feat(tpm): add read-only TPM validation

audit/internal/platform/tpm_test.go

@@ -0,0 +1,33 @@
+package platform
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestTPMValidationJobsAreReadOnly(t *testing.T) {
+	t.Parallel()
+
+	jobs := tpmValidationJobs()
+	want := [][]string{
+		{"tpm2_getcap", "properties-fixed"},
+		{"tpm2_getcap", "pcrs"},
+		{"tpm2_pcrread"},
+		{"tpm2_gettestresult"},
+	}
+	if len(jobs) != len(want) {
+		t.Fatalf("jobs=%d want %d", len(jobs), len(want))
+	}
+	for index, job := range jobs {
+		if !reflect.DeepEqual(job.cmd, want[index]) {
+			t.Fatalf("jobs[%d].cmd=%v want %v", index, job.cmd, want[index])
+		}
+		joined := strings.ToLower(strings.Join(job.cmd, " "))
+		for _, forbidden := range []string{"selftest", "clear", "changeauth", "nvwrite", "pcrextend", "create"} {
+			if strings.Contains(joined, forbidden) {
+				t.Fatalf("job %q contains state-changing command %q", joined, forbidden)
+			}
+		}
+	}
+}