/PCR/PCR_Read.c"
+-#include "command/PCR/PCR_Reset.c"
+-#include "command/PCR/PCR_SetAuthPolicy.c"
+-#include "command/PCR/PCR_SetAuthValue.c"
+-#include "command/Random/GetRandom.c"
+-#include "command/Random/StirRandom.c"
+-#include "command/Session/PolicyRestart.c"
+-#include "command/Session/StartAuthSession.c"
+-#include "command/Signature/Sign.c"
+-#include "command/Signature/VerifySignature.c"
+-#include "command/Startup/Shutdown.c"
+-#include "command/Startup/Startup.c"
+-#include "command/Symmetric/EncryptDecrypt.c"
+-#include "command/Symmetric/EncryptDecrypt2.c"
+-#include "command/Symmetric/EncryptDecrypt_spt.c"
+-#include "command/Symmetric/HMAC.c"
+-#include "command/Symmetric/Hash.c"
+-#include "command/Symmetric/MAC.c"
+-#include "command/Testing/GetTestResult.c"
+-#include "command/Testing/IncrementalSelfTest.c"
+-#include "command/Testing/SelfTest.c"
+-#include "command/Vendor/Vendor_TCG_Test.c"
+-#include "crypt/AlgorithmTests.c"
+-#include "crypt/BnConvert.c"
+-#include "crypt/BnMath.c"
+-#include "crypt/BnMemory.c"
+-#include "crypt/CryptCmac.c"
+-#include "crypt/CryptDes.c"
+-#include "crypt/CryptEccData.c"
+-#include "crypt/CryptEccKeyExchange.c"
+-#include "crypt/CryptEccMain.c"
+-#include "crypt/CryptEccSignature.c"
+-#include "crypt/CryptHash.c"
+-#include "crypt/CryptPrime.c"
+-#include "crypt/CryptPrimeSieve.c"
+-#include "crypt/CryptRand.c"
+-#include "crypt/CryptRsa.c"
+-#include "crypt/CryptSelfTest.c"
+-#include "crypt/CryptSmac.c"
+-#include "crypt/CryptSym.c"
+-#include "crypt/CryptUtil.c"
+-#include "crypt/PrimeData.c"
+-#include "crypt/RsaKeyCache.c"
+-#include "crypt/Ticket.c"
+-#include "crypt/ossl/TpmToOsslDesSupport.c"
+-#include "crypt/ossl/TpmToOsslMath.c"
+-#include "crypt/ossl/TpmToOsslSupport.c"
+-#include "events/_TPM_Hash_Data.c"
+-#include "events/_TPM_Hash_End.c"
+-#include "events/_TPM_Hash_Start.c"
+-#include "events/_TPM_Init.c"
+-#include "main/CommandDispatcher.c"
+-#include "main/ExecCommand.c"
+-#include "main/SessionProcess.c"
+-#include "subsystem/CommandAudit.c"
+-#include "subsystem/DA.c"
+-#include "subsystem/Hierarchy.c"
+-#include "subsystem/NvDynamic.c"
+-#include "subsystem/NvReserved.c"
+-#include "subsystem/Object.c"
+-#include "subsystem/PCR.c"
+-#include "subsystem/PP.c"
+-#include "subsystem/Session.c"
+-#include "subsystem/Time.c"
+-#include "support/AlgorithmCap.c"
+-#include "support/Bits.c"
+-#include "support/CommandCodeAttributes.c"
+-#include "support/Entity.c"
+-#include "support/Handle.c"
+-#include "support/IoBuffers.c"
+-#include "support/Locality.c"
+-#include "support/Manufacture.c"
+-#include "support/Marshal.c"
+-#include "support/MathOnByteBuffers.c"
+-#include "support/Memory.c"
+-#include "support/Power.c"
+-#include "support/PropertyCap.c"
+-#include "support/Response.c"
+-#include "support/ResponseCodeProcessing.c"
+-#include "support/TpmFail.c"
+-#include "support/TpmSizeChecks.c"

3rdparty/bazel/com_github_google_go_tpm_tools/ms_tpm_20_ref.need

@@ -0,0 +1,512 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+cc_library(
+    name = "ms_tpm_20_ref",
+    visibility = ["//visibility:public"],
+    srcs = [
+        "Samples/Google/Clock.c",
+        "Samples/Google/Entropy.c",
+        "Samples/Google/NVMem.c",
+        "Samples/Google/Run.c",
+        "TPMCmd/tpm/src/support/Global.c",
+        "TPMCmd/tpm/src/X509/TpmASN1.c",
+        "TPMCmd/tpm/src/X509/X509_ECC.c",
+        "TPMCmd/tpm/src/X509/X509_RSA.c",
+        "TPMCmd/tpm/src/X509/X509_spt.c",
+        "TPMCmd/tpm/src/command/Asymmetric/ECC_Parameters.c",
+        "TPMCmd/tpm/src/command/Asymmetric/ECDH_KeyGen.c",
+        "TPMCmd/tpm/src/command/Asymmetric/ECDH_ZGen.c",
+        "TPMCmd/tpm/src/command/Asymmetric/EC_Ephemeral.c",
+        "TPMCmd/tpm/src/command/Asymmetric/RSA_Decrypt.c",
+        "TPMCmd/tpm/src/command/Asymmetric/RSA_Encrypt.c",
+        "TPMCmd/tpm/src/command/Asymmetric/ZGen_2Phase.c",
+        "TPMCmd/tpm/src/command/AttachedComponent/AC_GetCapability.c",
+        "TPMCmd/tpm/src/command/AttachedComponent/AC_Send.c",
+        "TPMCmd/tpm/src/command/AttachedComponent/AC_spt.c",
+        "TPMCmd/tpm/src/command/AttachedComponent/Policy_AC_SendSelect.c",
+        "TPMCmd/tpm/src/command/Attestation/Attest_spt.c",
+        "TPMCmd/tpm/src/command/Attestation/Certify.c",
+        "TPMCmd/tpm/src/command/Attestation/CertifyCreation.c",
+        "TPMCmd/tpm/src/command/Attestation/CertifyX509.c",
+        "TPMCmd/tpm/src/command/Attestation/GetCommandAuditDigest.c",
+        "TPMCmd/tpm/src/command/Attestation/GetSessionAuditDigest.c",
+        "TPMCmd/tpm/src/command/Attestation/GetTime.c",
+        "TPMCmd/tpm/src/command/Attestation/Quote.c",
+        "TPMCmd/tpm/src/command/Capability/GetCapability.c",
+        "TPMCmd/tpm/src/command/Capability/TestParms.c",
+        "TPMCmd/tpm/src/command/ClockTimer/ClockRateAdjust.c",
+        "TPMCmd/tpm/src/command/ClockTimer/ClockSet.c",
+        "TPMCmd/tpm/src/command/ClockTimer/ReadClock.c",
+        "TPMCmd/tpm/src/command/CommandAudit/SetCommandCodeAuditStatus.c",
+        "TPMCmd/tpm/src/command/Context/ContextLoad.c",
+        "TPMCmd/tpm/src/command/Context/ContextSave.c",
+        "TPMCmd/tpm/src/command/Context/Context_spt.c",
+        "TPMCmd/tpm/src/command/Context/EvictControl.c",
+        "TPMCmd/tpm/src/command/Context/FlushContext.c",
+        "TPMCmd/tpm/src/command/DA/DictionaryAttackLockReset.c",
+        "TPMCmd/tpm/src/command/DA/DictionaryAttackParameters.c",
+        "TPMCmd/tpm/src/command/Duplication/Duplicate.c",
+        "TPMCmd/tpm/src/command/Duplication/Import.c",
+        "TPMCmd/tpm/src/command/Duplication/Rewrap.c",
+        "TPMCmd/tpm/src/command/EA/PolicyAuthValue.c",
+        "TPMCmd/tpm/src/command/EA/PolicyAuthorize.c",
+        "TPMCmd/tpm/src/command/EA/PolicyAuthorizeNV.c",
+        "TPMCmd/tpm/src/command/EA/PolicyCommandCode.c",
+        "TPMCmd/tpm/src/command/EA/PolicyCounterTimer.c",
+        "TPMCmd/tpm/src/command/EA/PolicyCpHash.c",
+        "TPMCmd/tpm/src/command/EA/PolicyDuplicationSelect.c",
+        "TPMCmd/tpm/src/command/EA/PolicyGetDigest.c",
+        "TPMCmd/tpm/src/command/EA/PolicyLocality.c",
+        "TPMCmd/tpm/src/command/EA/PolicyNV.c",
+        "TPMCmd/tpm/src/command/EA/PolicyNameHash.c",
+        "TPMCmd/tpm/src/command/EA/PolicyNvWritten.c",
+        "TPMCmd/tpm/src/command/EA/PolicyOR.c",
+        "TPMCmd/tpm/src/command/EA/PolicyPCR.c",
+        "TPMCmd/tpm/src/command/EA/PolicyPassword.c",
+        "TPMCmd/tpm/src/command/EA/PolicyPhysicalPresence.c",
+        "TPMCmd/tpm/src/command/EA/PolicySecret.c",
+        "TPMCmd/tpm/src/command/EA/PolicySigned.c",
+        "TPMCmd/tpm/src/command/EA/PolicyTemplate.c",
+        "TPMCmd/tpm/src/command/EA/PolicyTicket.c",
+        "TPMCmd/tpm/src/command/EA/Policy_spt.c",
+        "TPMCmd/tpm/src/command/Ecdaa/Commit.c",
+        "TPMCmd/tpm/src/command/FieldUpgrade/FieldUpgradeData.c",
+        "TPMCmd/tpm/src/command/FieldUpgrade/FieldUpgradeStart.c",
+        "TPMCmd/tpm/src/command/FieldUpgrade/FirmwareRead.c",
+        "TPMCmd/tpm/src/command/HashHMAC/EventSequenceComplete.c",
+        "TPMCmd/tpm/src/command/HashHMAC/HMAC_Start.c",
+        "TPMCmd/tpm/src/command/HashHMAC/HashSequenceStart.c",
+        "TPMCmd/tpm/src/command/HashHMAC/MAC_Start.c",
+        "TPMCmd/tpm/src/command/HashHMAC/SequenceComplete.c",
+        "TPMCmd/tpm/src/command/HashHMAC/SequenceUpdate.c",
+        "TPMCmd/tpm/src/command/Hierarchy/ChangeEPS.c",
+        "TPMCmd/tpm/src/command/Hierarchy/ChangePPS.c",
+        "TPMCmd/tpm/src/command/Hierarchy/Clear.c",
+        "TPMCmd/tpm/src/command/Hierarchy/ClearControl.c",
+        "TPMCmd/tpm/src/command/Hierarchy/CreatePrimary.c",
+        "TPMCmd/tpm/src/command/Hierarchy/HierarchyChangeAuth.c",
+        "TPMCmd/tpm/src/command/Hierarchy/HierarchyControl.c",
+        "TPMCmd/tpm/src/command/Hierarchy/SetPrimaryPolicy.c",
+        "TPMCmd/tpm/src/command/Misc/PP_Commands.c",
+        "TPMCmd/tpm/src/command/Misc/SetAlgorithmSet.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_Certify.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_ChangeAuth.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_DefineSpace.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_Extend.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_GlobalWriteLock.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_Increment.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_Read.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_ReadLock.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_ReadPublic.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_SetBits.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_UndefineSpace.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_UndefineSpaceSpecial.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_Write.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_WriteLock.c",
+        "TPMCmd/tpm/src/command/NVStorage/NV_spt.c",
+        "TPMCmd/tpm/src/command/Object/ActivateCredential.c",
+        "TPMCmd/tpm/src/command/Object/Create.c",
+        "TPMCmd/tpm/src/command/Object/CreateLoaded.c",
+        "TPMCmd/tpm/src/command/Object/Load.c",
+        "TPMCmd/tpm/src/command/Object/LoadExternal.c",
+        "TPMCmd/tpm/src/command/Object/MakeCredential.c",
+        "TPMCmd/tpm/src/command/Object/ObjectChangeAuth.c",
+        "TPMCmd/tpm/src/command/Object/Object_spt.c",
+        "TPMCmd/tpm/src/command/Object/ReadPublic.c",
+        "TPMCmd/tpm/src/command/Object/Unseal.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_Allocate.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_Event.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_Extend.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_Read.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_Reset.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_SetAuthPolicy.c",
+        "TPMCmd/tpm/src/command/PCR/PCR_SetAuthValue.c",
+        "TPMCmd/tpm/src/command/Random/GetRandom.c",
+        "TPMCmd/tpm/src/command/Random/StirRandom.c",
+        "TPMCmd/tpm/src/command/Session/PolicyRestart.c",
+        "TPMCmd/tpm/src/command/Session/StartAuthSession.c",
+        "TPMCmd/tpm/src/command/Signature/Sign.c",
+        "TPMCmd/tpm/src/command/Signature/VerifySignature.c",
+        "TPMCmd/tpm/src/command/Startup/Shutdown.c",
+        "TPMCmd/tpm/src/command/Startup/Startup.c",
+        "TPMCmd/tpm/src/command/Symmetric/EncryptDecrypt.c",
+        "TPMCmd/tpm/src/command/Symmetric/EncryptDecrypt2.c",
+        "TPMCmd/tpm/src/command/Symmetric/EncryptDecrypt_spt.c",
+        "TPMCmd/tpm/src/command/Symmetric/HMAC.c",
+        "TPMCmd/tpm/src/command/Symmetric/Hash.c",
+        "TPMCmd/tpm/src/command/Symmetric/MAC.c",
+        "TPMCmd/tpm/src/command/Testing/GetTestResult.c",
+        "TPMCmd/tpm/src/command/Testing/IncrementalSelfTest.c",
+        "TPMCmd/tpm/src/command/Testing/SelfTest.c",
+        "TPMCmd/tpm/src/command/Vendor/Vendor_TCG_Test.c",
+        "TPMCmd/tpm/src/crypt/AlgorithmTests.c",
+        "TPMCmd/tpm/src/crypt/BnConvert.c",
+        "TPMCmd/tpm/src/crypt/BnMath.c",
+        "TPMCmd/tpm/src/crypt/BnMemory.c",
+        "TPMCmd/tpm/src/crypt/CryptCmac.c",
+        "TPMCmd/tpm/src/crypt/CryptDes.c",
+        "TPMCmd/tpm/src/crypt/CryptEccData.c",
+        "TPMCmd/tpm/src/crypt/CryptEccKeyExchange.c",
+        "TPMCmd/tpm/src/crypt/CryptEccMain.c",
+        "TPMCmd/tpm/src/crypt/CryptEccSignature.c",
+        "TPMCmd/tpm/src/crypt/CryptHash.c",
+        "TPMCmd/tpm/src/crypt/CryptPrime.c",
+        "TPMCmd/tpm/src/crypt/CryptPrimeSieve.c",
+        "TPMCmd/tpm/src/crypt/CryptRand.c",
+        "TPMCmd/tpm/src/crypt/CryptRsa.c",
+        "TPMCmd/tpm/src/crypt/CryptSelfTest.c",
+        "TPMCmd/tpm/src/crypt/CryptSmac.c",
+        "TPMCmd/tpm/src/crypt/CryptSym.c",
+        "TPMCmd/tpm/src/crypt/CryptUtil.c",
+        "TPMCmd/tpm/src/crypt/PrimeData.c",
+        "TPMCmd/tpm/src/crypt/RsaKeyCache.c",
+        "TPMCmd/tpm/src/crypt/Ticket.c",
+        "TPMCmd/tpm/src/crypt/ossl/TpmToOsslDesSupport.c",
+        "TPMCmd/tpm/src/crypt/ossl/TpmToOsslMath.c",
+        "TPMCmd/tpm/src/crypt/ossl/TpmToOsslSupport.c",
+        "TPMCmd/tpm/src/events/_TPM_Hash_Data.c",
+        "TPMCmd/tpm/src/events/_TPM_Hash_End.c",
+        "TPMCmd/tpm/src/events/_TPM_Hash_Start.c",
+        "TPMCmd/tpm/src/events/_TPM_Init.c",
+        "TPMCmd/tpm/src/main/CommandDispatcher.c",
+        "TPMCmd/tpm/src/main/ExecCommand.c",
+        "TPMCmd/tpm/src/main/SessionProcess.c",
+        "TPMCmd/tpm/src/subsystem/CommandAudit.c",
+        "TPMCmd/tpm/src/subsystem/DA.c",
+        "TPMCmd/tpm/src/subsystem/Hierarchy.c",
+        "TPMCmd/tpm/src/subsystem/NvDynamic.c",
+        "TPMCmd/tpm/src/subsystem/NvReserved.c",
+        "TPMCmd/tpm/src/subsystem/Object.c",
+        "TPMCmd/tpm/src/subsystem/PCR.c",
+        "TPMCmd/tpm/src/subsystem/PP.c",
+        "TPMCmd/tpm/src/subsystem/Session.c",
+        "TPMCmd/tpm/src/subsystem/Time.c",
+        "TPMCmd/tpm/src/support/AlgorithmCap.c",
+        "TPMCmd/tpm/src/support/Bits.c",
+        "TPMCmd/tpm/src/support/CommandCodeAttributes.c",
+        "TPMCmd/tpm/src/support/Entity.c",
+        "TPMCmd/tpm/src/support/Handle.c",
+        "TPMCmd/tpm/src/support/IoBuffers.c",
+        "TPMCmd/tpm/src/support/Locality.c",
+        "TPMCmd/tpm/src/support/Manufacture.c",
+        "TPMCmd/tpm/src/support/Marshal.c",
+        "TPMCmd/tpm/src/support/MathOnByteBuffers.c",
+        "TPMCmd/tpm/src/support/Memory.c",
+        "TPMCmd/tpm/src/support/Power.c",
+        "TPMCmd/tpm/src/support/PropertyCap.c",
+        "TPMCmd/tpm/src/support/Response.c",
+        "TPMCmd/tpm/src/support/ResponseCodeProcessing.c",
+        "TPMCmd/tpm/src/support/TpmFail.c",
+        "TPMCmd/tpm/src/support/TpmSizeChecks.c",
+    ],
+    copts = [
+        # from internal/include.c
+        # "-D_CRYPT_HASH_C_",
+        # "-D_X509_SPT_",
+        # from internal/internal_cgo.go
+        # TODO: cleanup these flags
+        "-fno-delete-null-pointer-checks",
+        "-fwrapv",
+        "-fno-sanitize=all",  # relax sanitizer checks for this test-only dependency
+        "-DALG_SHA512=ALG_YES",
+        "-DCERTIFYX509_DEBUG=NO",
+        "-DCOMPILER_CHECKS=DEBUG",
+        "-DDEBUG=YES",
+        "-DECC_NIST_P224=YES",
+        "-DECC_NIST_P521=YES",
+        "-DMAX_CONTEXT_SIZE=1360",
+        "-DRUNTIME_SIZE_CHECKS=DEBUG",
+        "-DSIMULATION=NO",
+        "-DUSE_DA_USED=NO",
+        "-DVTPM=NO -DSIMULATION=NO -DUSE_DA_USED=NO",
+        "-I Samples/Google",
+        "-I TPMCmd/tpm/include",
+        "-I TPMCmd/tpm/include/prototypes",
+        "-I TPMCmd/tpm/src",
+        "-Wno-deprecated-declarations",
+        "-Wno-missing-braces -Wno-empty-body -Wno-unused-variable -Wno-uninitialized",
+        "-std=gnu11 -Wall -Wformat-security -fPIC",
+    ],
+    deps = [
