tests: Sign different TPM 2 certificate types with an ML-DSA key

Use swtpm_cert to sign the different types of TPM certificates with an
ML-DSA-87 key.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

tests/test_tpm2_swtpm_cert

@@ -33,6 +33,9 @@ RSA3072PRIVKEY=${TMPDIR}/rsa3072privkey.pem
 RSA3072PUBKEY=${TMPDIR}/rsa3072pubkey.pem
 ISSUERCERT_RSA3072=${TMPDIR}/rsa3072-issuercert.pem
 
+# ML-DSA-87 key used for signing
+ISSUERCERT_MLDSA87=${TMPDIR}/mldsa87-issuercert.pem
+
 if ! msg=$(openssl genrsa -out "${RSAPRIVKEY}" 2432 2>&1) ||
    ! msg=$(openssl rsa -in "${RSAPRIVKEY}" -pubout -out "${RSAPUBKEY}" 2>&1) ||
    ! msg=$(openssl ecparam -name prime256v1 -genkey -noout -out "${EC256PRIVKEY}" 2>&1) || \
@@ -70,6 +73,14 @@ if ! msg=$(openssl genrsa -out "${RSAPRIVKEY}" 2432 2>&1) ||
 	-days 1000 \
 	-subj "/CN=swtpm-localca" \
 	-CA "${CACERT}" \
+	-CAkey "${CAKEY}" 2>&1) || \
+   ! msg=$(openssl req \
+	-x509 \
+	-key "${MLDSA87PRIVKEY}" \
+	-out "${ISSUERCERT_MLDSA87}" \
+	-days 1000 \
+	-subj "/CN=swtpm-localca" \
+	-CA "${CACERT}" \
 	-CAkey "${CAKEY}" 2>&1) \
 ; then
 	echo "Could not create the required keys"
@@ -104,4 +115,19 @@ PARAM_CERT_SIZES="792-794 587-589 838-840 587-589 2086-2088 1318-1320 3110-3112
 ret=$?
 [ $ret -ne 0 ] && exit $ret
 
+
+printf "\nTesting with ml-dsa-87 certificate signing key\n"
+
+PARAM_RSAPUBKEY="${RSAPUBKEY}" \
+PARAM_ECPUBKEY="${EC256PUBKEY}" \
+PARAM_MLKEM1024PUBKEY="${MLKEM1024PUBKEY}" \
+PARAM_MLDSA87PUBKEY="${MLDSA87PUBKEY}" \
+PARAM_SIGNKEY="${MLDSA87PRIVKEY}" \
+PARAM_ISSUERCERT="${ISSUERCERT_MLDSA87}" \
+PARAM_CERT_SIZES="5285 5080 5331 5080 6579 5811 7603 5296 5045 5212 7484 5212 5351" \
+	./_test_tpm2_swtpm_cert
+ret=$?
+[ $ret -ne 0 ] && exit $ret
+
+
 exit 0