support go-tpm latest version

[yynmsl]

Hi,

the latest version is v0.9.5 https://github.com/google/go-tpm/releases.

We need to upgrade to version 0.9.5. Currently, we are using version 0.3.3, and these two versions are incompatible. If other services are using version 0.9.5, it will result in missing package errors.

[13ajay]

Hi, thanks for opening this issue, and sorry for the late response.

Would you be able to explain the benefit of making this change? I haven't looked very closely at the new version of the dependency, but if the only thing that has changed is the file paths in their codebase (no patches, bug fixes, etc.), I feel as though it may not be particularly useful to upgrade? Let me know if I'm missing something. Some of this is just an educated guess, stemming from the fact that this code has been moved to the legacy subdirectory (which I presume means that it won't really receive updates).

I do think that at some point, we should upgrade to the new version, but at that point, we probably shouldn't be taking a dependency on code within the legacy subdirectory. Instead, all the TPM-related code should be rewritten to use whatever new APIs the dependency now exposes.

[CodeLikeAGecko]

@13ajay The suggestion of adding /legacy will solve issues like these:
../../vendor/github.com/aws/rolesanywhere-credential-helper/aws_signing_helper/tpm_signer.go:62:26: undefined: tpm2.Public ../../vendor/github.com/aws/rolesanywhere-credential-helper/aws_signing_helper/tpm_signer.go:63:19: undefined: tpm2.AlgECC

We are seeing it in these two files.
vendor/github.com/aws/rolesanywhere-credential-helper/aws_signing_helper/tpm_signer.go vendor/github.com/aws/rolesanywhere-credential-helper/aws_signing_helper/tpm_signer_helper_other.go

Hope this helps.

[13ajay]

Thanks. My understanding was that since go.sum is checked in, builds should be reproducible. You're finding that this isn't the case? Can you share more details about how you're attempting to build?

[CodeLikeAGecko]

I think that the github.com/google/go-tpm/ project changed with its 0.9.0 release and moved those constants into its new /legacy/tmp2 folder.

I was just updating our vendor dependencies and it broke. I set my go.mod to "go 1.24" and then
go get -u ./...
go mod tidy
go mod vendor

It breaks with the subsequent go build.

I'm new enough to golang that I am not sure why this project's go.mod file specifies go-tpm of 0.3.3 and mine pulls in go-tpm 0.9.5 (indirectly).

[rohithkumar31]

@13ajay Any update on this? I'm using nats-server which also uses this as a dependency. They have upgraded it to the latest version while the rolesanywhere-credential-helper still uses the old version resulting in dependency conflicts and restricting me to upgrade to the latest version of nats.