+        ":ms_tpm_20_ref_google_samples",
+        "@org_openssl//:openssl",
+    ],
+)
+
+cc_library(
+    name = "ms_tpm_20_ref_google_samples",
+    visibility = ["//visibility:public"],
+    hdrs = [
+        "Samples/Google/PlatformData.h",
+        "Samples/Google/Platform.h",
+        "Samples/Google/Platform_fp.h",
+    ],
+    strip_include_prefix = "Samples/Google",
+    deps = [
+        ":ms_tpm_20_ref_include",
+        ":ms_tpm_20_ref_include_prototypes",
+    ],
+)
+
+cc_library(
+    name = "ms_tpm_20_ref_include",
+    visibility = ["//visibility:public"],
+    hdrs = [
+        "TPMCmd/tpm/include/Global.h",
+        "TPMCmd/tpm/include/TpmAlgorithmDefines.h",
+        "TPMCmd/tpm/include/HashTestData.h",
+        "TPMCmd/tpm/include/CryptSym.h",
+        "TPMCmd/tpm/include/TPMB.h",
+        "TPMCmd/tpm/include/GpMacros.h",
+        "TPMCmd/tpm/include/X509.h",
+        "TPMCmd/tpm/include/OIDs.h",
+        "TPMCmd/tpm/include/SymmetricTestData.h",
+        "TPMCmd/tpm/include/EccTestData.h",
+        "TPMCmd/tpm/include/TpmError.h",
+        "TPMCmd/tpm/include/CryptRand.h",
+        "TPMCmd/tpm/include/TpmTypes.h",
+        "TPMCmd/tpm/include/MinMax.h",
+        "TPMCmd/tpm/include/BaseTypes.h",
+        "TPMCmd/tpm/include/Tpm.h",
+        "TPMCmd/tpm/include/CompilerDependencies.h",
+        "TPMCmd/tpm/include/TpmProfile.h",
+        "TPMCmd/tpm/include/CryptTest.h",
+        "TPMCmd/tpm/include/LibSupport.h",
+        "TPMCmd/tpm/include/CryptHash.h",
+        "TPMCmd/tpm/include/SupportLibraryFunctionPrototypes_fp.h",
+        "TPMCmd/tpm/include/PRNG_TestVectors.h",
+        "TPMCmd/tpm/include/Capabilities.h",
+        "TPMCmd/tpm/include/CryptEcc.h",
+        "TPMCmd/tpm/include/CryptRsa.h",
+        "TPMCmd/tpm/include/VendorString.h",
+        "TPMCmd/tpm/include/CommandAttributeData.h",
+        "TPMCmd/tpm/include/CommandDispatcher.h",
+        "TPMCmd/tpm/include/BnValues.h",
+        "TPMCmd/tpm/include/HandleProcess.h",
+        "TPMCmd/tpm/include/SymmetricTest.h",
+        "TPMCmd/tpm/include/TpmBuildSwitches.h",
+        "TPMCmd/tpm/include/swap.h",
+        "TPMCmd/tpm/include/KdfTestData.h",
+        "TPMCmd/tpm/include/RsaTestData.h",
+        "TPMCmd/tpm/include/CommandAttributes.h",
+        "TPMCmd/tpm/include/CommandDispatchData.h",
+        "TPMCmd/tpm/include/Commands.h",
+        "TPMCmd/tpm/include/NV.h",
+        "TPMCmd/tpm/include/SelfTest.h",
+        "TPMCmd/tpm/include/InternalRoutines.h",
+        "TPMCmd/tpm/include/TpmASN1.h",
+        "TPMCmd/tpm/include/Wolf/user_settings.h",
+        "TPMCmd/tpm/include/Wolf/TpmToWolfHash.h",
+        "TPMCmd/tpm/include/Wolf/TpmToWolfMath.h",
+        "TPMCmd/tpm/include/Wolf/TpmToWolfSym.h",
+        "TPMCmd/tpm/include/Ltc/TpmToLtcSym.h",
+        "TPMCmd/tpm/include/Ltc/LtcSettings.h",
+        "TPMCmd/tpm/include/Ltc/TpmToLtcMath.h",
+        "TPMCmd/tpm/include/Ltc/TpmToLtcHash.h",
+        "TPMCmd/tpm/include/Ossl/TpmToOsslMath.h",
+        "TPMCmd/tpm/include/Ossl/TpmToOsslSym.h",
+        "TPMCmd/tpm/include/Ossl/TpmToOsslHash.h",
+    ],
+    strip_include_prefix = "TPMCmd/tpm/include",
+)
+
+cc_library(
+    name = "ms_tpm_20_ref_include_prototypes",
+    visibility = ["//visibility:public"],
+    hdrs = [
+        "TPMCmd/tpm/include/prototypes/CryptSym_fp.h",
+        "TPMCmd/tpm/include/prototypes/ChangePPS_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyDuplicationSelect_fp.h",
+        "TPMCmd/tpm/include/prototypes/Unseal_fp.h",
+        "TPMCmd/tpm/include/prototypes/HierarchyChangeAuth_fp.h",
+        "TPMCmd/tpm/include/prototypes/Session_fp.h",
+        "TPMCmd/tpm/include/prototypes/ClockSet_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyCounterTimer_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_ChangeAuth_fp.h",
+        "TPMCmd/tpm/include/prototypes/CommandAudit_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptRsa_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptSelfTest_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptRand_fp.h",
+        "TPMCmd/tpm/include/prototypes/X509_RSA_fp.h",
+        "TPMCmd/tpm/include/prototypes/Object_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToOsslMath_fp.h",
+        "TPMCmd/tpm/include/prototypes/CreateLoaded_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyPhysicalPresence_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptEccMain_fp.h",
+        "TPMCmd/tpm/include/prototypes/Commit_fp.h",
+        "TPMCmd/tpm/include/prototypes/ActivateCredential_fp.h",
+        "TPMCmd/tpm/include/prototypes/Power_fp.h",
+        "TPMCmd/tpm/include/prototypes/BnMemory_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_WriteLock_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyPCR_fp.h",
+        "TPMCmd/tpm/include/prototypes/BnConvert_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyPassword_fp.h",
+        "TPMCmd/tpm/include/prototypes/SessionProcess_fp.h",
+        "TPMCmd/tpm/include/prototypes/ClearControl_fp.h",
+        "TPMCmd/tpm/include/prototypes/ResponseCodeProcessing_fp.h",
+        "TPMCmd/tpm/include/prototypes/DictionaryAttackParameters_fp.h",
+        "TPMCmd/tpm/include/prototypes/EncryptDecrypt_fp.h",
+        "TPMCmd/tpm/include/prototypes/MAC_Start_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_GlobalWriteLock_fp.h",
+        "TPMCmd/tpm/include/prototypes/LoadExternal_fp.h",
+        "TPMCmd/tpm/include/prototypes/Import_fp.h",
+        "TPMCmd/tpm/include/prototypes/ContextSave_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptPrime_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyAuthorizeNV_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_ReadLock_fp.h",
+        "TPMCmd/tpm/include/prototypes/DictionaryAttackLockReset_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToLtcSupport_fp.h",
+        "TPMCmd/tpm/include/prototypes/GetRandom_fp.h",
+        "TPMCmd/tpm/include/prototypes/EvictControl_fp.h",
+        "TPMCmd/tpm/include/prototypes/ChangeEPS_fp.h",
+        "TPMCmd/tpm/include/prototypes/RSA_Decrypt_fp.h",
+        "TPMCmd/tpm/include/prototypes/FirmwareRead_fp.h",
+        "TPMCmd/tpm/include/prototypes/Create_fp.h",
+        "TPMCmd/tpm/include/prototypes/HMAC_Start_fp.h",
+        "TPMCmd/tpm/include/prototypes/Context_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/StartAuthSession_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_Read_fp.h",
+        "TPMCmd/tpm/include/prototypes/ClockRateAdjust_fp.h",
+        "TPMCmd/tpm/include/prototypes/SetCommandCodeAuditStatus_fp.h",
+        "TPMCmd/tpm/include/prototypes/EncryptDecrypt2_fp.h",
+        "TPMCmd/tpm/include/prototypes/Clear_fp.h",
+        "TPMCmd/tpm/include/prototypes/Handle_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptCmac_fp.h",
+        "TPMCmd/tpm/include/prototypes/EncryptDecrypt_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyNV_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptEccSignature_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptDes_fp.h",
+        "TPMCmd/tpm/include/prototypes/Manufacture_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyAuthValue_fp.h",
+        "TPMCmd/tpm/include/prototypes/CertifyCreation_fp.h",
+        "TPMCmd/tpm/include/prototypes/EC_Ephemeral_fp.h",
+        "TPMCmd/tpm/include/prototypes/_TPM_Hash_End_fp.h",
+        "TPMCmd/tpm/include/prototypes/Duplicate_fp.h",
+        "TPMCmd/tpm/include/prototypes/PropertyCap_fp.h",
+        "TPMCmd/tpm/include/prototypes/X509_ECC_fp.h",
+        "TPMCmd/tpm/include/prototypes/VerifySignature_fp.h",
+        "TPMCmd/tpm/include/prototypes/Policy_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToWolfDesSupport_fp.h",
+        "TPMCmd/tpm/include/prototypes/HierarchyControl_fp.h",
+        "TPMCmd/tpm/include/prototypes/SetAlgorithmSet_fp.h",
+        "TPMCmd/tpm/include/prototypes/Ticket_fp.h",
+        "TPMCmd/tpm/include/prototypes/Response_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_Extend_fp.h",
+        "TPMCmd/tpm/include/prototypes/ZGen_2Phase_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToLtcDesSupport_fp.h",
+        "TPMCmd/tpm/include/prototypes/HashSequenceStart_fp.h",
+        "TPMCmd/tpm/include/prototypes/AC_GetCapability_fp.h",
+        "TPMCmd/tpm/include/prototypes/SelfTest_fp.h",
+        "TPMCmd/tpm/include/prototypes/FlushContext_fp.h",
+        "TPMCmd/tpm/include/prototypes/GetSessionAuditDigest_fp.h",
+        "TPMCmd/tpm/include/prototypes/Hierarchy_fp.h",
+        "TPMCmd/tpm/include/prototypes/PP_Commands_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToWolfMath_fp.h",
+        "TPMCmd/tpm/include/prototypes/EventSequenceComplete_fp.h",
+        "TPMCmd/tpm/include/prototypes/RsaKeyCache_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_SetAuthPolicy_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicySecret_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptEccKeyExchange_fp.h",
+        "TPMCmd/tpm/include/prototypes/SequenceUpdate_fp.h",
+        "TPMCmd/tpm/include/prototypes/Marshal_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_Increment_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToWolfSupport_fp.h",
+        "TPMCmd/tpm/include/prototypes/HMAC_fp.h",
+        "TPMCmd/tpm/include/prototypes/GetTime_fp.h",
+        "TPMCmd/tpm/include/prototypes/FieldUpgradeStart_fp.h",
+        "TPMCmd/tpm/include/prototypes/ExecCommand_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_Extend_fp.h",
+        "TPMCmd/tpm/include/prototypes/Load_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyCpHash_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptUtil_fp.h",
+        "TPMCmd/tpm/include/prototypes/TestParms_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToOsslDesSupport_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmASN1_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToLtcMath_fp.h",
+        "TPMCmd/tpm/include/prototypes/MakeCredential_fp.h",
+        "TPMCmd/tpm/include/prototypes/ECDH_KeyGen_fp.h",
+        "TPMCmd/tpm/include/prototypes/GetCapability_fp.h",
+        "TPMCmd/tpm/include/prototypes/DA_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_UndefineSpaceSpecial_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_SetAuthValue_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyNvWritten_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptHash_fp.h",
+        "TPMCmd/tpm/include/prototypes/Bits_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptSmac_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_Read_fp.h",
+        "TPMCmd/tpm/include/prototypes/ECDH_ZGen_fp.h",
+        "TPMCmd/tpm/include/prototypes/CryptPrimeSieve_fp.h",
+        "TPMCmd/tpm/include/prototypes/Attest_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmFail_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_Write_fp.h",
+        "TPMCmd/tpm/include/prototypes/ECC_Parameters_fp.h",
+        "TPMCmd/tpm/include/prototypes/Object_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/_TPM_Hash_Start_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyGetDigest_fp.h",
+        "TPMCmd/tpm/include/prototypes/Sign_fp.h",
+        "TPMCmd/tpm/include/prototypes/ContextLoad_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyTemplate_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmSizeChecks_fp.h",
+        "TPMCmd/tpm/include/prototypes/Policy_AC_SendSelect_fp.h",
+        "TPMCmd/tpm/include/prototypes/X509_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_Certify_fp.h",
+        "TPMCmd/tpm/include/prototypes/GetTestResult_fp.h",
+        "TPMCmd/tpm/include/prototypes/CertifyX509_fp.h",
+        "TPMCmd/tpm/include/prototypes/Vendor_TCG_Test_fp.h",
+        "TPMCmd/tpm/include/prototypes/ReadPublic_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_SetBits_fp.h",
+        "TPMCmd/tpm/include/prototypes/Quote_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyCommandCode_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyOR_fp.h",
+        "TPMCmd/tpm/include/prototypes/IoBuffers_fp.h",
+        "TPMCmd/tpm/include/prototypes/NvReserved_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_DefineSpace_fp.h",
+        "TPMCmd/tpm/include/prototypes/Rewrap_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyRestart_fp.h",
+        "TPMCmd/tpm/include/prototypes/Hash_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_UndefineSpace_fp.h",
+        "TPMCmd/tpm/include/prototypes/AlgorithmTests_fp.h",
+        "TPMCmd/tpm/include/prototypes/BnMath_fp.h",
+        "TPMCmd/tpm/include/prototypes/Time_fp.h",
+        "TPMCmd/tpm/include/prototypes/Certify_fp.h",
+        "TPMCmd/tpm/include/prototypes/MathOnByteBuffers_fp.h",
+        "TPMCmd/tpm/include/prototypes/AC_spt_fp.h",
+        "TPMCmd/tpm/include/prototypes/Startup_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyNameHash_fp.h",
+        "TPMCmd/tpm/include/prototypes/NvDynamic_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicySigned_fp.h",
+        "TPMCmd/tpm/include/prototypes/AlgorithmCap_fp.h",
+        "TPMCmd/tpm/include/prototypes/CommandCodeAttributes_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyTicket_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_Reset_fp.h",
+        "TPMCmd/tpm/include/prototypes/IncrementalSelfTest_fp.h",
+        "TPMCmd/tpm/include/prototypes/GetCommandAuditDigest_fp.h",
+        "TPMCmd/tpm/include/prototypes/CommandDispatcher_fp.h",
+        "TPMCmd/tpm/include/prototypes/AC_Send_fp.h",
+        "TPMCmd/tpm/include/prototypes/Locality_fp.h",
+        "TPMCmd/tpm/include/prototypes/_TPM_Init_fp.h",
+        "TPMCmd/tpm/include/prototypes/FieldUpgradeData_fp.h",
+        "TPMCmd/tpm/include/prototypes/PP_fp.h",
+        "TPMCmd/tpm/include/prototypes/SetPrimaryPolicy_fp.h",
+        "TPMCmd/tpm/include/prototypes/RSA_Encrypt_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyAuthorize_fp.h",
+        "TPMCmd/tpm/include/prototypes/NV_ReadPublic_fp.h",
+        "TPMCmd/tpm/include/prototypes/_TPM_Hash_Data_fp.h",
+        "TPMCmd/tpm/include/prototypes/SequenceComplete_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_Event_fp.h",
+        "TPMCmd/tpm/include/prototypes/ObjectChangeAuth_fp.h",
+        "TPMCmd/tpm/include/prototypes/PCR_Allocate_fp.h",
+        "TPMCmd/tpm/include/prototypes/StirRandom_fp.h",
+        "TPMCmd/tpm/include/prototypes/CreatePrimary_fp.h",
+        "TPMCmd/tpm/include/prototypes/PolicyLocality_fp.h",
+        "TPMCmd/tpm/include/prototypes/TpmToOsslSupport_fp.h",
+        "TPMCmd/tpm/include/prototypes/Memory_fp.h",
+        "TPMCmd/tpm/include/prototypes/ReadClock_fp.h",
+        "TPMCmd/tpm/include/prototypes/Shutdown_fp.h",
+        "TPMCmd/tpm/include/prototypes/Entity_fp.h",
+        "TPMCmd/tpm/include/prototypes/MAC_fp.h",
+    ],
+    strip_include_prefix = "TPMCmd/tpm/include/prototypes",
+)

