spire: build tpmdevid nodeattestor plugin

  lib,

  buildGoModule,

  fetchFromGitHub,

  openssl,

}:

buildGoModule (finalAttrs: {

    sha256 = "sha256-iZMeD5ZwWKjY9mfuXgEgh+QLotmv28T8xBgpKoQTgxw=";

  };

  vendorHash = "sha256-tho3Qm9uHiiSNFmBZGZFgxhAKD4HKWsIUmiqkWlToQk=";

  # Needed for github.co/google/go-tpm-tools/simulator  which contains non-go files that `go mod vendor` strips

  proxyVendor = true;

  vendorHash = "sha256-nslLp/NjzsN1hSMMga67T6tMGLiqBNYQMt4Kjtwyvoc=";

  buildInputs = [ openssl ];

  ldflags = [

    "-s"

    "cmd/spire-server"

  ];

  excludedPackages = [

    # ensure these files aren't evaluated, see preCheck

    "test/tmpsimulator"

    "pkg/agent/plugin/nodeattestor/tpmdevid"

  ];

  __darwinAllowLocalNetworking = true;

  checkFlags =

    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

  preCheck = ''

    # remove test files which reference github.com/google/go-tpm-tools/simulator

    # since it requires cgo and some missing header files

    rm -rf test/tpmsimulator pkg/server/plugin/nodeattestor/tpmdevid/devid_test.go

    # unset to run all tests

    unset subPackages

  '';