3rdparty/bazel/com_github_google_go_tpm_tools/ms_tpm_20_ref.patch

@@ -0,0 +1,512 @@
+--- simulator/ms-tpm-20-ref/BUILD.bazel
++++ simulator/ms-tpm-20-ref/BUILD.bazel
+@@ -0,0 +1,509 @@
++cc_library(
++    name = "ms_tpm_20_ref",
++    visibility = ["//visibility:public"],
++    srcs = [
++        "Samples/Google/Clock.c",
++        "Samples/Google/Entropy.c",
++        "Samples/Google/NVMem.c",
++        "Samples/Google/Run.c",
++        "TPMCmd/tpm/src/support/Global.c",
++        "TPMCmd/tpm/src/X509/TpmASN1.c",
++        "TPMCmd/tpm/src/X509/X509_ECC.c",
++        "TPMCmd/tpm/src/X509/X509_RSA.c",
++        "TPMCmd/tpm/src/X509/X509_spt.c",
++        "TPMCmd/tpm/src/command/Asymmetric/ECC_Parameters.c",
++        "TPMCmd/tpm/src/command/Asymmetric/ECDH_KeyGen.c",
++        "TPMCmd/tpm/src/command/Asymmetric/ECDH_ZGen.c",
++        "TPMCmd/tpm/src/command/Asymmetric/EC_Ephemeral.c",
++        "TPMCmd/tpm/src/command/Asymmetric/RSA_Decrypt.c",
++        "TPMCmd/tpm/src/command/Asymmetric/RSA_Encrypt.c",
++        "TPMCmd/tpm/src/command/Asymmetric/ZGen_2Phase.c",
++        "TPMCmd/tpm/src/command/AttachedComponent/AC_GetCapability.c",
++        "TPMCmd/tpm/src/command/AttachedComponent/AC_Send.c",
++        "TPMCmd/tpm/src/command/AttachedComponent/AC_spt.c",
++        "TPMCmd/tpm/src/command/AttachedComponent/Policy_AC_SendSelect.c",
++        "TPMCmd/tpm/src/command/Attestation/Attest_spt.c",
++        "TPMCmd/tpm/src/command/Attestation/Certify.c",
++        "TPMCmd/tpm/src/command/Attestation/CertifyCreation.c",
++        "TPMCmd/tpm/src/command/Attestation/CertifyX509.c",
++        "TPMCmd/tpm/src/command/Attestation/GetCommandAuditDigest.c",
++        "TPMCmd/tpm/src/command/Attestation/GetSessionAuditDigest.c",
++        "TPMCmd/tpm/src/command/Attestation/GetTime.c",
++        "TPMCmd/tpm/src/command/Attestation/Quote.c",
++        "TPMCmd/tpm/src/command/Capability/GetCapability.c",
++        "TPMCmd/tpm/src/command/Capability/TestParms.c",
++        "TPMCmd/tpm/src/command/ClockTimer/ClockRateAdjust.c",
++        "TPMCmd/tpm/src/command/ClockTimer/ClockSet.c",
++        "TPMCmd/tpm/src/command/ClockTimer/ReadClock.c",
++        "TPMCmd/tpm/src/command/CommandAudit/SetCommandCodeAuditStatus.c",
++        "TPMCmd/tpm/src/command/Context/ContextLoad.c",
++        "TPMCmd/tpm/src/command/Context/ContextSave.c",
++        "TPMCmd/tpm/src/command/Context/Context_spt.c",
++        "TPMCmd/tpm/src/command/Context/EvictControl.c",
++        "TPMCmd/tpm/src/command/Context/FlushContext.c",
++        "TPMCmd/tpm/src/command/DA/DictionaryAttackLockReset.c",
++        "TPMCmd/tpm/src/command/DA/DictionaryAttackParameters.c",
++        "TPMCmd/tpm/src/command/Duplication/Duplicate.c",
++        "TPMCmd/tpm/src/command/Duplication/Import.c",
++        "TPMCmd/tpm/src/command/Duplication/Rewrap.c",
++        "TPMCmd/tpm/src/command/EA/PolicyAuthValue.c",
++        "TPMCmd/tpm/src/command/EA/PolicyAuthorize.c",
++        "TPMCmd/tpm/src/command/EA/PolicyAuthorizeNV.c",
++        "TPMCmd/tpm/src/command/EA/PolicyCommandCode.c",
++        "TPMCmd/tpm/src/command/EA/PolicyCounterTimer.c",
++        "TPMCmd/tpm/src/command/EA/PolicyCpHash.c",
++        "TPMCmd/tpm/src/command/EA/PolicyDuplicationSelect.c",
++        "TPMCmd/tpm/src/command/EA/PolicyGetDigest.c",
++        "TPMCmd/tpm/src/command/EA/PolicyLocality.c",
++        "TPMCmd/tpm/src/command/EA/PolicyNV.c",
++        "TPMCmd/tpm/src/command/EA/PolicyNameHash.c",
++        "TPMCmd/tpm/src/command/EA/PolicyNvWritten.c",
++        "TPMCmd/tpm/src/command/EA/PolicyOR.c",
++        "TPMCmd/tpm/src/command/EA/PolicyPCR.c",
++        "TPMCmd/tpm/src/command/EA/PolicyPassword.c",
++        "TPMCmd/tpm/src/command/EA/PolicyPhysicalPresence.c",
++        "TPMCmd/tpm/src/command/EA/PolicySecret.c",
++        "TPMCmd/tpm/src/command/EA/PolicySigned.c",
++        "TPMCmd/tpm/src/command/EA/PolicyTemplate.c",
++        "TPMCmd/tpm/src/command/EA/PolicyTicket.c",
++        "TPMCmd/tpm/src/command/EA/Policy_spt.c",
++        "TPMCmd/tpm/src/command/Ecdaa/Commit.c",
++        "TPMCmd/tpm/src/command/FieldUpgrade/FieldUpgradeData.c",
++        "TPMCmd/tpm/src/command/FieldUpgrade/FieldUpgradeStart.c",
++        "TPMCmd/tpm/src/command/FieldUpgrade/FirmwareRead.c",
++        "TPMCmd/tpm/src/command/HashHMAC/EventSequenceComplete.c",
++        "TPMCmd/tpm/src/command/HashHMAC/HMAC_Start.c",
++        "TPMCmd/tpm/src/command/HashHMAC/HashSequenceStart.c",
++        "TPMCmd/tpm/src/command/HashHMAC/MAC_Start.c",
++        "TPMCmd/tpm/src/command/HashHMAC/SequenceComplete.c",
++        "TPMCmd/tpm/src/command/HashHMAC/SequenceUpdate.c",
++        "TPMCmd/tpm/src/command/Hierarchy/ChangeEPS.c",
++        "TPMCmd/tpm/src/command/Hierarchy/ChangePPS.c",
++        "TPMCmd/tpm/src/command/Hierarchy/Clear.c",
++        "TPMCmd/tpm/src/command/Hierarchy/ClearControl.c",
++        "TPMCmd/tpm/src/command/Hierarchy/CreatePrimary.c",
++        "TPMCmd/tpm/src/command/Hierarchy/HierarchyChangeAuth.c",
++        "TPMCmd/tpm/src/command/Hierarchy/HierarchyControl.c",
++        "TPMCmd/tpm/src/command/Hierarchy/SetPrimaryPolicy.c",
++        "TPMCmd/tpm/src/command/Misc/PP_Commands.c",
++        "TPMCmd/tpm/src/command/Misc/SetAlgorithmSet.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_Certify.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_ChangeAuth.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_DefineSpace.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_Extend.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_GlobalWriteLock.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_Increment.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_Read.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_ReadLock.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_ReadPublic.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_SetBits.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_UndefineSpace.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_UndefineSpaceSpecial.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_Write.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_WriteLock.c",
++        "TPMCmd/tpm/src/command/NVStorage/NV_spt.c",
++        "TPMCmd/tpm/src/command/Object/ActivateCredential.c",
++        "TPMCmd/tpm/src/command/Object/Create.c",
++        "TPMCmd/tpm/src/command/Object/CreateLoaded.c",
++        "TPMCmd/tpm/src/command/Object/Load.c",
++        "TPMCmd/tpm/src/command/Object/LoadExternal.c",
++        "TPMCmd/tpm/src/command/Object/MakeCredential.c",
++        "TPMCmd/tpm/src/command/Object/ObjectChangeAuth.c",
++        "TPMCmd/tpm/src/command/Object/Object_spt.c",
++        "TPMCmd/tpm/src/command/Object/ReadPublic.c",
++        "TPMCmd/tpm/src/command/Object/Unseal.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_Allocate.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_Event.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_Extend.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_Read.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_Reset.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_SetAuthPolicy.c",
++        "TPMCmd/tpm/src/command/PCR/PCR_SetAuthValue.c",
++        "TPMCmd/tpm/src/command/Random/GetRandom.c",
++        "TPMCmd/tpm/src/command/Random/StirRandom.c",
++        "TPMCmd/tpm/src/command/Session/PolicyRestart.c",
++        "TPMCmd/tpm/src/command/Session/StartAuthSession.c",
++        "TPMCmd/tpm/src/command/Signature/Sign.c",
++        "TPMCmd/tpm/src/command/Signature/VerifySignature.c",
++        "TPMCmd/tpm/src/command/Startup/Shutdown.c",
++        "TPMCmd/tpm/src/command/Startup/Startup.c",
++        "TPMCmd/tpm/src/command/Symmetric/EncryptDecrypt.c",
++        "TPMCmd/tpm/src/command/Symmetric/EncryptDecrypt2.c",
++        "TPMCmd/tpm/src/command/Symmetric/EncryptDecrypt_spt.c",
++        "TPMCmd/tpm/src/command/Symmetric/HMAC.c",
++        "TPMCmd/tpm/src/command/Symmetric/Hash.c",
++        "TPMCmd/tpm/src/command/Symmetric/MAC.c",
++        "TPMCmd/tpm/src/command/Testing/GetTestResult.c",
++        "TPMCmd/tpm/src/command/Testing/IncrementalSelfTest.c",
++        "TPMCmd/tpm/src/command/Testing/SelfTest.c",
++        "TPMCmd/tpm/src/command/Vendor/Vendor_TCG_Test.c",
++        "TPMCmd/tpm/src/crypt/AlgorithmTests.c",
++        "TPMCmd/tpm/src/crypt/BnConvert.c",
++        "TPMCmd/tpm/src/crypt/BnMath.c",
++        "TPMCmd/tpm/src/crypt/BnMemory.c",
++        "TPMCmd/tpm/src/crypt/CryptCmac.c",
++        "TPMCmd/tpm/src/crypt/CryptDes.c",
++        "TPMCmd/tpm/src/crypt/CryptEccData.c",
++        "TPMCmd/tpm/src/crypt/CryptEccKeyExchange.c",
++        "TPMCmd/tpm/src/crypt/CryptEccMain.c",
++        "TPMCmd/tpm/src/crypt/CryptEccSignature.c",
++        "TPMCmd/tpm/src/crypt/CryptHash.c",
++        "TPMCmd/tpm/src/crypt/CryptPrime.c",
++        "TPMCmd/tpm/src/crypt/CryptPrimeSieve.c",
++        "TPMCmd/tpm/src/crypt/CryptRand.c",
++        "TPMCmd/tpm/src/crypt/CryptRsa.c",
++        "TPMCmd/tpm/src/crypt/CryptSelfTest.c",
++        "TPMCmd/tpm/src/crypt/CryptSmac.c",
++        "TPMCmd/tpm/src/crypt/CryptSym.c",
++        "TPMCmd/tpm/src/crypt/CryptUtil.c",
++        "TPMCmd/tpm/src/crypt/PrimeData.c",
++        "TPMCmd/tpm/src/crypt/RsaKeyCache.c",
++        "TPMCmd/tpm/src/crypt/Ticket.c",
++        "TPMCmd/tpm/src/crypt/ossl/TpmToOsslDesSupport.c",
++        "TPMCmd/tpm/src/crypt/ossl/TpmToOsslMath.c",
++        "TPMCmd/tpm/src/crypt/ossl/TpmToOsslSupport.c",
++        "TPMCmd/tpm/src/events/_TPM_Hash_Data.c",
++        "TPMCmd/tpm/src/events/_TPM_Hash_End.c",
++        "TPMCmd/tpm/src/events/_TPM_Hash_Start.c",
++        "TPMCmd/tpm/src/events/_TPM_Init.c",
++        "TPMCmd/tpm/src/main/CommandDispatcher.c",
++        "TPMCmd/tpm/src/main/ExecCommand.c",
++        "TPMCmd/tpm/src/main/SessionProcess.c",
++        "TPMCmd/tpm/src/subsystem/CommandAudit.c",
++        "TPMCmd/tpm/src/subsystem/DA.c",
++        "TPMCmd/tpm/src/subsystem/Hierarchy.c",
++        "TPMCmd/tpm/src/subsystem/NvDynamic.c",
++        "TPMCmd/tpm/src/subsystem/NvReserved.c",
++        "TPMCmd/tpm/src/subsystem/Object.c",
++        "TPMCmd/tpm/src/subsystem/PCR.c",
++        "TPMCmd/tpm/src/subsystem/PP.c",
++        "TPMCmd/tpm/src/subsystem/Session.c",
++        "TPMCmd/tpm/src/subsystem/Time.c",
++        "TPMCmd/tpm/src/support/AlgorithmCap.c",
++        "TPMCmd/tpm/src/support/Bits.c",
++        "TPMCmd/tpm/src/support/CommandCodeAttributes.c",
++        "TPMCmd/tpm/src/support/Entity.c",
++        "TPMCmd/tpm/src/support/Handle.c",
++        "TPMCmd/tpm/src/support/IoBuffers.c",
++        "TPMCmd/tpm/src/support/Locality.c",
++        "TPMCmd/tpm/src/support/Manufacture.c",
++        "TPMCmd/tpm/src/support/Marshal.c",
++        "TPMCmd/tpm/src/support/MathOnByteBuffers.c",
++        "TPMCmd/tpm/src/support/Memory.c",
++        "TPMCmd/tpm/src/support/Power.c",
++        "TPMCmd/tpm/src/support/PropertyCap.c",
++        "TPMCmd/tpm/src/support/Response.c",
++        "TPMCmd/tpm/src/support/ResponseCodeProcessing.c",
++        "TPMCmd/tpm/src/support/TpmFail.c",
++        "TPMCmd/tpm/src/support/TpmSizeChecks.c",
++    ],
++    copts = [
++        # from internal/include.c
++        # "-D_CRYPT_HASH_C_",
++        # "-D_X509_SPT_",
++        # from internal/internal_cgo.go
++        "-fno-delete-null-pointer-checks",
++        "-fwrapv",
++        "-fno-sanitize=all", # relax sanitizer checks for this test-only dependency
++        "-DALG_SHA512=ALG_YES",
++        "-DCERTIFYX509_DEBUG=NO",
++        "-DCOMPILER_CHECKS=DEBUG",
++        "-DDEBUG=YES",
++        "-DECC_NIST_P224=YES",
++        "-DECC_NIST_P521=YES",
++        "-DMAX_CONTEXT_SIZE=1360",
++        "-DRUNTIME_SIZE_CHECKS=DEBUG",
++        "-DSIMULATION=NO",
++        "-DUSE_DA_USED=NO",
++        "-DVTPM=NO -DSIMULATION=NO -DUSE_DA_USED=NO",
++        "-I Samples/Google",
++        "-I TPMCmd/tpm/include",
++        "-I TPMCmd/tpm/include/prototypes",
++        "-I TPMCmd/tpm/src",
++        "-Wno-deprecated-declarations",
++        "-Wno-missing-braces -Wno-empty-body -Wno-unused-variable -Wno-uninitialized",
++        "-std=gnu11 -Wall -Wformat-security -fPIC",
++    ],
++    deps = [
++        ":ms_tpm_20_ref_google_samples",
++        "@org_openssl//:openssl",
++    ],
++)
++
++cc_library(
++    name = "ms_tpm_20_ref_google_samples",
++    visibility = ["//visibility:public"],
++    hdrs = [
++        "Samples/Google/PlatformData.h",
++        "Samples/Google/Platform.h",
++        "Samples/Google/Platform_fp.h",
++    ],
++    strip_include_prefix = "Samples/Google",
++    deps = [
++        ":ms_tpm_20_ref_include",
++        ":ms_tpm_20_ref_include_prototypes",
++    ],
++)
++
++cc_library(
++    name = "ms_tpm_20_ref_include",
++    visibility = ["//visibility:public"],
++    hdrs = [
++        "TPMCmd/tpm/include/Global.h",
++        "TPMCmd/tpm/include/TpmAlgorithmDefines.h",
++        "TPMCmd/tpm/include/HashTestData.h",
++        "TPMCmd/tpm/include/CryptSym.h",
++        "TPMCmd/tpm/include/TPMB.h",
++        "TPMCmd/tpm/include/GpMacros.h",
++        "TPMCmd/tpm/include/X509.h",
++        "TPMCmd/tpm/include/OIDs.h",
++        "TPMCmd/tpm/include/SymmetricTestData.h",
++        "TPMCmd/tpm/include/EccTestData.h",
++        "TPMCmd/tpm/include/TpmError.h",
++        "TPMCmd/tpm/include/CryptRand.h",
++        "TPMCmd/tpm/include/TpmTypes.h",
++        "TPMCmd/tpm/include/MinMax.h",
++        "TPMCmd/tpm/include/BaseTypes.h",
++        "TPMCmd/tpm/include/Tpm.h",
++        "TPMCmd/tpm/include/CompilerDependencies.h",
++        "TPMCmd/tpm/include/TpmProfile.h",
++        "TPMCmd/tpm/include/CryptTest.h",
++        "TPMCmd/tpm/include/LibSupport.h",
++        "TPMCmd/tpm/include/CryptHash.h",
++        "TPMCmd/tpm/include/SupportLibraryFunctionPrototypes_fp.h",
++        "TPMCmd/tpm/include/PRNG_TestVectors.h",
++        "TPMCmd/tpm/include/Capabilities.h",
++        "TPMCmd/tpm/include/CryptEcc.h",
++        "TPMCmd/tpm/include/CryptRsa.h",
++        "TPMCmd/tpm/include/VendorString.h",
++        "TPMCmd/tpm/include/CommandAttributeData.h",
++        "TPMCmd/tpm/include/CommandDispatcher.h",
++        "TPMCmd/tpm/include/BnValues.h",
++        "TPMCmd/tpm/include/HandleProcess.h",
++        "TPMCmd/tpm/include/SymmetricTest.h",
++        "TPMCmd/tpm/include/TpmBuildSwitches.h",
++        "TPMCmd/tpm/include/swap.h",
++        "TPMCmd/tpm/include/KdfTestData.h",
++        "TPMCmd/tpm/include/RsaTestData.h",
++        "TPMCmd/tpm/include/CommandAttributes.h",
++        "TPMCmd/tpm/include/CommandDispatchData.h",
++        "TPMCmd/tpm/include/Commands.h",
++        "TPMCmd/tpm/include/NV.h",
++        "TPMCmd/tpm/include/SelfTest.h",
++        "TPMCmd/tpm/include/InternalRoutines.h",
++        "TPMCmd/tpm/include/TpmASN1.h",
++        "TPMCmd/tpm/include/Wolf/user_settings.h",
++        "TPMCmd/tpm/include/Wolf/TpmToWolfHash.h",
++        "TPMCmd/tpm/include/Wolf/TpmToWolfMath.h",
++        "TPMCmd/tpm/include/Wolf/TpmToWolfSym.h",
++        "TPMCmd/tpm/include/Ltc/TpmToLtcSym.h",
++        "TPMCmd/tpm/include/Ltc/LtcSettings.h",
++        "TPMCmd/tpm/include/Ltc/TpmToLtcMath.h",
++        "TPMCmd/tpm/include/Ltc/TpmToLtcHash.h",
++        "TPMCmd/tpm/include/Ossl/TpmToOsslMath.h",
++        "TPMCmd/tpm/include/Ossl/TpmToOsslSym.h",
++        "TPMCmd/tpm/include/Ossl/TpmToOsslHash.h",
++    ],
++    strip_include_prefix = "TPMCmd/tpm/include",
++)
++
++cc_library(
++    name = "ms_tpm_20_ref_include_prototypes",
++    visibility = ["//visibility:public"],
++    hdrs = [
++        "TPMCmd/tpm/include/prototypes/CryptSym_fp.h",
++        "TPMCmd/tpm/include/prototypes/ChangePPS_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyDuplicationSelect_fp.h",
++        "TPMCmd/tpm/include/prototypes/Unseal_fp.h",
++        "TPMCmd/tpm/include/prototypes/HierarchyChangeAuth_fp.h",
++        "TPMCmd/tpm/include/prototypes/Session_fp.h",
++        "TPMCmd/tpm/include/prototypes/ClockSet_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyCounterTimer_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_ChangeAuth_fp.h",
++        "TPMCmd/tpm/include/prototypes/CommandAudit_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptRsa_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptSelfTest_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptRand_fp.h",
++        "TPMCmd/tpm/include/prototypes/X509_RSA_fp.h",
++        "TPMCmd/tpm/include/prototypes/Object_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToOsslMath_fp.h",
++        "TPMCmd/tpm/include/prototypes/CreateLoaded_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyPhysicalPresence_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptEccMain_fp.h",
++        "TPMCmd/tpm/include/prototypes/Commit_fp.h",
++        "TPMCmd/tpm/include/prototypes/ActivateCredential_fp.h",
++        "TPMCmd/tpm/include/prototypes/Power_fp.h",
++        "TPMCmd/tpm/include/prototypes/BnMemory_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_WriteLock_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyPCR_fp.h",
++        "TPMCmd/tpm/include/prototypes/BnConvert_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyPassword_fp.h",
++        "TPMCmd/tpm/include/prototypes/SessionProcess_fp.h",
++        "TPMCmd/tpm/include/prototypes/ClearControl_fp.h",
++        "TPMCmd/tpm/include/prototypes/ResponseCodeProcessing_fp.h",
++        "TPMCmd/tpm/include/prototypes/DictionaryAttackParameters_fp.h",
++        "TPMCmd/tpm/include/prototypes/EncryptDecrypt_fp.h",
++        "TPMCmd/tpm/include/prototypes/MAC_Start_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_GlobalWriteLock_fp.h",
++        "TPMCmd/tpm/include/prototypes/LoadExternal_fp.h",
++        "TPMCmd/tpm/include/prototypes/Import_fp.h",
++        "TPMCmd/tpm/include/prototypes/ContextSave_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptPrime_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyAuthorizeNV_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_ReadLock_fp.h",
++        "TPMCmd/tpm/include/prototypes/DictionaryAttackLockReset_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToLtcSupport_fp.h",
++        "TPMCmd/tpm/include/prototypes/GetRandom_fp.h",
++        "TPMCmd/tpm/include/prototypes/EvictControl_fp.h",
++        "TPMCmd/tpm/include/prototypes/ChangeEPS_fp.h",
++        "TPMCmd/tpm/include/prototypes/RSA_Decrypt_fp.h",
++        "TPMCmd/tpm/include/prototypes/FirmwareRead_fp.h",
++        "TPMCmd/tpm/include/prototypes/Create_fp.h",
++        "TPMCmd/tpm/include/prototypes/HMAC_Start_fp.h",
++        "TPMCmd/tpm/include/prototypes/Context_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/StartAuthSession_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_Read_fp.h",
++        "TPMCmd/tpm/include/prototypes/ClockRateAdjust_fp.h",
++        "TPMCmd/tpm/include/prototypes/SetCommandCodeAuditStatus_fp.h",
++        "TPMCmd/tpm/include/prototypes/EncryptDecrypt2_fp.h",
++        "TPMCmd/tpm/include/prototypes/Clear_fp.h",
++        "TPMCmd/tpm/include/prototypes/Handle_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptCmac_fp.h",
++        "TPMCmd/tpm/include/prototypes/EncryptDecrypt_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyNV_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptEccSignature_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptDes_fp.h",
++        "TPMCmd/tpm/include/prototypes/Manufacture_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyAuthValue_fp.h",
++        "TPMCmd/tpm/include/prototypes/CertifyCreation_fp.h",
++        "TPMCmd/tpm/include/prototypes/EC_Ephemeral_fp.h",
++        "TPMCmd/tpm/include/prototypes/_TPM_Hash_End_fp.h",
++        "TPMCmd/tpm/include/prototypes/Duplicate_fp.h",
++        "TPMCmd/tpm/include/prototypes/PropertyCap_fp.h",
++        "TPMCmd/tpm/include/prototypes/X509_ECC_fp.h",
++        "TPMCmd/tpm/include/prototypes/VerifySignature_fp.h",
++        "TPMCmd/tpm/include/prototypes/Policy_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToWolfDesSupport_fp.h",
++        "TPMCmd/tpm/include/prototypes/HierarchyControl_fp.h",
++        "TPMCmd/tpm/include/prototypes/SetAlgorithmSet_fp.h",
++        "TPMCmd/tpm/include/prototypes/Ticket_fp.h",
++        "TPMCmd/tpm/include/prototypes/Response_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_Extend_fp.h",
++        "TPMCmd/tpm/include/prototypes/ZGen_2Phase_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToLtcDesSupport_fp.h",
++        "TPMCmd/tpm/include/prototypes/HashSequenceStart_fp.h",
++        "TPMCmd/tpm/include/prototypes/AC_GetCapability_fp.h",
++        "TPMCmd/tpm/include/prototypes/SelfTest_fp.h",
++        "TPMCmd/tpm/include/prototypes/FlushContext_fp.h",
++        "TPMCmd/tpm/include/prototypes/GetSessionAuditDigest_fp.h",
++        "TPMCmd/tpm/include/prototypes/Hierarchy_fp.h",
++        "TPMCmd/tpm/include/prototypes/PP_Commands_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToWolfMath_fp.h",
++        "TPMCmd/tpm/include/prototypes/EventSequenceComplete_fp.h",
++        "TPMCmd/tpm/include/prototypes/RsaKeyCache_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_SetAuthPolicy_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicySecret_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptEccKeyExchange_fp.h",
++        "TPMCmd/tpm/include/prototypes/SequenceUpdate_fp.h",
++        "TPMCmd/tpm/include/prototypes/Marshal_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_Increment_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToWolfSupport_fp.h",
++        "TPMCmd/tpm/include/prototypes/HMAC_fp.h",
++        "TPMCmd/tpm/include/prototypes/GetTime_fp.h",
++        "TPMCmd/tpm/include/prototypes/FieldUpgradeStart_fp.h",
++        "TPMCmd/tpm/include/prototypes/ExecCommand_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_Extend_fp.h",
++        "TPMCmd/tpm/include/prototypes/Load_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyCpHash_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptUtil_fp.h",
++        "TPMCmd/tpm/include/prototypes/TestParms_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToOsslDesSupport_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmASN1_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToLtcMath_fp.h",
++        "TPMCmd/tpm/include/prototypes/MakeCredential_fp.h",
++        "TPMCmd/tpm/include/prototypes/ECDH_KeyGen_fp.h",
++        "TPMCmd/tpm/include/prototypes/GetCapability_fp.h",
++        "TPMCmd/tpm/include/prototypes/DA_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_UndefineSpaceSpecial_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_SetAuthValue_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyNvWritten_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptHash_fp.h",
++        "TPMCmd/tpm/include/prototypes/Bits_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptSmac_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_Read_fp.h",
++        "TPMCmd/tpm/include/prototypes/ECDH_ZGen_fp.h",
++        "TPMCmd/tpm/include/prototypes/CryptPrimeSieve_fp.h",
++        "TPMCmd/tpm/include/prototypes/Attest_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmFail_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_Write_fp.h",
++        "TPMCmd/tpm/include/prototypes/ECC_Parameters_fp.h",
++        "TPMCmd/tpm/include/prototypes/Object_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/_TPM_Hash_Start_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyGetDigest_fp.h",
++        "TPMCmd/tpm/include/prototypes/Sign_fp.h",
++        "TPMCmd/tpm/include/prototypes/ContextLoad_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyTemplate_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmSizeChecks_fp.h",
++        "TPMCmd/tpm/include/prototypes/Policy_AC_SendSelect_fp.h",
++        "TPMCmd/tpm/include/prototypes/X509_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_Certify_fp.h",
++        "TPMCmd/tpm/include/prototypes/GetTestResult_fp.h",
++        "TPMCmd/tpm/include/prototypes/CertifyX509_fp.h",
++        "TPMCmd/tpm/include/prototypes/Vendor_TCG_Test_fp.h",
++        "TPMCmd/tpm/include/prototypes/ReadPublic_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_SetBits_fp.h",
++        "TPMCmd/tpm/include/prototypes/Quote_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyCommandCode_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyOR_fp.h",
++        "TPMCmd/tpm/include/prototypes/IoBuffers_fp.h",
++        "TPMCmd/tpm/include/prototypes/NvReserved_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_DefineSpace_fp.h",
++        "TPMCmd/tpm/include/prototypes/Rewrap_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyRestart_fp.h",
++        "TPMCmd/tpm/include/prototypes/Hash_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_UndefineSpace_fp.h",
++        "TPMCmd/tpm/include/prototypes/AlgorithmTests_fp.h",
++        "TPMCmd/tpm/include/prototypes/BnMath_fp.h",
++        "TPMCmd/tpm/include/prototypes/Time_fp.h",
++        "TPMCmd/tpm/include/prototypes/Certify_fp.h",
++        "TPMCmd/tpm/include/prototypes/MathOnByteBuffers_fp.h",
++        "TPMCmd/tpm/include/prototypes/AC_spt_fp.h",
++        "TPMCmd/tpm/include/prototypes/Startup_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyNameHash_fp.h",
++        "TPMCmd/tpm/include/prototypes/NvDynamic_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicySigned_fp.h",
++        "TPMCmd/tpm/include/prototypes/AlgorithmCap_fp.h",
++        "TPMCmd/tpm/include/prototypes/CommandCodeAttributes_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyTicket_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_Reset_fp.h",
++        "TPMCmd/tpm/include/prototypes/IncrementalSelfTest_fp.h",
++        "TPMCmd/tpm/include/prototypes/GetCommandAuditDigest_fp.h",
++        "TPMCmd/tpm/include/prototypes/CommandDispatcher_fp.h",
++        "TPMCmd/tpm/include/prototypes/AC_Send_fp.h",
++        "TPMCmd/tpm/include/prototypes/Locality_fp.h",
++        "TPMCmd/tpm/include/prototypes/_TPM_Init_fp.h",
++        "TPMCmd/tpm/include/prototypes/FieldUpgradeData_fp.h",
++        "TPMCmd/tpm/include/prototypes/PP_fp.h",
++        "TPMCmd/tpm/include/prototypes/SetPrimaryPolicy_fp.h",
++        "TPMCmd/tpm/include/prototypes/RSA_Encrypt_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyAuthorize_fp.h",
++        "TPMCmd/tpm/include/prototypes/NV_ReadPublic_fp.h",
++        "TPMCmd/tpm/include/prototypes/_TPM_Hash_Data_fp.h",
++        "TPMCmd/tpm/include/prototypes/SequenceComplete_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_Event_fp.h",
++        "TPMCmd/tpm/include/prototypes/ObjectChangeAuth_fp.h",
++        "TPMCmd/tpm/include/prototypes/PCR_Allocate_fp.h",
++        "TPMCmd/tpm/include/prototypes/StirRandom_fp.h",
++        "TPMCmd/tpm/include/prototypes/CreatePrimary_fp.h",
++        "TPMCmd/tpm/include/prototypes/PolicyLocality_fp.h",
++        "TPMCmd/tpm/include/prototypes/TpmToOsslSupport_fp.h",
++        "TPMCmd/tpm/include/prototypes/Memory_fp.h",
++        "TPMCmd/tpm/include/prototypes/ReadClock_fp.h",
++        "TPMCmd/tpm/include/prototypes/Shutdown_fp.h",
++        "TPMCmd/tpm/include/prototypes/Entity_fp.h",
++        "TPMCmd/tpm/include/prototypes/MAC_fp.h",
++    ],
++    strip_include_prefix = "TPMCmd/tpm/include/prototypes",
++)

3rdparty/bazel/com_github_google_go_tpm_tools/placeholder/BUILD.bazel

@@ -0,0 +1,12 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+cc_library(
+    name = "ms_tpm_20_ref_disabled",
+    srcs = ["ms_tpm_20_disabled.c"],
+    hdrs = [
+        "Platform.h",
+        "Tpm.h",
+    ],
+    includes = ["."],
+    visibility = ["//visibility:public"],
+)

3rdparty/bazel/com_github_google_go_tpm_tools/placeholder/Platform.h

@@ -0,0 +1,22 @@
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+extern int g_inFailureMode;
+
+typedef union {
+	uint16_t      size;
+	uint8_t       *buffer;
+} TPM2B, TPM2B_SEED;
+typedef struct
+{
+    TPM2B_SEED          EPSeed;
+    TPM2B_SEED          SPSeed;
+    TPM2B_SEED          PPSeed;
+} PERSISTENT_DATA;
+
+extern PERSISTENT_DATA  gp;
+
+void _plat__Reset(bool forceManufacture);
+void _plat__RunCommand(uint32_t requestSize, unsigned char *request,
+                       uint32_t *responseSize, unsigned char **response);

3rdparty/bazel/com_github_google_go_tpm_tools/placeholder/Tpm.h

@@ -0,0 +1,27 @@
+#undef TRUE
+#define TRUE                1
+#undef FALSE
+#define FALSE               0
+#undef YES
+#define YES                 1
+#undef NO
+#define NO                  0
+#undef SET
+#define SET                 1
+#undef CLEAR
+#define CLEAR               0
+#ifndef MAX_RESPONSE_SIZE
+#define MAX_RESPONSE_SIZE               4096
+#endif
+
+#ifndef EPSeed
+#define EPSeed 1
+#endif
+#ifndef SPSeed
+#define SPSeed 1
+#endif
+#ifndef PPSeed
+#define PPSeed 1
+#endif
+
+#define NV_SYNC_PERSISTENT(x)

3rdparty/bazel/com_github_google_go_tpm_tools/placeholder/ms_tpm_20_disabled.c

@@ -0,0 +1,9 @@
+#include "Platform.h"
+#include "Tpm.h"
+
+int g_inFailureMode = 0;
+
+void _plat__Reset(bool forceManufacture) {}
+
+void _plat__RunCommand(uint32_t requestSize, unsigned char *request,
+                       uint32_t *responseSize, unsigned char **response) {}

3rdparty/bazel/com_github_martinjungblut_go_cryptsetup/com_github_martinjungblut_go_cryptsetup.patch

@@ -0,0 +1,12 @@
+--- BUILD.bazel
++++ BUILD.bazel
+@@ -14,6 +14,9 @@
+         "plain.go",
+     ],
+     cgo = True,
++    cdeps = [
++        "@//rpm:cryptsetup",
++    ],
+     importpath = "github.com/martinjungblut/go-cryptsetup",
+     visibility = ["//visibility:public"],
+ )

3rdparty/bazel/org_libvirt_go_libvirt/go_libvirt.need

@@ -0,0 +1,129 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "libvirt",
+    srcs = [
+        "callbacks.go",
+        "callbacks_helper.go",
+        "callbacks_helper.h",
+        "connect.go",
+        "connect_helper.go",
+        "connect_helper.h",
+        "doc.go",
+        "domain.go",
+        "domain_checkpoint.go",
+        "domain_events.go",
+        "domain_events_helper.go",
+        "domain_events_helper.h",
+        "domain_snapshot.go",
+        "error.go",
+        "error_helper.go",
+        "error_helper.h",
+        "events.go",
+        "events_helper.go",
+        "events_helper.h",
+        "interface.go",
+        "libvirt_generated.h",
+        "libvirt_generated_callbacks.h",
+        "libvirt_generated_dlopen.h",
+        "libvirt_generated_enums.h",
+        "libvirt_generated_functions.h",
+        "libvirt_generated_functions_static_common.go",
+        "libvirt_generated_functions_static_domain.go",
+        "libvirt_generated_functions_static_domain_checkpoint.go",
+        "libvirt_generated_functions_static_domain_snapshot.go",
+        "libvirt_generated_functions_static_event.go",
+        "libvirt_generated_functions_static_host.go",
+        "libvirt_generated_functions_static_interface.go",
+        "libvirt_generated_functions_static_network.go",
+        "libvirt_generated_functions_static_nodedev.go",
+        "libvirt_generated_functions_static_nwfilter.go",
+        "libvirt_generated_functions_static_secret.go",
+        "libvirt_generated_functions_static_storage.go",
+        "libvirt_generated_functions_static_stream.go",
+        "libvirt_generated_functions_static_virterror.go",
+        "libvirt_generated_macros.h",
+        "libvirt_generated_structs.h",
+        "libvirt_generated_typedefs.h",
+        "libvirt_generated_variables.h",
+        "libvirt_lxc_generated.h",
+        "libvirt_lxc_generated_callbacks.h",
+        "libvirt_lxc_generated_dlopen.h",
+        "libvirt_lxc_generated_enums.h",
+        "libvirt_lxc_generated_functions.h",
+        "libvirt_lxc_generated_functions_static.go",
+        "libvirt_lxc_generated_macros.h",
+        "libvirt_lxc_generated_structs.h",
+        "libvirt_lxc_generated_typedefs.h",
+        "libvirt_lxc_generated_variables.h",
+        "libvirt_qemu_generated.h",
+        "libvirt_qemu_generated_callbacks.h",
+        "libvirt_qemu_generated_dlopen.h",
+        "libvirt_qemu_generated_enums.h",
+        "libvirt_qemu_generated_functions.h",
+        "libvirt_qemu_generated_functions_static.go",
+        "libvirt_qemu_generated_macros.h",
+        "libvirt_qemu_generated_structs.h",
+        "libvirt_qemu_generated_typedefs.h",
+        "libvirt_qemu_generated_variables.h",
+        "lxc.go",
+        "network.go",
+        "network_events.go",
+        "network_events_helper.go",
+        "network_events_helper.h",
+        "network_port.go",
+        "node_device.go",
+        "node_device_events.go",
+        "node_device_events_helper.go",
+        "node_device_events_helper.h",
+        "nwfilter.go",
+        "nwfilter_binding.go",
+        "qemu.go",
+        "qemu_helper.go",
+        "qemu_helper.h",
+        "secret.go",
+        "secret_events.go",
+        "secret_events_helper.go",
+        "secret_events_helper.h",
+        "storage_pool.go",
+        "storage_pool_events.go",
+        "storage_pool_events_helper.go",
+        "storage_pool_events_helper.h",
+        "storage_volume.go",
+        "stream.go",
+        "stream_helper.go",
+        "stream_helper.h",
+        "typedparams.go",
+    ],
+    cdeps = [
+        "@//rpm:libvirt",
+    ],
+    cgo = True,
+    importpath = "libvirt.org/go/libvirt",
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":libvirt",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "libvirt_test",
+    srcs = [
+        "common_test.go",
+        "connect_test.go",
+        "domain_events_test.go",
+        "domain_test.go",
+        "interface_test.go",
+        "network_events_test.go",
+        "network_test.go",
+        "node_device_events_test.go",
+        "storage_pool_events_test.go",
+        "storage_pool_test.go",
+        "storage_volume_test.go",
+        "typedparams_test.go",
+    ],
+    embed = [":libvirt"],
+)

3rdparty/bazel/org_libvirt_go_libvirt/go_libvirt.orig

@@ -0,0 +1,126 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "libvirt",
+    srcs = [
+        "callbacks.go",
+        "callbacks_helper.go",
+        "callbacks_helper.h",
+        "connect.go",
+        "connect_helper.go",
+        "connect_helper.h",
+        "doc.go",
+        "domain.go",
+        "domain_checkpoint.go",
+        "domain_events.go",
+        "domain_events_helper.go",
+        "domain_events_helper.h",
+        "domain_snapshot.go",
+        "error.go",
+        "error_helper.go",
+        "error_helper.h",
+        "events.go",
+        "events_helper.go",
+        "events_helper.h",
+        "interface.go",
+        "libvirt_generated.h",
+        "libvirt_generated_callbacks.h",
+        "libvirt_generated_dlopen.h",
+        "libvirt_generated_enums.h",
+        "libvirt_generated_functions.h",
+        "libvirt_generated_functions_static_common.go",
+        "libvirt_generated_functions_static_domain.go",
+        "libvirt_generated_functions_static_domain_checkpoint.go",
+        "libvirt_generated_functions_static_domain_snapshot.go",
+        "libvirt_generated_functions_static_event.go",
+        "libvirt_generated_functions_static_host.go",
+        "libvirt_generated_functions_static_interface.go",
+        "libvirt_generated_functions_static_network.go",
+        "libvirt_generated_functions_static_nodedev.go",
+        "libvirt_generated_functions_static_nwfilter.go",
+        "libvirt_generated_functions_static_secret.go",
+        "libvirt_generated_functions_static_storage.go",
+        "libvirt_generated_functions_static_stream.go",
+        "libvirt_generated_functions_static_virterror.go",
+        "libvirt_generated_macros.h",
+        "libvirt_generated_structs.h",
+        "libvirt_generated_typedefs.h",
+        "libvirt_generated_variables.h",
+        "libvirt_lxc_generated.h",
+        "libvirt_lxc_generated_callbacks.h",
+        "libvirt_lxc_generated_dlopen.h",
+        "libvirt_lxc_generated_enums.h",
+        "libvirt_lxc_generated_functions.h",
+        "libvirt_lxc_generated_functions_static.go",
+        "libvirt_lxc_generated_macros.h",
+        "libvirt_lxc_generated_structs.h",
+        "libvirt_lxc_generated_typedefs.h",
+        "libvirt_lxc_generated_variables.h",
+        "libvirt_qemu_generated.h",
+        "libvirt_qemu_generated_callbacks.h",
+        "libvirt_qemu_generated_dlopen.h",
+        "libvirt_qemu_generated_enums.h",
+        "libvirt_qemu_generated_functions.h",
+        "libvirt_qemu_generated_functions_static.go",
+        "libvirt_qemu_generated_macros.h",
+        "libvirt_qemu_generated_structs.h",
+        "libvirt_qemu_generated_typedefs.h",
+        "libvirt_qemu_generated_variables.h",
+        "lxc.go",
+        "network.go",
+        "network_events.go",
+        "network_events_helper.go",
+        "network_events_helper.h",
+        "network_port.go",
+        "node_device.go",
+        "node_device_events.go",
+        "node_device_events_helper.go",
+        "node_device_events_helper.h",
+        "nwfilter.go",
+        "nwfilter_binding.go",
+        "qemu.go",
+        "qemu_helper.go",
+        "qemu_helper.h",
+        "secret.go",
+        "secret_events.go",
+        "secret_events_helper.go",
+        "secret_events_helper.h",
+        "storage_pool.go",
+        "storage_pool_events.go",
+        "storage_pool_events_helper.go",
+        "storage_pool_events_helper.h",
+        "storage_volume.go",
+        "stream.go",
+        "stream_helper.go",
+        "stream_helper.h",
+        "typedparams.go",
+    ],
+    cgo = True,
+    importpath = "libvirt.org/go/libvirt",
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":libvirt",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "libvirt_test",
+    srcs = [
+        "common_test.go",
+        "connect_test.go",
+        "domain_events_test.go",
+        "domain_test.go",
+        "interface_test.go",
+        "network_events_test.go",
+        "network_test.go",
+        "node_device_events_test.go",
+        "storage_pool_events_test.go",
+        "storage_pool_test.go",
+        "storage_volume_test.go",
+        "typedparams_test.go",
+    ],
+    embed = [":libvirt"],
+)

3rdparty/bazel/org_libvirt_go_libvirt/go_libvirt.patch

@@ -0,0 +1,12 @@
+--- BUILD.bazel
++++ BUILD.bazel
+@@ -95,6 +95,9 @@
+         "stream_helper.h",
+         "typedparams.go",
+     ],
++    cdeps = [
++        "@//rpm:libvirt",
++    ],
+     cgo = True,
+     importpath = "libvirt.org/go/libvirt",
+     visibility = ["//visibility:public"],

3rdparty/bazel/org_openssl/BUILD.bazel

@@ -0,0 +1,39 @@
+load("@bazel_skylib//rules:build_test.bzl", "build_test")
+load("@rules_cc//cc:defs.bzl", "cc_test")
+
+exports_files(
+    [
+        "BUILD.openssl.bazel",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+cc_test(
+    name = "openssl_test",
+    srcs = ["openssl_test.cc"],
+    linkopts = select({
+        "@org_openssl//:msvc_compiler": [
+            "advapi32.lib",
+            "user32.lib",
+        ],
+        "//conditions:default": [],
+    }),
+    deps = ["@org_openssl//:openssl"],
+)
+
+build_test(
+    name = "build_test",
+    targets = [
+        "@org_openssl//:openssl",
+    ],
+    visibility = ["//:__pkg__"],
+)
+
+test_suite(
+    name = "openssl_test_suite",
+    tests = [
+        ":build_test",
+        ":openssl_test",
+    ],
+    visibility = ["//:__pkg__"],
+)

3rdparty/bazel/org_openssl/BUILD.nasm.bazel

@@ -0,0 +1,17 @@
+load("@bazel_skylib//rules:select_file.bzl", "select_file")
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(
+        include = ["**"],
+        exclude = ["*.bazel"],
+    ),
+)
+
+select_file(
+    name = "nasm",
+    srcs = ":all_srcs",
+    subpath = "nasm.exe",
+)

3rdparty/bazel/org_openssl/BUILD.openssl.bazel

@@ -0,0 +1,125 @@
+"""An openssl build file based on a snippet found in the github issue:
+https://github.com/bazelbuild/rules_foreign_cc/issues/337
+
+Note that the $(PERL) "make variable" (https://docs.bazel.build/versions/main/be/make-variables.html)
+is populated by the perl toolchain provided by rules_perl.
+"""
+
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make", "configure_make_variant")
+
+# Read https://wiki.openssl.org/index.php/Compilation_and_Installation
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(
+        include = ["**"],
+        exclude = ["*.bazel"],
+    ),
+)
+
+CONFIGURE_OPTIONS = [
+    "no-comp",
+    "no-idea",
+    "no-weak-ssl-ciphers",
+    "no-tests",
+]
+
+LIB_NAME = "openssl"
+
+MAKE_TARGETS = [
+    "build_programs",
+    "install_sw",
+]
+
+config_setting(
+    name = "msvc_compiler",
+    flag_values = {
+        "@bazel_tools//tools/cpp:compiler": "msvc-cl",
+    },
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "openssl",
+    actual = select({
+        ":msvc_compiler": "openssl_msvc",
+        "//conditions:default": "openssl_default",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+configure_make_variant(
+    name = "openssl_msvc",
+    build_data = [
+        "@nasm//:nasm",
+    ],
+    configure_command = "Configure",
+    configure_in_place = True,
+    configure_options = CONFIGURE_OPTIONS + [
+        "VC-WIN64A",
+        # Unset Microsoft Assembler (MASM) flags set by built-in MSVC toolchain,
+        # as NASM is unsed to build OpenSSL rather than MASM
+        "ASFLAGS=\" \"",
+    ],
+    configure_prefix = "$$PERL",
+    env = {
+        # The Zi flag must be set otherwise OpenSSL fails to build due to missing .pdb files
+        "CFLAGS": "-Zi",
+        "PATH": "$$(dirname $(execpath @nasm//:nasm))",
+        "PERL": "$$EXT_BUILD_ROOT$$/$(PERL)",
+    },
+    lib_name = LIB_NAME,
+    lib_source = ":all_srcs",
+    out_binaries = ["openssl.exe"],
+    out_interface_libs = [
+        "libssl.lib",
+        "libcrypto.lib",
+    ],
+    out_shared_libs = [
+        "libssl-1_1-x64.dll",
+        "libcrypto-1_1-x64.dll",
+    ],
+    targets = MAKE_TARGETS,
+    toolchain = "@rules_foreign_cc//toolchains:preinstalled_nmake_toolchain",
+    toolchains = ["@rules_perl//:current_toolchain"],
+)
+
+configure_make(
+    name = "openssl_default",
+    configure_command = "config",
+    configure_in_place = True,
+    configure_options = CONFIGURE_OPTIONS,
+    env = select({
+        "@platforms//os:macos": {
+            "AR": "",
+            "PERL": "$$EXT_BUILD_ROOT$$/$(PERL)",
+        },
+        "//conditions:default": {
+            "PERL": "$$EXT_BUILD_ROOT$$/$(PERL)",
+        },
+    }),
+    lib_name = LIB_NAME,
+    lib_source = ":all_srcs",
+    out_binaries = ["openssl"],
+    # Note that for Linux builds, libssl must come before libcrypto on the linker command-line.
+    # As such, libssl must be listed before libcrypto
+    out_shared_libs = select({
+        "@platforms//os:macos": [
+            "libssl.1.1.dylib",
+            "libcrypto.1.1.dylib",
+        ],
+        "//conditions:default": [
+            "libssl.so.1.1",
+            "libcrypto.so.1.1",
+        ],
+    }),
+    targets = MAKE_TARGETS,
+    toolchains = ["@rules_perl//:current_toolchain"],
+)
+
+filegroup(
+    name = "gen_dir",
+    srcs = [":openssl"],
+    output_group = "gen_dir",
+    visibility = ["//visibility:public"],
+)

3rdparty/bazel/org_openssl/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

3rdparty/bazel/org_openssl/openssl_repositories.bzl

@@ -0,0 +1,39 @@
+"""A module defining the third party dependency OpenSSL"""
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+
+def openssl_repositories():
+    maybe(
+        http_archive,
+        name = "org_openssl",
+        build_file = Label("//3rdparty/bazel/org_openssl:BUILD.openssl.bazel"),
+        sha256 = "c5ac01e760ee6ff0dab61d6b2bbd30146724d063eb322180c6f18a6f74e4b6aa",
+        strip_prefix = "openssl-1.1.1s",
+        urls = [
+            "https://www.openssl.org/source/openssl-1.1.1s.tar.gz",
+            "https://github.com/openssl/openssl/archive/OpenSSL_1_1_1s.tar.gz",
+        ],
+    )
+
+    maybe(
+        http_archive,
+        name = "nasm",
+        build_file = Label("//3rdparty/bazel/org_openssl:BUILD.nasm.bazel"),
+        sha256 = "f5c93c146f52b4f1664fa3ce6579f961a910e869ab0dae431bd871bdd2584ef2",
+        strip_prefix = "nasm-2.15.05",
+        urls = [
+            "https://mirror.bazel.build/www.nasm.us/pub/nasm/releasebuilds/2.15.05/win64/nasm-2.15.05-win64.zip",
+            "https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/win64/nasm-2.15.05-win64.zip",
+        ],
+    )
+
+    maybe(
+        http_archive,
+        name = "rules_perl",
+        sha256 = "24957cea0a43ee70bff9b78256698a0a11e89455483b30b4c41d1f6bfd20d269",
+        strip_prefix = "rules_perl-db026ffa0d89fdff97de0c27199d84bd2c3b696c",
+        urls = [
+            "https://github.com/malt3/rules_perl/archive/db026ffa0d89fdff97de0c27199d84bd2c3b696c.tar.gz",
+        ],
+    )

3rdparty/bazel/org_openssl/openssl_setup.bzl

@@ -0,0 +1,7 @@
+"""A module initialising the third party dependencies OpenSSL"""
+
+load("@rules_perl//perl:deps.bzl", "perl_register_toolchains", "perl_rules_dependencies")
+
+def openssl_setup():
+    perl_rules_dependencies()
+    perl_register_toolchains()

3rdparty/bazel/org_openssl/openssl_test.cc

@@ -0,0 +1,53 @@
+#include <openssl/sha.h>
+
+#include <cassert>
+#include <iomanip>
+#include <sstream>
+#include <string>
+
+// Use (void) to silent unused warnings.
+#define assertm(exp, msg) assert(((void)msg, exp))
+
+// From https://stackoverflow.com/a/2262447/7768383
+bool simpleSHA256(const void* input, unsigned long length, unsigned char* md)
+{
+    SHA256_CTX context;
+    if (!SHA256_Init(&context))
+        return false;
+
+    if (!SHA256_Update(&context, (unsigned char*)input, length))
+        return false;
+
+    if (!SHA256_Final(md, &context))
+        return false;
+
+    return true;
+}
+
+// Convert an byte array into a string
+std::string fromByteArray(const unsigned char* data, unsigned long length)
+{
+    std::stringstream shastr;
+    shastr << std::hex << std::setfill('0');
+    for (unsigned long i = 0; i < length; ++i)
+    {
+        shastr << std::setw(2) << static_cast<int>(data[i]);
+    }
+
+    return shastr.str();
+}
+
+std::string MESSAGE = "hello world";
+std::string MESSAGE_HASH = "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9";
+
+int main(int argc, char* argv[])
+{
+    unsigned char md[SHA256_DIGEST_LENGTH] = {};
+
+    assertm(simpleSHA256(static_cast<const void*>(MESSAGE.data()), MESSAGE.size(), md), "Failed to generate hash");
+    std::string hash = fromByteArray(md, SHA256_DIGEST_LENGTH);
+
+    assertm(hash == MESSAGE_HASH, "Unexpected message hash");
+
+    return 0;
+}

3rdparty/node-maintenance-operator/api/v1beta1/BUILD.bazel

@@ -0,0 +1,19 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "v1beta1",
+    srcs = [
+        "groupversion_info.go",
+        "nodemaintenance_types.go",
+        "v1beta1.go",
+        "zz_generated.deepcopy.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/3rdparty/node-maintenance-operator/api/v1beta1",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_sigs_controller_runtime//pkg/scheme",
+    ],
+)

BUILD.bazel

@@ -2,14 +2,23 @@ load("@bazel_gazelle//:def.bzl", "gazelle")
 load("@bazeldnf//:def.bzl", "bazeldnf")
 load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier", "buildifier_test")
 
-# gazelle:prefix github.com/edgelesssys/constellation
+# gazelle:map_kind go_test go_test //bazel/go:go_test.bzl
+# gazelle:prefix github.com/edgelesssys/constellation/v2
 gazelle(name = "gazelle")
 
+gazelle(
+    name = "gazelle-check",
+    command = "fix",
+    mode = "diff",
+)
+
 gazelle(
     name = "gazelle-update-repos",
     args = [
         "-from_file=go.work",
         "-to_macro=toolchains/go_module_deps.bzl%go_dependencies",
+        "-build_file_proto_mode=disable_global",
+        "-build_file_generation=on",
         "-prune",
     ],
     command = "update-repos",

CMakeLists.txt

@@ -1,17 +1,7 @@
 cmake_minimum_required(VERSION 3.11)
-
-# WARNING: This is only executed when running `cmake`.
-# Therefore, to update the version number, one needs to run `cmake` first.
-execute_process(COMMAND bash -c "go run ${CMAKE_SOURCE_DIR}/hack/pseudo-version/. | tr -d '\n'"
-    OUTPUT_VARIABLE PSEUDO_VERSION)
-
-project(constellation LANGUAGES C VERSION 0.0.0)
-
-if (${PROJECT_VERSION} STREQUAL "0.0.0")
-  set(PROJECT_VERSION ${PSEUDO_VERSION})
-endif()
-
+project(constellation LANGUAGES C)
 set(CLI_BUILD_TAGS "" CACHE STRING "Tags passed to go build of Constellation CLI.")
+set(BAZEL "bazel" CACHE STRING "Path to bazel binary.")
 
 enable_testing()
 
@@ -19,7 +9,9 @@ enable_testing()
 # disk-mapper
 #
 add_custom_target(disk-mapper ALL
-  DOCKER_BUILDKIT=1 docker build -o ${CMAKE_BINARY_DIR} --build-arg PROJECT_VERSION="${PROJECT_VERSION}" -f Dockerfile.build --target disk-mapper .
+  COMMAND ${BAZEL} build //disk-mapper/cmd:cmd
+  COMMAND cp \$$\(${BAZEL} cquery --output=files //disk-mapper/cmd:cmd\) ${CMAKE_BINARY_DIR}/disk-mapper
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/disk-mapper
   WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS disk-mapper
 )
@@ -28,7 +20,9 @@ add_custom_target(disk-mapper ALL
 # measurement-reader
 #
 add_custom_target(measurement-reader ALL
-  DOCKER_BUILDKIT=1 docker build -o ${CMAKE_BINARY_DIR} --build-arg PROJECT_VERSION="${PROJECT_VERSION}" -f Dockerfile.build --target measurement-reader .
+  COMMAND ${BAZEL} build //measurement-reader/cmd:cmd
+  COMMAND cp \$$\(${BAZEL} cquery --output=files //measurement-reader/cmd:cmd\) ${CMAKE_BINARY_DIR}/measurement-reader
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/measurement-reader
   WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS measurement-reader
 )
@@ -37,7 +31,9 @@ add_custom_target(measurement-reader ALL
 # bootstrapper
 #
 add_custom_target(bootstrapper ALL
-  DOCKER_BUILDKIT=1 docker build -o ${CMAKE_BINARY_DIR} --build-arg PROJECT_VERSION="${PROJECT_VERSION}" -f Dockerfile.build --target bootstrapper .
+  COMMAND ${BAZEL} build //bootstrapper/cmd/bootstrapper:bootstrapper
+  COMMAND cp \$$\(${BAZEL} cquery --output=files //bootstrapper/cmd/bootstrapper:bootstrapper\) ${CMAKE_BINARY_DIR}/bootstrapper
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/bootstrapper
   WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS bootstrapper
 )
@@ -46,7 +42,9 @@ add_custom_target(bootstrapper ALL
 # upgrade-agent
 #
 add_custom_target(upgrade-agent ALL
-  DOCKER_BUILDKIT=1 docker build -o ${CMAKE_BINARY_DIR} --build-arg PROJECT_VERSION="${PROJECT_VERSION}" -f Dockerfile.build --target upgrade-agent .
+  COMMAND ${BAZEL} build //upgrade-agent/cmd:cmd
+  COMMAND cp \$$\(${BAZEL} cquery --output=files //upgrade-agent/cmd:cmd\) ${CMAKE_BINARY_DIR}/upgrade-agent
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/upgrade-agent
   WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS upgrade-agent
 )
@@ -55,26 +53,21 @@ add_custom_target(upgrade-agent ALL
 # cli
 #
 add_custom_target(cli ALL
-  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/constellation -tags='${CLI_BUILD_TAGS}' -ldflags "-buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}"
-  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/cli
+  COMMAND ${BAZEL} build --@io_bazel_rules_go//go/config:tags='${CLI_BUILD_TAGS}' --platforms=@local_config_platform//:host //cli:cli_oss
+  COMMAND cp \$$\(${BAZEL} cquery --@io_bazel_rules_go//go/config:tags='${CLI_BUILD_TAGS}' --platforms=@local_config_platform//:host --output=files //cli:cli_oss\) ${CMAKE_BINARY_DIR}/constellation
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/constellation
+  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS constellation
 )
 
-#
-# testing / debugging
-#
-add_custom_target(debug_bootstrapper
-  go build -o ${CMAKE_BINARY_DIR}/debug_bootstrapper -buildvcs=false -ldflags "-buildid='' -X main.version=${PROJECT_VERSION}"
-  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/bootstrapper/cmd/bootstrapper
-  BYPRODUCTS debug_bootstrapper
-)
-
 #
 # debugd
 #
 add_custom_target(debugd ALL
-  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/debugd -buildvcs=false -ldflags "-buildid=''"
-  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/debugd/cmd/debugd
+  COMMAND ${BAZEL} build //debugd/cmd/debugd:debugd
+  COMMAND cp \$$\(${BAZEL} cquery --output=files //debugd/cmd/debugd:debugd\) ${CMAKE_BINARY_DIR}/debugd
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/debugd
+  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS debugd
 )
 
@@ -82,8 +75,10 @@ add_custom_target(debugd ALL
 # cdbg
 #
 add_custom_target(cdbg ALL
-  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/cdbg -buildvcs=false -ldflags "-buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}"
-  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/debugd/cmd/cdbg
+  COMMAND ${BAZEL} build --platforms=@local_config_platform//:host //debugd/cmd/cdbg:cdbg
+  COMMAND cp \$$\(${BAZEL} cquery --platforms=@local_config_platform//:host --output=files //debugd/cmd/cdbg:cdbg\) ${CMAKE_BINARY_DIR}/cdbg
+  COMMAND chmod +w ${CMAKE_BINARY_DIR}/cdbg
+  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   BYPRODUCTS cdbg
 )
 
@@ -97,6 +92,9 @@ add_test(NAME integration-license COMMAND bash -c "go test -tags integration" WO
 # format
 #
 add_custom_target(format
+  COMMAND bash -c "${BAZEL} run //:buildifier-fix"
+  COMMAND bash -c "${BAZEL} run //:gazelle"
+  COMMAND bash -c "${BAZEL} run //:gazelle-update-repos"
   COMMAND bash -c "shfmt -i 2 -s -w -sr $(shfmt -f ${CMAKE_SOURCE_DIR} | grep -v helm/charts/cilium)"
   COMMAND bash -c "gofumpt -l -w ${CMAKE_SOURCE_DIR}"
   VERBATIM

WORKSPACE.bazel

@@ -2,17 +2,6 @@ load("//toolchains:java_deps.bzl", "java_deps")
 
 java_deps()
 
-# proto toolchain
-load("//toolchains:proto_deps.bzl", "proto_deps")
-
-proto_deps()
-
-load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
-
-rules_proto_dependencies()
-
-rules_proto_toolchains()
-
 # Go toolchain
 load("//toolchains:go_rules_deps.bzl", "go_deps")
 
@@ -33,6 +22,17 @@ gazelle_dependencies(go_repository_default_config = "//:WORKSPACE.bazel")
 
 # gazelle:repo bazel_gazelle
 
+# proto toolchain
+load("//toolchains:proto_deps.bzl", "proto_deps")
+
+proto_deps()
+
+load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
+
+rules_proto_dependencies()
+
+rules_proto_toolchains()
+
 # dnf / rpm toolchain
 
 load("//toolchains:dnf_deps.bzl", "dnf_deps")
@@ -60,7 +60,18 @@ zig_cc_deps()
 
 load("@bazel-zig-cc//toolchain:defs.bzl", zig_toolchains = "toolchains")
 
-zig_toolchains()
+# See https://ziglang.org/download/ for the latest releases
+
+zig_toolchains(
+    host_platform_sha256 = {
+        "linux-aarch64": "b759a11993949531c692ccfc3d1a004b14df714a7a3515fe0b5c90c9a7631d61",
+        "linux-x86_64": "028dad5189e02b2058679b64df16e854a1c1ca0e6044b334d4f3be6e35544f07",
+        "macos-aarch64": "5709c27d581988f50f5e6fd5b69d92707787e803a1d04992e290b764617664e6",
+        "macos-x86_64": "88d194adb2f3c1a9edbb4a24d018007d5f827a57d1d26b2d9f3459236da1b7b6",
+        "windows-x86_64": "75e510bda108e4d78b89d5d1d09e70ea8595fac7c43b5611f280668881adb09d",
+    },
+    version = "0.11.0-dev.1638+7199d7c77",
+)
 
 register_toolchains(
     "@zig_sdk//libc_aware/toolchain:linux_amd64_gnu.2.34",
@@ -76,6 +87,29 @@ register_toolchains(
     "@zig_sdk//toolchain:windows_amd64",
 )
 
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_foreign_cc",
+    sha256 = "2a4d07cd64b0719b39a7c12218a3e507672b82a97b98c6a89d38565894cf7c51",
+    strip_prefix = "rules_foreign_cc-0.9.0",
+    url = "https://github.com/bazelbuild/rules_foreign_cc/archive/refs/tags/0.9.0.tar.gz",
+)
+
+load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
+
+# This sets up some common toolchains for building targets. For more details, please see
+# https://bazelbuild.github.io/rules_foreign_cc/0.9.0/flatten.html#rules_foreign_cc_dependencies
+rules_foreign_cc_dependencies()
+
+load("//3rdparty/bazel/org_openssl:openssl_repositories.bzl", "openssl_repositories")
+
+openssl_repositories()
+
+load("//3rdparty/bazel/org_openssl:openssl_setup.bzl", "openssl_setup")
+
+openssl_setup()
+
 # Packaging rules (tar)
 load("//toolchains:pkg_deps.bzl", "pkg_deps")
 

bazel/go/go_test.bzl

@@ -0,0 +1,105 @@
+"""
+This module contains rules and macros for building and testing Go code.
+"""
+
+load("@io_bazel_rules_go//go:def.bzl", _go_test = "go_test")
+
+def go_test(ld = None, **kwargs):
+    """go_test is a wrapper for go_test that uses default settings for Constellation.
+
+    It adds the following:
+    - Sets test count to 3.
+    - Sets race detector to on by default.
+    - Optionally sets the interpreter path to ld.
+
+    Args:
+          ld: path to interpreter to that will be written into the elf header.
+          **kwargs: all other arguments are passed to go_test.
+    """
+
+    # Sets test count to 3.
+    kwargs.setdefault("args", [])
+    kwargs["args"].append("--test.count=3")
+
+    # enable race detector by default
+    kwargs.setdefault("race", "on")
+
+    # set gc_linkopts to set the interpreter path to ld.
+    kwargs.setdefault("gc_linkopts", [])
+    if ld:
+        kwargs["gc_linkopts"] += ["-I", ld]
+
+    _go_test(**kwargs)
+
+def _vars_script(env, ld, cmd):
+    ret = ["#!/bin/sh"]
+    for k, v in env.items():
+        ret.append('export {}="{}"'.format(k, v))
+    ret.append('exec {} {} "$@"'.format(ld, cmd))
+    return "\n".join(ret) + "\n"
+
+def _ld_binary_impl(ctx):
+    source_info = ctx.attr.src[DefaultInfo]
+    ld_info = ctx.attr.ld[DefaultInfo]
+
+    executable = None
+    if source_info.files_to_run and source_info.files_to_run.executable:
+        command = _vars_script(ctx.attr.env, ld_info.files_to_run.executable.short_path, source_info.files_to_run.executable.short_path)
+        executable = ctx.actions.declare_file("{}_under_ld".format(ctx.file.src.basename))
+        ctx.actions.write(
+            output = executable,
+            content = command,
+            is_executable = True,
+        )
+
+    runfiles = ctx.runfiles(files = ctx.files.src)
+    runfiles = runfiles.merge(source_info.data_runfiles)
+    runfiles = runfiles.merge(ctx.runfiles(files = ctx.files.ld))
+    runfiles = runfiles.merge(ld_info.data_runfiles)
+    return [DefaultInfo(
+        executable = executable,
+        files = depset([executable]),
+        runfiles = runfiles,
+    )]
+
+_attrs = {
+    "env": attr.string_dict(
+        doc = "Environment variables for the test",
+    ),
+    "ld": attr.label(
+        executable = True,
+        cfg = "exec",
+        doc = "ld wrapper executable",
+    ),
+    "src": attr.label(
+        allow_single_file = True,
+        mandatory = True,
+        doc = "Target to build.",
+    ),
+}
+
+ld_test = rule(
+    implementation = _ld_binary_impl,
+    attrs = _attrs,
+    executable = True,
+    test = True,
+)
+
+def go_ld_test(**kwargs):
+    """go_ld_test is a wrapper for go_test that uses the specified ld to run the test binary under.
+
+    Args:
+          **kwargs: all arguments are passed to go_test.
+    """
+
+    # Sets test count to 3.
+    kwargs.setdefault("args", [])
+    kwargs["args"].append("--test.count=3")
+
+    # Disable test wrapper
+    kwargs.setdefault("env", {})
+    kwargs["env"]["GO_TEST_WRAP"] = "0"
+
+    ld_test(
+        **kwargs
+    )

bazel/settings/BUILD.bazel

@@ -0,0 +1,35 @@
+load("@bazel_skylib//rules:common_settings.bzl", "bool_flag", "string_flag")
+
+bool_flag(
+    # tpm_simulator is used to decide if the TPM simulator should be enabled
+    # and linked into the build.
+    #
+    # You can set enable at the command line with "$ bazel build
+    # --//bazel/settings:tpm_simulator ..."
+    # or in a .bazelrc file with "build --//bazel/settings:tpm_simulator".
+    # for details.
+    name = "tpm_simulator",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "tpm_simulator_enabled",
+    flag_values = {":tpm_simulator": "True"},
+    visibility = ["//visibility:public"],
+)
+
+string_flag(
+    # cryptsetup_provider is used to decide if you want to link against the
+    # cryptsetup library provided by the host system or the one provided by
+    # the Fedora RPMs.
+    # You can set this at the command line with "$ bazel build
+    # --//bazel/settings:cryptsetup_provider ..."
+    # or in a .bazelrc file with "build --//bazel/settings:cryptsetup_provider".
+    # for details.
+    name = "cryptsetup_provider",
+    build_setting_default = "fedora_rpm",
+    values = [
+        "fedora_rpm",
+        "host",
+    ],
+)

bootstrapper/cmd/bootstrapper/BUILD.bazel

@@ -0,0 +1,56 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "bootstrapper_lib",
+    srcs = [
+        "main.go",
+        "run.go",
+        "test.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/cmd/bootstrapper",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//bootstrapper/internal/clean",
+        "//bootstrapper/internal/diskencryption",
+        "//bootstrapper/internal/helm",
+        "//bootstrapper/internal/initserver",
+        "//bootstrapper/internal/joinclient",
+        "//bootstrapper/internal/kubernetes",
+        "//bootstrapper/internal/kubernetes/k8sapi",
+        "//bootstrapper/internal/kubernetes/kubewaiter",
+        "//bootstrapper/internal/logging",
+        "//bootstrapper/internal/nodelock",
+        "//internal/atls",
+        "//internal/attestation/choose",
+        "//internal/attestation/simulator",
+        "//internal/attestation/vtpm",
+        "//internal/cloud/aws",
+        "//internal/cloud/azure",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcp",
+        "//internal/cloud/metadata",
+        "//internal/cloud/qemu",
+        "//internal/constants",
+        "//internal/file",
+        "//internal/grpc/dialer",
+        "//internal/kubernetes/kubectl",
+        "//internal/logger",
+        "//internal/oid",
+        "//internal/role",
+        "//internal/versions/components",
+        "@com_github_spf13_afero//:afero",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/apis/kubeadm/v1beta3",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_binary(
+    name = "bootstrapper",
+    embed = [":bootstrapper_lib"],
+    # keep
+    gotags = select({
+        "//bazel/settings:tpm_simulator_enabled": [],
+        "//conditions:default": ["disable_tpm_simulator"],
+    }),
+    visibility = ["//visibility:public"],
+)

bootstrapper/initproto/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "initproto_proto",
+    srcs = ["init.proto"],
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "initproto_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/initproto",
+    proto = ":initproto_proto",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "initproto",
+    embed = [":initproto_go_proto"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/initproto",
+    visibility = ["//visibility:public"],
+)

bootstrapper/internal/certificate/BUILD.bazel

@@ -0,0 +1,9 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "certificate",
+    srcs = ["certificate.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/certificate",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = ["@io_k8s_kubernetes//cmd/kubeadm/app/constants"],
+)

bootstrapper/internal/clean/BUILD.bazel

@@ -0,0 +1,19 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "clean",
+    srcs = ["clean.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/clean",
+    visibility = ["//bootstrapper:__subpackages__"],
+)
+
+go_test(
+    name = "clean_test",
+    srcs = ["clean_test.go"],
+    embed = [":clean"],
+    deps = [
+        "@com_github_stretchr_testify//assert",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

bootstrapper/internal/diskencryption/BUILD.bazel

@@ -0,0 +1,33 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_ld_test", "go_test")
+
+go_library(
+    name = "diskencryption",
+    srcs = ["diskencryption.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/diskencryption",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "@com_github_martinjungblut_go_cryptsetup//:go-cryptsetup",
+        "@com_github_spf13_afero//:afero",
+    ],
+)
+
+go_test(
+    name = "diskencryption_test",
+    srcs = ["diskencryption_test.go"],
+    embed = [":diskencryption"],
+    # keep
+    tags = ["manual"],
+    deps = [
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)
+
+go_ld_test(
+    name = "diskencryption_ld_test",
+    src = "diskencryption_test",
+    ld = "//rpm:ld",
+)

bootstrapper/internal/helm/BUILD.bazel

@@ -0,0 +1,29 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "helm",
+    srcs = ["helm.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/helm",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//bootstrapper/internal/kubernetes/k8sapi",
+        "//internal/constants",
+        "//internal/deploy/helm",
+        "//internal/logger",
+        "//internal/retry",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/util/wait",
+        "@org_uber_go_zap//:zap",
+        "@sh_helm_helm_v3//pkg/action",
+        "@sh_helm_helm_v3//pkg/chart",
+        "@sh_helm_helm_v3//pkg/chart/loader",
+        "@sh_helm_helm_v3//pkg/cli",
+    ],
+)
+
+go_test(
+    name = "helm_test",
+    srcs = ["helm_test.go"],
+    embed = [":helm"],
+)

bootstrapper/internal/initserver/BUILD.bazel

@@ -0,0 +1,62 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_ld_test", "go_test")
+
+go_library(
+    name = "initserver",
+    srcs = ["initserver.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/initserver",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//bootstrapper/initproto",
+        "//bootstrapper/internal/diskencryption",
+        "//internal/atls",
+        "//internal/attestation",
+        "//internal/attestation/azure/snp",
+        "//internal/crypto",
+        "//internal/file",
+        "//internal/grpc/atlscredentials",
+        "//internal/grpc/grpclog",
+        "//internal/kms/kms",
+        "//internal/kms/setup",
+        "//internal/logger",
+        "//internal/nodestate",
+        "//internal/role",
+        "//internal/versions/components",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//keepalive",
+        "@org_golang_google_grpc//status",
+        "@org_golang_x_crypto//bcrypt",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "initserver_test",
+    srcs = ["initserver_test.go"],
+    embed = [":initserver"],
+    # keep
+    tags = ["manual"],
+    deps = [
+        "//bootstrapper/initproto",
+        "//internal/atls",
+        "//internal/crypto/testvector",
+        "//internal/file",
+        "//internal/kms/setup",
+        "//internal/kms/uri",
+        "//internal/logger",
+        "//internal/oid",
+        "//internal/versions/components",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_x_crypto//bcrypt",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)
+
+go_ld_test(
+    name = "initserver_ld_test",
+    src = "initserver_test",
+    ld = "//rpm:ld",
+)

bootstrapper/internal/joinclient/BUILD.bazel

@@ -0,0 +1,61 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_ld_test", "go_test")
+
+go_library(
+    name = "joinclient",
+    srcs = ["joinclient.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/joinclient",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//bootstrapper/internal/certificate",
+        "//bootstrapper/internal/diskencryption",
+        "//internal/attestation",
+        "//internal/cloud/metadata",
+        "//internal/constants",
+        "//internal/file",
+        "//internal/logger",
+        "//internal/nodestate",
+        "//internal/role",
+        "//internal/versions/components",
+        "//joinservice/joinproto",
+        "@com_github_spf13_afero//:afero",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/apis/kubeadm/v1beta3",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/constants",
+        "@io_k8s_utils//clock",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "joinclient_test",
+    srcs = ["joinclient_test.go"],
+    embed = [":joinclient"],
+    # keep
+    tags = ["manual"],
+    deps = [
+        "//internal/cloud/metadata",
+        "//internal/constants",
+        "//internal/file",
+        "//internal/grpc/atlscredentials",
+        "//internal/grpc/dialer",
+        "//internal/grpc/testdialer",
+        "//internal/logger",
+        "//internal/role",
+        "//internal/versions/components",
+        "//joinservice/joinproto",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/apis/kubeadm/v1beta3",
+        "@io_k8s_utils//clock/testing",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)
+
+go_ld_test(
+    name = "joinclient_ld_test",
+    src = "joinclient_test",
+    ld = "//rpm:ld",
+)

bootstrapper/internal/kubernetes/BUILD.bazel

@@ -0,0 +1,55 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "kubernetes",
+    srcs = [
+        "cloud_provider.go",
+        "k8sutil.go",
+        "kubernetes.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/kubernetes",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//bootstrapper/internal/kubernetes/k8sapi",
+        "//bootstrapper/internal/kubernetes/kubewaiter",
+        "//internal/attestation/measurements",
+        "//internal/cloud/azureshared",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcpshared",
+        "//internal/cloud/metadata",
+        "//internal/constants",
+        "//internal/deploy/helm",
+        "//internal/kubernetes",
+        "//internal/logger",
+        "//internal/role",
+        "//internal/versions/components",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/apis/kubeadm/v1beta3",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "kubernetes_test",
+    srcs = ["kubernetes_test.go"],
+    embed = [":kubernetes"],
+    deps = [
+        "//bootstrapper/internal/kubernetes/k8sapi",
+        "//bootstrapper/internal/kubernetes/kubewaiter",
+        "//internal/cloud/metadata",
+        "//internal/constants",
+        "//internal/deploy/helm",
+        "//internal/kubernetes",
+        "//internal/logger",
+        "//internal/role",
+        "//internal/versions",
+        "//internal/versions/components",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/apis/kubeadm/v1beta3",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

bootstrapper/internal/kubernetes/k8sapi/BUILD.bazel

@@ -0,0 +1,49 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "k8sapi",
+    srcs = [
+        "k8sapi.go",
+        "k8sutil.go",
+        "kubeadm_config.go",
+        "systemd.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/kubernetes/k8sapi",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//bootstrapper/internal/certificate",
+        "//bootstrapper/internal/kubernetes/k8sapi/resources",
+        "//internal/constants",
+        "//internal/crypto",
+        "//internal/file",
+        "//internal/installer",
+        "//internal/kubernetes",
+        "//internal/logger",
+        "//internal/role",
+        "//internal/versions/components",
+        "@com_github_coreos_go_systemd_v22//dbus",
+        "@com_github_spf13_afero//:afero",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apiserver//pkg/authentication/user",
+        "@io_k8s_kubelet//config/v1beta1",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/apis/kubeadm/v1beta3",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/constants",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "k8sapi_test",
+    srcs = ["kubeadm_config_test.go"],
+    embed = [":k8sapi"],
+    deps = [
+        "//internal/kubernetes",
+        "//internal/versions",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_kubernetes//cmd/kubeadm/app/util",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

bootstrapper/internal/kubernetes/k8sapi/resources/BUILD.bazel

@@ -0,0 +1,34 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "resources",
+    srcs = [
+        "auditpolicy.go",
+        "konnectivity.go",
+        "resources.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/kubernetes/k8sapi/resources",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//bootstrapper/internal/certificate",
+        "//internal/kubernetes",
+        "//internal/versions",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/util/intstr",
+        "@io_k8s_apiserver//pkg/apis/apiserver",
+        "@io_k8s_apiserver//pkg/apis/audit/v1:audit",
+    ],
+)
+
+go_test(
+    name = "resources_test",
+    srcs = ["auditpolicy_test.go"],
+    embed = [":resources"],
+    deps = [
+        "//internal/kubernetes",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)

bootstrapper/internal/kubernetes/kubewaiter/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "kubewaiter",
+    srcs = ["kubewaiter.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/kubernetes/kubewaiter",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = [
+        "//internal/retry",
+        "@io_k8s_api//core/v1:core",
+    ],
+)
+
+go_test(
+    name = "kubewaiter_test",
+    srcs = ["kubewaiter_test.go"],
+    embed = [":kubewaiter"],
+    deps = [
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_api//core/v1:core",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

bootstrapper/internal/logging/BUILD.bazel

@@ -0,0 +1,8 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "logging",
+    srcs = ["logger.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/logging",
+    visibility = ["//bootstrapper:__subpackages__"],
+)

bootstrapper/internal/nodelock/BUILD.bazel

@@ -0,0 +1,9 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "nodelock",
+    srcs = ["nodelock.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/bootstrapper/internal/nodelock",
+    visibility = ["//bootstrapper:__subpackages__"],
+    deps = ["//internal/attestation/vtpm"],
+)

cli/BUILD.bazel

@@ -0,0 +1,45 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+
+go_library(
+    name = "cli_lib",
+    srcs = ["main.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/cli",
+    visibility = ["//visibility:private"],
+    deps = ["//cli/cmd"],
+)
+
+# keep
+go_binary(
+    name = "cli_oss",
+    embed = [":cli_lib"],
+    pure = "on",
+    visibility = ["//visibility:public"],
+)
+
+# keep
+go_binary(
+    name = "cli_enterprise",
+    embed = [":cli_lib"],
+    gotags = ["enterprise"],
+    pure = "on",
+    visibility = ["//visibility:public"],
+)
+
+[
+    go_cross_binary(
+        name = "cli_%s_%s" % (edition, platform),
+        platform = "@io_bazel_rules_go//go/toolchain:" + platform,
+        target = ":cli_%s" % edition,
+        visibility = ["//visibility:public"],
+    )
+    for platform in [
+        "darwin_amd64",
+        "darwin_arm64",
+        "linux_amd64",
+        "linux_arm64",
+    ]
+    for edition in [
+        "oss",
+        "enterprise",
+    ]
+]

cli/cmd/BUILD.bazel

@@ -0,0 +1,13 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "cmd",
+    srcs = ["root.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/cmd",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//cli/internal/cmd",
+        "//internal/constants",
+        "@com_github_spf13_cobra//:cobra",
+    ],
+)

cli/internal/cloudcmd/BUILD.bazel

@@ -0,0 +1,99 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "cloudcmd",
+    srcs = [
+        "clients.go",
+        "cloudcmd.go",
+        "create.go",
+        "iam.go",
+        "rollback.go",
+        "terminate.go",
+        "upgrade.go",
+        "validators.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd",
+    visibility = ["//cli:__subpackages__"],
+    deps = [
+        "//cli/internal/clusterid",
+        "//cli/internal/helm",
+        "//cli/internal/iamid",
+        "//cli/internal/image",
+        "//cli/internal/libvirt",
+        "//cli/internal/terraform",
+        "//internal/atls",
+        "//internal/attestation/aws",
+        "//internal/attestation/azure/snp",
+        "//internal/attestation/azure/trustedlaunch",
+        "//internal/attestation/gcp",
+        "//internal/attestation/idkeydigest",
+        "//internal/attestation/measurements",
+        "//internal/attestation/qemu",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcpshared",
+        "//internal/compatibility",
+        "//internal/config",
+        "//internal/constants",
+        "//internal/kubernetes",
+        "//internal/kubernetes/kubectl",
+        "//internal/versions",
+        "//internal/versions/components",
+        "//internal/versionsapi",
+        "//operators/constellation-node-operator/api/v1alpha1",
+        "@com_github_hashicorp_terraform_json//:terraform-json",
+        "@com_github_spf13_cobra//:cobra",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_client_go//dynamic",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//tools/clientcmd",
+    ],
+)
+
+go_test(
+    name = "cloudcmd_test",
+    srcs = [
+        "clients_test.go",
+        "create_test.go",
+        "iam_test.go",
+        "rollback_test.go",
+        "terminate_test.go",
+        "upgrade_test.go",
+        "validators_test.go",
+    ],
+    embed = [":cloudcmd"],
+    deps = [
+        "//cli/internal/iamid",
+        "//cli/internal/terraform",
+        "//internal/atls",
+        "//internal/attestation/azure/snp",
+        "//internal/attestation/azure/trustedlaunch",
+        "//internal/attestation/gcp",
+        "//internal/attestation/idkeydigest",
+        "//internal/attestation/measurements",
+        "//internal/attestation/qemu",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcpshared",
+        "//internal/compatibility",
+        "//internal/config",
+        "//internal/constants",
+        "//internal/logger",
+        "//internal/versions",
+        "//internal/versions/components",
+        "//operators/constellation-node-operator/api/v1alpha1",
+        "@com_github_hashicorp_terraform_json//:terraform-json",
+        "@com_github_spf13_cobra//:cobra",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

cli/internal/clusterid/BUILD.bazel

@@ -0,0 +1,9 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "clusterid",
+    srcs = ["id.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/clusterid",
+    visibility = ["//cli:__subpackages__"],
+    deps = ["//internal/cloud/cloudprovider"],
+)

cli/internal/cmd/BUILD.bazel

@@ -0,0 +1,141 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "cmd",
+    srcs = [
+        "cloud.go",
+        "cmd.go",
+        "config.go",
+        "configfetchmeasurements.go",
+        "configgenerate.go",
+        "configinstancetypes.go",
+        "configkubernetesversions.go",
+        "create.go",
+        "iamcreate.go",
+        "iamdestroy.go",
+        "init.go",
+        "log.go",
+        "mini.go",
+        "minidown.go",
+        "miniup.go",
+        "recover.go",
+        "spinner.go",
+        "terminate.go",
+        "upgrade.go",
+        "upgradeapply.go",
+        "upgradecheck.go",
+        "userinteraction.go",
+        "validargs.go",
+        "verifier.go",
+        "verify.go",
+        "version.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/cmd",
+    visibility = ["//cli:__subpackages__"],
+    deps = [
+        "//bootstrapper/initproto",
+        "//cli/internal/cloudcmd",
+        "//cli/internal/clusterid",
+        "//cli/internal/helm",
+        "//cli/internal/iamid",
+        "//cli/internal/libvirt",
+        "//cli/internal/terraform",
+        "//disk-mapper/recoverproto",
+        "//internal/atls",
+        "//internal/attestation/measurements",
+        "//internal/cloud/azureshared",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcpshared",
+        "//internal/compatibility",
+        "//internal/config",
+        "//internal/config/instancetypes",
+        "//internal/constants",
+        "//internal/crypto",
+        "//internal/file",
+        "//internal/grpc/dialer",
+        "//internal/grpc/retry",
+        "//internal/kms/uri",
+        "//internal/kubernetes/kubectl",
+        "//internal/license",
+        "//internal/logger",
+        "//internal/retry",
+        "//internal/sigstore",
+        "//internal/versions",
+        "//internal/versionsapi",
+        "//internal/versionsapi/fetcher",
+        "//verify/verifyproto",
+        "@com_github_mattn_go_isatty//:go-isatty",
+        "@com_github_siderolabs_talos_pkg_machinery//config/encoder",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_spf13_cobra//:cobra",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_client_go//tools/clientcmd/api/latest",
+        "@io_k8s_sigs_yaml//:yaml",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//connectivity",
+        "@org_golang_x_mod//semver",
+        "@org_golang_x_sys//unix",
+        "@org_uber_go_zap//zapcore",
+    ],
+)
+
+go_test(
+    name = "cmd_test",
+    srcs = [
+        "cloud_test.go",
+        "configfetchmeasurements_test.go",
+        "configgenerate_test.go",
+        "create_test.go",
+        "iamcreate_test.go",
+        "iamdestroy_test.go",
+        "init_test.go",
+        "recover_test.go",
+        "spinner_test.go",
+        "terminate_test.go",
+        "upgradeapply_test.go",
+        "upgradecheck_test.go",
+        "userinteraction_test.go",
+        "validargs_test.go",
+        "verifier_test.go",
+        "verify_test.go",
+        "version_test.go",
+    ],
+    embed = [":cmd"],
+    deps = [
+        "//bootstrapper/initproto",
+        "//cli/internal/cloudcmd",
+        "//cli/internal/clusterid",
+        "//cli/internal/iamid",
+        "//disk-mapper/recoverproto",
+        "//internal/atls",
+        "//internal/attestation/measurements",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcpshared",
+        "//internal/config",
+        "//internal/constants",
+        "//internal/crypto/testvector",
+        "//internal/file",
+        "//internal/grpc/atlscredentials",
+        "//internal/grpc/dialer",
+        "//internal/grpc/testdialer",
+        "//internal/kms/uri",
+        "//internal/license",
+        "//internal/logger",
+        "//internal/oid",
+        "//internal/versions",
+        "//internal/versionsapi",
+        "//verify/verifyproto",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_spf13_cobra//:cobra",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@in_gopkg_yaml_v3//:yaml_v3",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_x_mod//semver",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

cli/internal/cmd/init_test.go

@@ -524,7 +524,7 @@ func (m *stubMerger) kubeconfigEnvVar() string {
 func defaultConfigWithExpectedMeasurements(t *testing.T, conf *config.Config, csp cloudprovider.Provider) *config.Config {
 	t.Helper()
 
-	conf.Image = "v0.0.0"
+	conf.Image = "v" + constants.VersionInfo()
 	conf.Name = "kubernetes"
 
 	switch csp {

cli/internal/cmd/userinteraction_test.go

@@ -57,6 +57,7 @@ func TestAskToConfirm(t *testing.T) {
 			cmd.SetErr(&bytes.Buffer{})
 			in := bytes.NewBufferString(tc.input)
 			cmd.SetIn(in)
+			cmd.SetArgs([]string{})
 
 			err := cmd.Execute()
 			assert.ErrorIs(err, tc.wantErr)

cli/internal/cmd/version.go

@@ -7,6 +7,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 package cmd
 
 import (
+	"runtime"
 	"runtime/debug"
 
 	"github.com/edgelesssys/constellation/v2/internal/constants"
@@ -27,14 +28,15 @@ func NewVersionCmd() *cobra.Command {
 
 func runVersion(cmd *cobra.Command, args []string) {
 	buildInfo, ok := debug.ReadBuildInfo()
-	if !ok {
-		cmd.PrintErrf("Unable to retrieve build info. Is buildvcs enabled?")
-		return
+	var commit, state, date, goVersion, compiler, platform string
+	if ok {
+		commit, state, date, goVersion, compiler, platform = parseBuildInfo(buildInfo)
+	} else {
+		commit, state, date, goVersion, compiler, platform = parseStamp()
 	}
 
-	commit, state, date, goVersion, compiler, platform := parseBuildInfo(buildInfo)
-
 	cmd.Printf("Version:\t%s (%s)\n", constants.VersionInfo(), constants.VersionBuild)
+	cmd.Printf("Edition:\t%s\n", constants.Edition)
 	cmd.Printf("GitCommit:\t%s\n", commit)
 	cmd.Printf("GitTreeState:\t%s\n", state)
 	cmd.Printf("BuildDate:\t%s\n", date)
@@ -43,6 +45,7 @@ func runVersion(cmd *cobra.Command, args []string) {
 	cmd.Printf("Platform:\t%s\n", platform)
 }
 
+// parseBuildInfo parses the build info from the debug info provided by setting the buildvcs flag.
 func parseBuildInfo(info *debug.BuildInfo) (commit, state, date, goVersion, compiler, platform string) {
 	var arch, os string
 	for idx := range info.Settings {
@@ -73,3 +76,14 @@ func parseBuildInfo(info *debug.BuildInfo) (commit, state, date, goVersion, comp
 	goVersion = info.GoVersion
 	return commit, state, date, goVersion, compiler, platform
 }
+
+// parseStamp parses the build info from the stamping information provided by Bazel.
+func parseStamp() (commit, state, date, goVersion, compiler, platform string) {
+	commit = constants.Commit()
+	state = constants.State()
+	date = constants.Timestamp()
+	goVersion = runtime.Version()
+	compiler = "bazel/gc"
+	platform = runtime.GOOS + "/" + runtime.GOARCH
+	return commit, state, date, goVersion, compiler, platform
+}

cli/internal/cmd/version_test.go

@@ -12,8 +12,9 @@ import (
 	"runtime/debug"
 	"testing"
 
-	"github.com/edgelesssys/constellation/v2/internal/constants"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/edgelesssys/constellation/v2/internal/constants"
 )
 
 func TestVersionCmd(t *testing.T) {
@@ -22,6 +23,7 @@ func TestVersionCmd(t *testing.T) {
 	cmd := NewVersionCmd()
 	b := &bytes.Buffer{}
 	cmd.SetOut(b)
+	cmd.SetArgs([]string{})
 
 	err := cmd.Execute()
 	assert.NoError(err)

cli/internal/helm/BUILD.bazel

@@ -0,0 +1,374 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "helm",
+    srcs = [
+        "backup.go",
+        "client.go",
+        "helm.go",
+        "loader.go",
+        "values.go",
+    ],
+    embedsrcs = [
+        "charts/cert-manager/Chart.yaml",
+        "charts/cert-manager/templates/NOTES.txt",
+        "charts/cert-manager/templates/_helpers.tpl",
+        "charts/cert-manager/templates/cainjector-deployment.yaml",
+        "charts/cert-manager/templates/cainjector-psp-clusterrole.yaml",
+        "charts/cert-manager/templates/cainjector-psp-clusterrolebinding.yaml",
+        "charts/cert-manager/templates/cainjector-psp.yaml",
+        "charts/cert-manager/templates/cainjector-rbac.yaml",
+        "charts/cert-manager/templates/cainjector-serviceaccount.yaml",
+        "charts/cert-manager/templates/crds.yaml",
+        "charts/cert-manager/templates/deployment.yaml",
+        "charts/cert-manager/templates/networkpolicy-egress.yaml",
+        "charts/cert-manager/templates/networkpolicy-webhooks.yaml",
+        "charts/cert-manager/templates/psp-clusterrole.yaml",
+        "charts/cert-manager/templates/psp-clusterrolebinding.yaml",
+        "charts/cert-manager/templates/psp.yaml",
+        "charts/cert-manager/templates/rbac.yaml",
+        "charts/cert-manager/templates/service.yaml",
+        "charts/cert-manager/templates/serviceaccount.yaml",
+        "charts/cert-manager/templates/servicemonitor.yaml",
+        "charts/cert-manager/templates/startupapicheck-job.yaml",
+        "charts/cert-manager/templates/startupapicheck-psp-clusterrole.yaml",
+        "charts/cert-manager/templates/startupapicheck-psp-clusterrolebinding.yaml",
+        "charts/cert-manager/templates/startupapicheck-psp.yaml",
+        "charts/cert-manager/templates/startupapicheck-rbac.yaml",
+        "charts/cert-manager/templates/startupapicheck-serviceaccount.yaml",
+        "charts/cert-manager/templates/webhook-config.yaml",
+        "charts/cert-manager/templates/webhook-deployment.yaml",
+        "charts/cert-manager/templates/webhook-mutating-webhook.yaml",
+        "charts/cert-manager/templates/webhook-psp-clusterrole.yaml",
+        "charts/cert-manager/templates/webhook-psp-clusterrolebinding.yaml",
+        "charts/cert-manager/templates/webhook-psp.yaml",
+        "charts/cert-manager/templates/webhook-rbac.yaml",
+        "charts/cert-manager/templates/webhook-service.yaml",
+        "charts/cert-manager/templates/webhook-serviceaccount.yaml",
+        "charts/cert-manager/templates/webhook-validating-webhook.yaml",
+        "charts/cert-manager/values.yaml",
+        "charts/cilium/.helmignore",
+        "charts/cilium/Chart.yaml",
+        "charts/cilium/LICENSE",
+        "charts/cilium/README.md",
+        "charts/cilium/README.md.gotmpl",
+        "charts/cilium/files/nodeinit/poststart-eni.bash",
+        "charts/cilium/files/nodeinit/prestop.bash",
+        "charts/cilium/files/nodeinit/startup.bash",
+        "charts/cilium/templates/NOTES.txt",
+        "charts/cilium/templates/_helpers.tpl",
+        "charts/cilium/templates/cilium-agent/clusterrole.yaml",
+        "charts/cilium/templates/cilium-agent/clusterrolebinding.yaml",
+        "charts/cilium/templates/cilium-agent/daemonset.yaml",
+        "charts/cilium/templates/cilium-agent/role.yaml",
+        "charts/cilium/templates/cilium-agent/rolebinding.yaml",
+        "charts/cilium/templates/cilium-agent/service.yaml",
+        "charts/cilium/templates/cilium-agent/serviceaccount.yaml",
+        "charts/cilium/templates/cilium-agent/servicemonitor.yaml",
+        "charts/cilium/templates/cilium-ca-secret.yaml",
+        "charts/cilium/templates/cilium-configmap.yaml",
+        "charts/cilium/templates/cilium-ingress-class.yaml",
+        "charts/cilium/templates/cilium-nodeinit/daemonset.yaml",
+        "charts/cilium/templates/cilium-operator/_helpers.tpl",
+        "charts/cilium/templates/cilium-operator/clusterrole.yaml",
+        "charts/cilium/templates/cilium-operator/clusterrolebinding.yaml",
+        "charts/cilium/templates/cilium-operator/deployment.yaml",
+        "charts/cilium/templates/cilium-operator/poddisruptionbudget.yaml",
+        "charts/cilium/templates/cilium-operator/role.yaml",
+        "charts/cilium/templates/cilium-operator/rolebinding.yaml",
+        "charts/cilium/templates/cilium-operator/secret.yaml",
+        "charts/cilium/templates/cilium-operator/service.yaml",
+        "charts/cilium/templates/cilium-operator/serviceaccount.yaml",
+        "charts/cilium/templates/cilium-operator/servicemonitor.yaml",
+        "charts/cilium/templates/cilium-preflight/clusterrole.yaml",
+        "charts/cilium/templates/cilium-preflight/clusterrolebinding.yaml",
+        "charts/cilium/templates/cilium-preflight/daemonset.yaml",
+        "charts/cilium/templates/cilium-preflight/deployment.yaml",
+        "charts/cilium/templates/cilium-preflight/poddisruptionbudget.yaml",
+        "charts/cilium/templates/cilium-preflight/serviceaccount.yaml",
+        "charts/cilium/templates/cilium-resource-quota.yaml",
+        "charts/cilium/templates/cilium-secrets-namespace.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/clusterrole.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/clusterrolebinding.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/deployment.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/poddisruptionbudget.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/service.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/serviceaccount.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-certmanager/_helpers.tpl",
+        "charts/cilium/templates/clustermesh-apiserver/tls-certmanager/admin-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-certmanager/client-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-certmanager/clustermesh-apiserver-issuer.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-certmanager/remote-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-certmanager/server-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/_job-spec.tpl",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/ca-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/cronjob.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/job.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/role.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/rolebinding.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-cronjob/serviceaccount.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-helm/_helpers.tpl",
+        "charts/cilium/templates/clustermesh-apiserver/tls-helm/admin-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-helm/ca-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-helm/client-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-helm/remote-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-provided/admin-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-provided/ca-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-provided/client-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-provided/remote-secret.yaml",
+        "charts/cilium/templates/clustermesh-apiserver/tls-provided/server-secret.yaml",
+        "charts/cilium/templates/clustermesh-config/_helpers.tpl",
+        "charts/cilium/templates/clustermesh-config/clustermesh-secret.yaml",
+        "charts/cilium/templates/etcd-operator/cilium-etcd-operator-clusterrole.yaml",
+        "charts/cilium/templates/etcd-operator/cilium-etcd-operator-clusterrolebinding.yaml",
+        "charts/cilium/templates/etcd-operator/cilium-etcd-operator-deployment.yaml",
+        "charts/cilium/templates/etcd-operator/cilium-etcd-operator-serviceaccount.yaml",
+        "charts/cilium/templates/etcd-operator/etcd-operator-clusterrole.yaml",
+        "charts/cilium/templates/etcd-operator/etcd-operator-clusterrolebinding.yaml",
+        "charts/cilium/templates/etcd-operator/etcd-operator-serviceaccount.yaml",
+        "charts/cilium/templates/etcd-operator/poddisruptionbudget.yaml",
+        "charts/cilium/templates/hubble-relay/configmap.yaml",
+        "charts/cilium/templates/hubble-relay/deployment.yaml",
+        "charts/cilium/templates/hubble-relay/metrics-service.yaml",
+        "charts/cilium/templates/hubble-relay/poddisruptionbudget.yaml",
+        "charts/cilium/templates/hubble-relay/service.yaml",
+        "charts/cilium/templates/hubble-relay/serviceaccount.yaml",
+        "charts/cilium/templates/hubble-relay/servicemonitor.yaml",
+        "charts/cilium/templates/hubble-ui/_nginx.tpl",
+        "charts/cilium/templates/hubble-ui/clusterrole.yaml",
+        "charts/cilium/templates/hubble-ui/clusterrolebinding.yaml",
+        "charts/cilium/templates/hubble-ui/configmap.yaml",
+        "charts/cilium/templates/hubble-ui/deployment.yaml",
+        "charts/cilium/templates/hubble-ui/ingress.yaml",
+        "charts/cilium/templates/hubble-ui/poddisruptionbudget.yaml",
+        "charts/cilium/templates/hubble-ui/service.yaml",
+        "charts/cilium/templates/hubble-ui/serviceaccount.yaml",
+        "charts/cilium/templates/hubble/metrics-service.yaml",
+        "charts/cilium/templates/hubble/peer-service.yaml",
+        "charts/cilium/templates/hubble/servicemonitor.yaml",
+        "charts/cilium/templates/hubble/tls-certmanager/_helpers.tpl",
+        "charts/cilium/templates/hubble/tls-certmanager/hubble-issuer.yaml",
+        "charts/cilium/templates/hubble/tls-certmanager/relay-client-secret.yaml",
+        "charts/cilium/templates/hubble/tls-certmanager/relay-server-secret.yaml",
+        "charts/cilium/templates/hubble/tls-certmanager/server-secret.yaml",
+        "charts/cilium/templates/hubble/tls-certmanager/ui-client-certs.yaml",
+        "charts/cilium/templates/hubble/tls-cronjob/_job-spec.tpl",
+        "charts/cilium/templates/hubble/tls-cronjob/ca-secret.yaml",
+        "charts/cilium/templates/hubble/tls-cronjob/clusterrole.yaml",
+        "charts/cilium/templates/hubble/tls-cronjob/clusterrolebinding.yaml",
+        "charts/cilium/templates/hubble/tls-cronjob/cronjob.yaml",
+        "charts/cilium/templates/hubble/tls-cronjob/job.yaml",
+        "charts/cilium/templates/hubble/tls-cronjob/serviceaccount.yaml",
+        "charts/cilium/templates/hubble/tls-helm/_helpers.tpl",
+        "charts/cilium/templates/hubble/tls-helm/ca-secret.yaml",
+        "charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml",
+        "charts/cilium/templates/hubble/tls-helm/relay-server-secret.yaml",
+        "charts/cilium/templates/hubble/tls-helm/server-secret.yaml",
+        "charts/cilium/templates/hubble/tls-helm/ui-client-certs.yaml",
+        "charts/cilium/templates/hubble/tls-provided/ca-secret.yaml",
+        "charts/cilium/templates/hubble/tls-provided/relay-client-secret.yaml",
+        "charts/cilium/templates/hubble/tls-provided/relay-server-secret.yaml",
+        "charts/cilium/templates/hubble/tls-provided/server-secret.yaml",
+        "charts/cilium/templates/hubble/tls-provided/ui-client-certs.yaml",
+        "charts/cilium/templates/validate.yaml",
+        "charts/cilium/values.yaml",
+        "charts/cilium/values.yaml.tmpl",
+        "charts/edgeless/constellation-services/.helmignore",
+        "charts/edgeless/constellation-services/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/.helmignore",
+        "charts/edgeless/constellation-services/charts/autoscaler/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/aws-deployment.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/azure-deployment.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/azure-secret.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/clusterrole.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/clusterrolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/gcp-deployment.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/poddisruptionbudget.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/role.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/rolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/service.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/templates/serviceaccount.yaml",
+        "charts/edgeless/constellation-services/charts/autoscaler/values.schema.json",
+        "charts/edgeless/constellation-services/charts/autoscaler/values.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/_helpers.tpl",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/crd-csi-snapshot.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/csi-azuredisk-controller.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/csi-azuredisk-driver.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/csi-azuredisk-node.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/csi-snapshot-controller.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/rbac-csi-azuredisk-controller.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/rbac-csi-azuredisk-node.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/rbac-csi-snapshot-controller.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/serviceaccount-csi-azuredisk-controller.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/serviceaccount-csi-azuredisk-node.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/serviceaccount-csi-snapshot-controller.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/storageclass_default.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/templates/storageclass_integrity.yaml",
+        "charts/edgeless/constellation-services/charts/azuredisk-csi-driver/values.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/.helmignore",
+        "charts/edgeless/constellation-services/charts/ccm/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/aws-daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/azure-daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/azure-secret.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/clusterrolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/gcp-cm.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/gcp-daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/gcp-secret.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/templates/serviceaccount.yaml",
+        "charts/edgeless/constellation-services/charts/ccm/values.schema.json",
+        "charts/edgeless/constellation-services/charts/ccm/values.yaml",
+        "charts/edgeless/constellation-services/charts/cnm/.helmignore",
+        "charts/edgeless/constellation-services/charts/cnm/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/cnm/templates/azure-daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/cnm/templates/clusterrole.yaml",
+        "charts/edgeless/constellation-services/charts/cnm/templates/clusterrolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/cnm/templates/serviceaccount.yaml",
+        "charts/edgeless/constellation-services/charts/cnm/values.schema.json",
+        "charts/edgeless/constellation-services/charts/cnm/values.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/cluster_setup.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/controller.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/node.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/storageclass_default.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/storageclass_integrity.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/v1_csidriver.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/values.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-guest-agent/.helmignore",
+        "charts/edgeless/constellation-services/charts/gcp-guest-agent/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-guest-agent/templates/daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/gcp-guest-agent/values.schema.json",
+        "charts/edgeless/constellation-services/charts/gcp-guest-agent/values.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/.helmignore",
+        "charts/edgeless/constellation-services/charts/join-service/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/templates/clusterrole.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/templates/clusterrolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/templates/configmap.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/templates/daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/templates/service.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/templates/serviceaccount.yaml",
+        "charts/edgeless/constellation-services/charts/join-service/values.schema.json",
+        "charts/edgeless/constellation-services/charts/join-service/values.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/.helmignore",
+        "charts/edgeless/constellation-services/charts/key-service/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/templates/clusterrole.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/templates/clusterrolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/templates/daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/templates/mastersecret.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/templates/service.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/templates/serviceaccount.yaml",
+        "charts/edgeless/constellation-services/charts/key-service/values.schema.json",
+        "charts/edgeless/constellation-services/charts/key-service/values.yaml",
+        "charts/edgeless/constellation-services/charts/konnectivity/.helmignore",
+        "charts/edgeless/constellation-services/charts/konnectivity/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/konnectivity/templates/clusterrolebinding.yaml",
+        "charts/edgeless/constellation-services/charts/konnectivity/templates/daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/konnectivity/templates/serviceaccount.yaml",
+        "charts/edgeless/constellation-services/charts/konnectivity/values.schema.json",
+        "charts/edgeless/constellation-services/charts/konnectivity/values.yaml",
+        "charts/edgeless/constellation-services/charts/verification-service/.helmignore",
+        "charts/edgeless/constellation-services/charts/verification-service/Chart.yaml",
+        "charts/edgeless/constellation-services/charts/verification-service/templates/daemonset.yaml",
+        "charts/edgeless/constellation-services/charts/verification-service/templates/loadbalancer-service.yaml",
+        "charts/edgeless/constellation-services/charts/verification-service/templates/nodeport-service.yaml",
+        "charts/edgeless/constellation-services/charts/verification-service/values.schema.json",
+        "charts/edgeless/constellation-services/charts/verification-service/values.yaml",
+        "charts/edgeless/constellation-services/templates/.gitkeep",
+        "charts/edgeless/constellation-services/values.yaml",
+        "charts/edgeless/operators/.helmignore",
+        "charts/edgeless/operators/Chart.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/.helmignore",
+        "charts/edgeless/operators/charts/constellation-operator/Chart.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/crds/autoscalingstrategy-crd.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/crds/joiningnode-crd.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/crds/nodeversion-crd.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/crds/pendingnode-crd.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/crds/scalinggroup-crd.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/_helpers.tpl",
+        "charts/edgeless/operators/charts/constellation-operator/templates/deployment.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/leader-election-rbac.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/manager-config.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/manager-rbac.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/metrics-reader-rbac.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/metrics-service.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/templates/proxy-rbac.yaml",
+        "charts/edgeless/operators/charts/constellation-operator/values.schema.json",
+        "charts/edgeless/operators/charts/constellation-operator/values.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/.helmignore",
+        "charts/edgeless/operators/charts/node-maintenance-operator/Chart.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/crds/nodemaintenance-crd.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/_helpers.tpl",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/deployment.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/leader-election-rbac.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/manager-rbac.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/metrics-reader-rbac.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/metrics-service.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/proxy-rbac.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/selfsigned-issuer.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/serving-cert.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/validating-webhook-configuration.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/templates/webhook-service.yaml",
+        "charts/edgeless/operators/charts/node-maintenance-operator/values.schema.json",
+        "charts/edgeless/operators/charts/node-maintenance-operator/values.yaml",
+        "charts/edgeless/operators/values.yaml",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/helm",
+    visibility = ["//cli:__subpackages__"],
+    deps = [
+        "//internal/cloud/cloudprovider",
+        "//internal/compatibility",
+        "//internal/config",
+        "//internal/constants",
+        "//internal/deploy/helm",
+        "//internal/file",
+        "//internal/versions",
+        "@com_github_pkg_errors//:errors",
+        "@com_github_spf13_afero//:afero",
+        "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1:apiextensions",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_sigs_yaml//:yaml",
+        "@sh_helm_helm//pkg/ignore",
+        "@sh_helm_helm_v3//pkg/action",
+        "@sh_helm_helm_v3//pkg/chart",
+        "@sh_helm_helm_v3//pkg/chart/loader",
+        "@sh_helm_helm_v3//pkg/chartutil",
+        "@sh_helm_helm_v3//pkg/cli",
+        "@sh_helm_helm_v3//pkg/release",
+    ],
+)
+
+go_test(
+    name = "helm_test",
+    srcs = [
+        "backup_test.go",
+        "client_test.go",
+        "loader_test.go",
+    ],
+    data = glob(["testdata/**"]),
+    embed = [":helm"],
+    deps = [
+        "//internal/attestation/measurements",
+        "//internal/cloud/cloudprovider",
+        "//internal/compatibility",
+        "//internal/config",
+        "//internal/deploy/helm",
+        "//internal/file",
+        "//internal/logger",
+        "@com_github_pkg_errors//:errors",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1:apiextensions",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_sigs_yaml//:yaml",
+        "@sh_helm_helm_v3//pkg/chart",
+        "@sh_helm_helm_v3//pkg/chart/loader",
+        "@sh_helm_helm_v3//pkg/chartutil",
+        "@sh_helm_helm_v3//pkg/engine",
+        "@sh_helm_helm_v3//pkg/release",
+    ],
+)

cli/internal/iamid/BUILD.bazel

@@ -0,0 +1,9 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "iamid",
+    srcs = ["id.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/iamid",
+    visibility = ["//cli:__subpackages__"],
+    deps = ["//internal/cloud/cloudprovider"],
+)

cli/internal/image/BUILD.bazel

@@ -0,0 +1,39 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "image",
+    srcs = [
+        "image.go",
+        "raw.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/image",
+    visibility = ["//cli:__subpackages__"],
+    deps = [
+        "//internal/cloud/cloudprovider",
+        "//internal/config",
+        "//internal/versionsapi",
+        "//internal/versionsapi/fetcher",
+        "@com_github_schollz_progressbar_v3//:progressbar",
+        "@com_github_spf13_afero//:afero",
+    ],
+)
+
+go_test(
+    name = "image_test",
+    srcs = [
+        "image_test.go",
+        "raw_test.go",
+    ],
+    embed = [":image"],
+    deps = [
+        "//internal/cloud/cloudprovider",
+        "//internal/config",
+        "//internal/file",
+        "//internal/versionsapi",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

cli/internal/libvirt/BUILD.bazel

@@ -0,0 +1,16 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "libvirt",
+    srcs = ["libvirt.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/libvirt",
+    visibility = ["//cli:__subpackages__"],
+    deps = [
+        "//internal/file",
+        "@com_github_docker_docker//api/types",
+        "@com_github_docker_docker//api/types/container",
+        "@com_github_docker_docker//api/types/filters",
+        "@com_github_docker_docker//client",
+        "@com_github_spf13_afero//:afero",
+    ],
+)

cli/internal/terraform/BUILD.bazel

@@ -0,0 +1,106 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "terraform",
+    srcs = [
+        "loader.go",
+        "terraform.go",
+        "variables.go",
+    ],
+    embedsrcs = [
+        "terraform/aws/.terraform.lock.hcl",
+        "terraform/aws/main.tf",
+        "terraform/aws/modules/instance_group/main.tf",
+        "terraform/aws/modules/instance_group/variables.tf",
+        "terraform/aws/modules/load_balancer_target/main.tf",
+        "terraform/aws/modules/load_balancer_target/output.tf",
+        "terraform/aws/modules/load_balancer_target/variables.tf",
+        "terraform/aws/modules/public_private_subnet/main.tf",
+        "terraform/aws/modules/public_private_subnet/output.tf",
+        "terraform/aws/modules/public_private_subnet/variables.tf",
+        "terraform/aws/outputs.tf",
+        "terraform/aws/variables.tf",
+        "terraform/azure/.terraform.lock.hcl",
+        "terraform/azure/main.tf",
+        "terraform/azure/modules/load_balancer_backend/main.tf",
+        "terraform/azure/modules/load_balancer_backend/outputs.tf",
+        "terraform/azure/modules/load_balancer_backend/variables.tf",
+        "terraform/azure/modules/scale_set/main.tf",
+        "terraform/azure/modules/scale_set/variables.tf",
+        "terraform/azure/outputs.tf",
+        "terraform/azure/variables.tf",
+        "terraform/gcp/.terraform.lock.hcl",
+        "terraform/gcp/main.tf",
+        "terraform/gcp/modules/instance_group/main.tf",
+        "terraform/gcp/modules/instance_group/outputs.tf",
+        "terraform/gcp/modules/instance_group/variables.tf",
+        "terraform/gcp/modules/loadbalancer/main.tf",
+        "terraform/gcp/modules/loadbalancer/variables.tf",
+        "terraform/gcp/outputs.tf",
+        "terraform/gcp/variables.tf",
+        "terraform/iam/aws/README.md",
+        "terraform/iam/aws/main.tf",
+        "terraform/iam/aws/outputs.tf",
+        "terraform/iam/aws/variables.tf",
+        "terraform/iam/azure/README.md",
+        "terraform/iam/azure/main.tf",
+        "terraform/iam/azure/outputs.tf",
+        "terraform/iam/azure/variables.tf",
+        "terraform/iam/gcp/README.md",
+        "terraform/iam/gcp/main.tf",
+        "terraform/iam/gcp/outputs.tf",
+        "terraform/iam/gcp/variables.tf",
+        "terraform/qemu/.terraform.lock.hcl",
+        "terraform/qemu/main.tf",
+        "terraform/qemu/modules/instance_group/domain.xsl",
+        "terraform/qemu/modules/instance_group/main.tf",
+        "terraform/qemu/modules/instance_group/outputs.tf",
+        "terraform/qemu/modules/instance_group/variables.tf",
+        "terraform/qemu/outputs.tf",
+        "terraform/qemu/variables.tf",
+        "terraform/openstack/.terraform.lock.hcl",
+        "terraform/openstack/main.tf",
+        "terraform/openstack/modules/instance_group/main.tf",
+        "terraform/openstack/modules/instance_group/outputs.tf",
+        "terraform/openstack/modules/instance_group/variables.tf",
+        "terraform/openstack/modules/loadbalancer/main.tf",
+        "terraform/openstack/modules/loadbalancer/variables.tf",
+        "terraform/openstack/outputs.tf",
+        "terraform/openstack/variables.tf",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/cli/internal/terraform",
+    visibility = ["//cli:__subpackages__"],
+    deps = [
+        "//internal/cloud/cloudprovider",
+        "//internal/file",
+        "@com_github_hashicorp_go_version//:go-version",
+        "@com_github_hashicorp_hc_install//:hc-install",
+        "@com_github_hashicorp_hc_install//fs",
+        "@com_github_hashicorp_hc_install//product",
+        "@com_github_hashicorp_hc_install//releases",
+        "@com_github_hashicorp_hc_install//src",
+        "@com_github_hashicorp_terraform_exec//tfexec",
+        "@com_github_hashicorp_terraform_json//:terraform-json",
+        "@com_github_spf13_afero//:afero",
+    ],
+)
+
+go_test(
+    name = "terraform_test",
+    srcs = [
+        "loader_test.go",
+        "terraform_test.go",
+    ],
+    embed = [":terraform"],
+    deps = [
+        "//internal/cloud/cloudprovider",
+        "//internal/constants",
+        "//internal/file",
+        "@com_github_hashicorp_terraform_exec//tfexec",
+        "@com_github_hashicorp_terraform_json//:terraform-json",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)

csi/cryptmapper/BUILD.bazel

@@ -0,0 +1,35 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_ld_test", "go_test")
+
+go_library(
+    name = "cryptmapper",
+    srcs = ["cryptmapper.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/csi/cryptmapper",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//internal/crypto",
+        "//internal/cryptsetup",
+        "@com_github_martinjungblut_go_cryptsetup//:go-cryptsetup",
+        "@io_k8s_mount_utils//:mount-utils",
+        "@io_k8s_utils//exec",
+    ],
+)
+
+go_test(
+    name = "cryptmapper_test",
+    srcs = ["cryptmapper_test.go"],
+    embed = [":cryptmapper"],
+    # keep
+    tags = ["manual"],
+    deps = [
+        "@com_github_martinjungblut_go_cryptsetup//:go-cryptsetup",
+        "@com_github_stretchr_testify//assert",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)
+
+go_ld_test(
+    name = "cryptmapper_ld_test",
+    src = "cryptmapper_test",
+    ld = "//rpm:ld",
+)

csi/kms/BUILD.bazel

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "kms",
+    srcs = ["constellation.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/csi/kms",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//keyservice/keyserviceproto",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)
+
+go_test(
+    name = "kms_test",
+    srcs = ["constellation_test.go"],
+    embed = [":kms"],
+    deps = [
+        "//keyservice/keyserviceproto",
+        "@com_github_stretchr_testify//assert",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//test/bufconn",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/cmd/cdbg/BUILD.bazel

@@ -0,0 +1,32 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+
+go_library(
+    name = "cdbg_lib",
+    srcs = ["cdbg.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/cmd/cdbg",
+    visibility = ["//visibility:private"],
+    deps = ["//debugd/internal/cdbg/cmd"],
+)
+
+go_binary(
+    name = "cdbg",
+    embed = [":cdbg_lib"],
+    # keep
+    pure = "on",
+    visibility = ["//visibility:public"],
+)
+
+[
+    go_cross_binary(
+        name = "cdbg_%s" % platform,
+        platform = "@io_bazel_rules_go//go/toolchain:" + platform,
+        target = ":cdbg",
+        visibility = ["//visibility:public"],
+    )
+    for platform in [
+        "darwin_amd64",
+        "darwin_arm64",
+        "linux_amd64",
+        "linux_arm64",
+    ]
+]

debugd/cmd/debugd/BUILD.bazel

@@ -0,0 +1,35 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "debugd_lib",
+    srcs = ["debugd.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/cmd/debugd",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//debugd/internal/debugd/deploy",
+        "//debugd/internal/debugd/info",
+        "//debugd/internal/debugd/logcollector",
+        "//debugd/internal/debugd/metadata",
+        "//debugd/internal/debugd/metadata/cloudprovider",
+        "//debugd/internal/debugd/metadata/fallback",
+        "//debugd/internal/debugd/server",
+        "//debugd/internal/filetransfer",
+        "//debugd/internal/filetransfer/streamer",
+        "//internal/cloud/aws",
+        "//internal/cloud/azure",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcp",
+        "//internal/cloud/qemu",
+        "//internal/logger",
+        "@com_github_spf13_afero//:afero",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_binary(
+    name = "debugd",
+    embed = [":debugd_lib"],
+    # keep
+    pure = "on",
+    visibility = ["//visibility:public"],
+)

debugd/internal/cdbg/cmd/BUILD.bazel

@@ -0,0 +1,26 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "cmd",
+    srcs = [
+        "deploy.go",
+        "root.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/cdbg/cmd",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/debugd",
+        "//debugd/internal/debugd/logcollector",
+        "//debugd/internal/filetransfer",
+        "//debugd/internal/filetransfer/streamer",
+        "//debugd/service",
+        "//internal/config",
+        "//internal/constants",
+        "//internal/file",
+        "//internal/logger",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_spf13_cobra//:cobra",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)

debugd/internal/debugd/BUILD.bazel

@@ -0,0 +1,11 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "debugd",
+    srcs = [
+        "constants.go",
+        "debugd.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd",
+    visibility = ["//debugd:__subpackages__"],
+)

debugd/internal/debugd/deploy/BUILD.bazel

@@ -0,0 +1,47 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "deploy",
+    srcs = [
+        "deploy.go",
+        "download.go",
+        "service.go",
+        "systemdaction_string.go",
+        "wrappers.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/deploy",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/filetransfer",
+        "//debugd/service",
+        "//internal/constants",
+        "//internal/logger",
+        "@com_github_coreos_go_systemd_v22//dbus",
+        "@com_github_spf13_afero//:afero",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "deploy_test",
+    srcs = [
+        "download_test.go",
+        "service_test.go",
+    ],
+    embed = [":deploy"],
+    deps = [
+        "//debugd/internal/filetransfer",
+        "//debugd/service",
+        "//internal/constants",
+        "//internal/grpc/testdialer",
+        "//internal/logger",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/internal/debugd/info/BUILD.bazel

@@ -0,0 +1,21 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "info",
+    srcs = ["info.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/info",
+    visibility = ["//debugd:__subpackages__"],
+    deps = ["//debugd/service"],
+)
+
+go_test(
+    name = "info_test",
+    srcs = ["info_test.go"],
+    embed = [":info"],
+    deps = [
+        "//debugd/service",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)

debugd/internal/debugd/logcollector/BUILD.bazel

@@ -0,0 +1,40 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "logcollector",
+    srcs = [
+        "credentials.go",
+        "fields.go",
+        "logcollector.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/logcollector",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/debugd/info",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/metadata",
+        "//internal/logger",
+        "//internal/versions",
+        "@com_github_aws_aws_sdk_go_v2_config//:config",
+        "@com_github_aws_aws_sdk_go_v2_service_secretsmanager//:secretsmanager",
+        "@com_github_azure_azure_sdk_for_go_sdk_azidentity//:azidentity",
+        "@com_github_azure_azure_sdk_for_go_sdk_keyvault_azsecrets//:azsecrets",
+        "@com_github_googleapis_gax_go_v2//:gax-go",
+        "@com_google_cloud_go_secretmanager//apiv1",
+        "@com_google_cloud_go_secretmanager//apiv1/secretmanagerpb",
+    ],
+)
+
+go_test(
+    name = "logcollector_test",
+    srcs = ["credentials_test.go"],
+    embed = [":logcollector"],
+    deps = [
+        "@com_github_aws_aws_sdk_go_v2_service_secretsmanager//:secretsmanager",
+        "@com_github_azure_azure_sdk_for_go_sdk_keyvault_azsecrets//:azsecrets",
+        "@com_github_googleapis_gax_go_v2//:gax-go",
+        "@com_github_stretchr_testify//assert",
+        "@com_google_cloud_go_secretmanager//apiv1/secretmanagerpb",
+    ],
+)

debugd/internal/debugd/metadata/BUILD.bazel

@@ -0,0 +1,28 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "metadata",
+    srcs = [
+        "metadata.go",
+        "scheduler.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/metadata",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/debugd",
+        "//internal/logger",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "metadata_test",
+    srcs = ["scheduler_test.go"],
+    embed = [":metadata"],
+    deps = [
+        "//internal/logger",
+        "@com_github_stretchr_testify//assert",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/internal/debugd/metadata/cloudprovider/BUILD.bazel

@@ -0,0 +1,26 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "cloudprovider",
+    srcs = ["cloudprovider.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/metadata/cloudprovider",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//internal/cloud/metadata",
+        "//internal/role",
+    ],
+)
+
+go_test(
+    name = "cloudprovider_test",
+    srcs = ["cloudprovider_test.go"],
+    embed = [":cloudprovider"],
+    deps = [
+        "//internal/cloud/metadata",
+        "//internal/role",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/internal/debugd/metadata/fallback/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "fallback",
+    srcs = ["fallback.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/metadata/fallback",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/debugd/metadata/cloudprovider",
+        "//internal/cloud/metadata",
+    ],
+)
+
+go_test(
+    name = "fallback_test",
+    srcs = ["fallback_test.go"],
+    embed = [":fallback"],
+    deps = [
+        "//internal/role",
+        "@com_github_stretchr_testify//assert",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/internal/debugd/server/BUILD.bazel

@@ -0,0 +1,40 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "server",
+    srcs = ["server.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/debugd/server",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/debugd/deploy",
+        "//debugd/internal/debugd/info",
+        "//debugd/internal/filetransfer",
+        "//debugd/service",
+        "//internal/constants",
+        "//internal/logger",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//keepalive",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "server_test",
+    srcs = ["server_test.go"],
+    embed = [":server"],
+    deps = [
+        "//debugd/internal/debugd/deploy",
+        "//debugd/internal/debugd/info",
+        "//debugd/internal/filetransfer",
+        "//debugd/service",
+        "//internal/constants",
+        "//internal/grpc/testdialer",
+        "//internal/logger",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/internal/filetransfer/BUILD.bazel

@@ -0,0 +1,36 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "filetransfer",
+    srcs = [
+        "chunkstream.go",
+        "filetransfer.go",
+    ],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/filetransfer",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/internal/debugd",
+        "//debugd/internal/filetransfer/streamer",
+        "//debugd/service",
+        "//internal/logger",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_test(
+    name = "filetransfer_test",
+    srcs = [
+        "chunkstream_test.go",
+        "filetransfer_test.go",
+    ],
+    embed = [":filetransfer"],
+    deps = [
+        "//debugd/internal/filetransfer/streamer",
+        "//debugd/service",
+        "//internal/logger",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/internal/filetransfer/streamer/BUILD.bazel

@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "streamer",
+    srcs = ["streamer.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/internal/filetransfer/streamer",
+    visibility = ["//debugd:__subpackages__"],
+    deps = [
+        "//debugd/service",
+        "@com_github_schollz_progressbar_v3//:progressbar",
+        "@com_github_spf13_afero//:afero",
+    ],
+)
+
+go_test(
+    name = "streamer_test",
+    srcs = ["streamer_test.go"],
+    embed = [":streamer"],
+    deps = [
+        "//debugd/service",
+        "@com_github_spf13_afero//:afero",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_uber_go_goleak//:goleak",
+    ],
+)

debugd/service/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "service_proto",
+    srcs = ["debugd.proto"],
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "service_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/service",
+    proto = ":service_proto",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "service",
+    embed = [":service_go_proto"],
+    importpath = "github.com/edgelesssys/constellation/v2/debugd/service",
+    visibility = ["//visibility:public"],
+)

dev-docs/workflows/build-test-run.md

@@ -4,8 +4,9 @@ The following are instructions for building all components in the constellation
 
 Prerequisites:
 
-* 20 GB disk space
+* 20GB (minimum), better 40 GB disk space (required if you want to cross compile for all platforms)
 * [Latest version of Go](https://go.dev/doc/install).
+* [Bazelisk installed as `bazel` in your path](https://github.com/bazelbuild/bazelisk/releases).
 * [Docker](https://docs.docker.com/engine/install/). Can be installed with these commands on Ubuntu 22.04: `sudo apt update && sudo apt install docker.io`. As the build spawns docker containers your user account either needs to be in the `docker` group (Add with `sudo usermod -a -G docker $USER`) or you have to run builds with `sudo`. When using `sudo` remember that your root user might (depending on your distro and local config) not have the go binary in it's PATH. The current PATH can be forwarded to the root env with `sudo env PATH=$PATH <cmd>`.
 
 * Packages on Ubuntu:
@@ -20,11 +21,27 @@ Prerequisites:
   sudo dnf install @development-tools pkg-config cmake openssl-devel cryptsetup-libs cryptsetup-devel
   ```
 
+CMake wrapper:
+
 ```sh
 mkdir build
 cd build
 cmake ..
-make -j`nproc`
+make
+```
+
+Bazel build:
+
+```sh
+bazel query //...
+bazel build //path/to:target
+bazel build //... # build everything (for every supported platform)
+bazel build //bootstrapper/cmd/bootstrapper:bootstrapper # build bootstrapper
+bazel build //cli:cli_oss # build CLI
+bazel build //cli:cli_oss_linux_amd64 # cross compile CLI for linux amd64
+bazel build //cli:cli_oss_linux_arm64 # cross compile CLI for linux arm64
+bazel build //cli:cli_oss_darwin_amd64 # cross compile CLI for mac amd64
+bazel build //cli:cli_oss_darwin_arm64 # cross compile CLI for mac arm64
 ```
 
 # Test
@@ -39,6 +56,12 @@ You can limit the execution of tests to specific targets with e.g. `ctest -R uni
 
 Some of the tests rely on libvirt and won't work if you don't have a virtualization capable CPU. You can find instructions on setting up libvirt in our [QEMU README](qemu.md).
 
+Running unit tests with Bazel:
+
+```sh
+bazel test //...
+```
+
 # Deploy
 
 > :warning: Debug images are not safe to use in production environments. :warning:
@@ -76,6 +99,44 @@ Therefore, if you want to verify a cluster deployed with a release image you wil
 
 After collecting the measurements you can put them into your `constellation-conf.yaml` under the `measurements` key in order to enforce them.
 
+# Dependency management
+
+## Go
+
+Go dependencies are managed with [Go modules](https://blog.golang.org/using-go-modules) that are all linked from the main [go.work](/go.work) file.
+[Follow the go documentation](https://go.dev/doc/modules/managing-dependencies) on how to use Go modules.
+After updating a dependency, you will have to run `bazel run //:gazelle-update-repos` to update the Bazel workspace with changes from `go.mod` and `go.sum` files.
+
+# Bazel
+
+Bazel is the primary build system for this project. It is used to build all Go code and will be used to build all artifacts in the future.
+Still, we aim to keep the codebase compatible with `go build` and `go test` as well.
+Whenever Go code is changed, you will have to run `bazel run //:gazelle` to regenerate the Bazel build files for Go code.
+The CI will check if the Bazel build files are up to date with `bazel run //:gazelle-check`.
+Optionally, you can use [autogazelle](https://github.com/bazelbuild/bazel-gazelle/tree/master/cmd/autogazelle) to regenerate the Bazel build files automatically on save. This is not tested and might not work properly.
+
+## Bazel commands
+
+* `bazel query //...` - list all targets
+* `bazel query //subfolder` - list all targets in a subfolder
+* `bazel build //...` - build all targets
+* `bazel build //subfolder/...` - build all targets in a subfolder (recursive)
+* `bazel build //subfolder:all` - build all targets in a subfolder (non-recursive)
+* `bazel build //subfolder:target` - build single target
+* `bazel run --run_under="cd $PWD &&" //cli:cli_oss -- create -c 1 -w 1` - build + run a target with arguments in current working directory
+* `bazel cquery --output=files //subfolder:target` - get location of a build artifact
+* `bazel test //...` - run all tests
+* `bazel run //:gazelle` - regenerate Bazel build files for Go code
+* `bazel run //:gazelle-check` - check if Bazel build files for Go code are up to date
+* `bazel run //:gazelle-update-repos` - update Bazel workspace with changes from `go.mod` and `go.sum` files
+* `bazel run //:buildifier-fix` - format Bazel build files
+* `bazel test //:buildifier-check` - lint Bazel build files
+
+## Editor integration
+
+You can continue to use the default Go language server and editor integration. This will show you different paths for external dependencies and not use the Bazel cache.
+Alternatively, you can use [the go language server integration for Bazel](https://github.com/bazelbuild/rules_go/wiki/Editor-setup). This will use Bazel for dependency resolution and execute Bazel commands for building and testing.
+
 # Image export
 
 To download an image you will have to export it first.

disk-mapper/cmd/BUILD.bazel

@@ -0,0 +1,39 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "cmd_lib",
+    srcs = ["main.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/disk-mapper/cmd",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//disk-mapper/internal/mapper",
+        "//disk-mapper/internal/recoveryserver",
+        "//disk-mapper/internal/rejoinclient",
+        "//disk-mapper/internal/setup",
+        "//internal/attestation/choose",
+        "//internal/attestation/vtpm",
+        "//internal/cloud/aws",
+        "//internal/cloud/azure",
+        "//internal/cloud/cloudprovider",
+        "//internal/cloud/gcp",
+        "//internal/cloud/metadata",
+        "//internal/cloud/openstack",
+        "//internal/cloud/qemu",
+        "//internal/constants",
+        "//internal/grpc/dialer",
+        "//internal/kms/setup",
+        "//internal/logger",
+        "//internal/oid",
+        "//internal/role",
+        "@com_github_google_go_tpm//tpm2",
+        "@com_github_google_go_tpm_tools//client",
+        "@com_github_spf13_afero//:afero",
+        "@org_uber_go_zap//:zap",
+    ],
+)
+
+go_binary(
+    name = "cmd",
+    embed = [":cmd_lib"],
+    visibility = ["//visibility:public"],
+)