Merge ~sylvain-pineau/plainbox-provider-tpm2:upstream-4.1.1-focal into plainbox-provider-tpm2:master

[Sylvain Pineau]

Focal TPM2 4.1.1 upstream tests

New version, new test, new test plan. It's a mix of the integration tests found in the original source archive and various fixes only available on master (April 2020).

A couple of tests that are way too destructive have been removed (e.g tpm2_clearcontrols) as they could result in a complete tpm2 DA lockout (for a week...).

Tested on stock 20.04 beta: https://people.canonical.com/~spineau/submission_2020-04-19T17.01.01.582921.html

[Jonathan Cave (jocave)]

Thanks for the hard work on this, it will be great to have them available.

One question that shouldn't stop this landing; I wonder if there are any test plans that are used across bionic and focal releases that would want for the appropriate set of tests to be automatically selected (i.e. can just include the appropriate nested plan)?

review: Approve

[Sylvain Pineau (sylvain-pineau)]

templated test plans? such thing does not exist

diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/ek-template-default.bin b/data/tpm2-tools-4.1.1/integration/fixtures/ek-template-default.bin
new file mode 100644
index 0000000..508267e
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/ek-template-default.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/event-uefiaction.bin b/data/tpm2-tools-4.1.1/integration/fixtures/event-uefiaction.bin
new file mode 100644
index 0000000..9088a8c
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/event-uefiaction.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/event-uefiservices.bin b/data/tpm2-tools-4.1.1/integration/fixtures/event-uefiservices.bin
new file mode 100644
index 0000000..88507dc
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/event-uefiservices.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/event-uefivar.bin b/data/tpm2-tools-4.1.1/integration/fixtures/event-uefivar.bin
new file mode 100644
index 0000000..130a549
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/event-uefivar.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/event.bin b/data/tpm2-tools-4.1.1/integration/fixtures/event.bin
new file mode 100644
index 0000000..2ec9344
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/event.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/get-capability-tpm-prop-fixed.bin b/data/tpm2-tools-4.1.1/integration/fixtures/get-capability-tpm-prop-fixed.bin
new file mode 100644
index 0000000..66fb259
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/get-capability-tpm-prop-fixed.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/fixtures/specid-vendordata.bin b/data/tpm2-tools-4.1.1/integration/fixtures/specid-vendordata.bin
new file mode 100644
index 0000000..cca24e6
Binary files /dev/null and b/data/tpm2-tools-4.1.1/integration/fixtures/specid-vendordata.bin differ
diff --git a/data/tpm2-tools-4.1.1/integration/helpers.sh b/data/tpm2-tools-4.1.1/integration/helpers.sh
new file mode 100644
index 0000000..1501e19
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/helpers.sh
@@ -0,0 +1,676 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+set -E
+
+# Return 0 if run by a TPM simulator, return 1 otherwise
+is_simulator() {
+    # both simulators mssim and swtpm have their vendor sting set to "SW":
+    # TPM2_PT_VENDOR_STRING_1:
+    #   raw: 0x53572020
+    #   value: "SW"
+    tpm2_getcap properties-fixed \
+    | grep -zP "TPM2_PT_VENDOR_STRING_1:\s*raw: 0x53572020" &>/dev/null
+}
+
+# Return 0 if algorithm is supported, return 1 otherwise
+# Error if TPM is simulator and algorithm is unsupported
+is_alg_supported() {
+    if tpm2_testparms $1 2> /dev/null; then
+        return 0
+    else
+        if is_simulator; then
+            echo "ERROR: $1 is not supported by the TPM simulator."
+            exit 1
+        else
+            echo "SKIP: Testing on a non-simulator TPM. Skipping unsupported algorithm $1"
+            return 1
+        fi
+    fi
+}
+
+# Return 0 if command is supported, return 1 otherwise
+# Error if TPM is simulator and command is unsupported
+is_cmd_supported() {
+    if tpm2_getcap commands | grep -i "$1:" &> /dev/null; then
+        return 0
+    else
+        if is_simulator; then
+            echo "ERROR: $1 is not supported by the TPM simulator."
+            exit 1
+        else
+            echo "SKIP: Testing on a non-simulator TPM. Skipping unsupported command $1"
+            return 1
+        fi
+    fi
+}
+
+function filter_algs_by() {
+
+python3 << pyscript
+from __future__ import print_function
+
+import sys
+import yaml
+
+with open("$1") as f:
+    try:
+        y = yaml.safe_load(f)
+        for alg, details in y.items():
+            if $2:
+                print(alg)
+    except yaml.YAMLError as exc:
+        sys.exit(exc)
+pyscript
+}
+
+populate_algs() {
+    algs="$(mktemp)"
+    tpm2_getcap algorithms > "${algs}"
+    filter_algs_by "${algs}" "${1}"
+    rm "${algs}"
+}
+
+populate_hash_algs() {
+    populate_algs "details['hash'] and not details['method'] and not details['symmetric'] and not details['signing'] $1"
+}
+
+# Return alg argument if supported by TPM.
+hash_alg_supported() {
+    local orig_alg="$1"
+    local alg="$orig_alg"
+    local algs_supported
+
+    algs_supported="$(populate_hash_algs name)"
+    local hex2name=(
+        [0x04]="sha1"
+        [0x0B]="sha256"
+        [0x0C]="sha384"
+        [0x0D]="sha512"
+        [0x12]="sm3_256"
+    )
+
+    if [ -z "$alg" ]; then
+        echo "$algs_supported"
+        return
+    fi
+
+    if [ "$alg" = "${alg//[^0-9a-fA-FxX]/}" ]; then
+        alg=${hex2name["$alg"]}
+        [ -z "$alg" ] && return
+    fi
+
+    local t_alg
+    for t_alg in $algs_supported; do
+        if [ "$t_alg" = "$alg" ]; then
+            echo "$orig_alg"
+            return
+        fi
+    done
+}
+
+# Get nice names of supported algorithms lengths
+# Does not work with hashes!
+# e.g. calling "populate_alg_lengths rsa" will print:
+# rsa1024
+# rsa2048
+populate_alg_lengths() {
+    #set -x
+    alg="$1"
+    local lengths="1 128 192 224 256 384 512 1024 2048 4096"
+    local populated=""
+    for len in $lengths; do
+        if tpm2_testparms "$alg$len" 2> /dev/null; then
+            if [ -z "$populated" ]; then
+                populated="$alg$len"
+            else
+                populated="$populated\n$alg$len"
+            fi
+        fi
+    done;
+    printf "$populated"
+}
+
+# Get nice name of the algorithm with its weakest supported key size
+# Does not work with hashes!
+# e.g. calling "weakest_alg aes" will print "aes128"
+weakest_alg() {
+    populate_alg_lengths "$1" | head -n1
+}
+
+# Get nice name of the algorithm with its strongest supported key size
+# Does not work with hashes!
+# e.g. calling "strongest_alg aes" will print "aes256"
+strongest_alg() {
+    populate_alg_lengths "$1" | tail -n1
+}
+
+# Get nice names of supported algorithm modes
+# Does not work with hashes!
+# e.g. calling "populate_alg_modes aes128" will print:
+# aes128cfb
+# aes128cbc
+populate_alg_modes() {
+    #set -x
+    alg="$1"
+    local modes="ctr ofb cbc cfb ecb"
+    local populated=""
+    for mode in $modes; do
+        if tpm2_testparms "$alg$mode" 2> /dev/null; then
+            if [ -z "$populated" ]; then
+                populated="$alg$mode"
+            else
+                populated="$populated\n$alg$mode"
+            fi
+        fi
+    done;
+    printf "$populated"
+}
+
+#
+# Verifies that the contexts of a file path provided
+# as the first argument loads as a YAML file.
+#
+function yaml_verify() {
+python3 << pyscript
+from __future__ import print_function
+
+import sys
+import yaml
+
+with open("$1") as f:
+    try:
+        y = yaml.safe_load(f)
+    except yaml.YAMLError as exc:
+        sys.exit(exc)
+pyscript
+}
+
+#
+# Given a file as argument 1, prints the value of the key
+# provided as argument 2 and optionally argument 3 (for nested maps).
+# Note that all names and values are parsed as strings.
+#
+function yaml_get_kv() {
+
+    third_arg=""
+    if [ $# -eq 3 ]; then
+        third_arg=$3
+    fi
+
+python3 << pyscript
+from __future__ import print_function
+
+import sys
+import yaml
+
+with open("$1") as f:
+    try:
+        y = yaml.load(f, Loader=yaml.BaseLoader)
+        if $# == 3:
+            print(y["$2"]["$third_arg"])
+        else:
+            print(y["$2"])
+    except yaml.YAMLError as exc:
+        sys.exit(exc)
+pyscript
+}
+
+function recreate_info() {
+    echo
+    echo "--- To recreate this test run the following: ---"
+    local a="export TPM2_ABRMD=\"$TPM2_ABRMD\"\n"
+    a="$a""export TPM2_SIM=\"$TPM2_SIM\"\n"
+    a="$a""export TPM2ABRMD_TCTI=\"$TPM2ABRMD_TCTI\"\n"
+    a="$a""export TPM2_SIMPORT=\"$TPM2_SIMPORT\"\n"
+    a="$a""export TPM2TOOLS_TEST_TCTI=\"$TPM2TOOLS_TEST_TCTI\"\n"
+    a="$a""export PATH=\"$PATH\"\n"
+    a="$a""TPM2_SIM_NV_CHIP=\"$TPM2_SIM_NV_CHIP\"\n"
+    a="$a""TPM2_TOOLS_TEST_FIXTURES=\"$TPM2_TOOLS_TEST_FIXTURES\"\n"
+    echo "#!/usr/bin/env bash"
+    echo -e "$a"
+    local script="$tpm2_test_original_cwd""/""$0"
+    echo $(realpath "$script")
+    echo "--- EOF ---"
+    echo
+}
+
+tpm2_test_original_cwd=""
+tpm2_test_cwd=""
+function switch_to_test_dir() {
+    tpm2_test_original_cwd=`pwd`;
+    tpm2_test_cwd=$(mktemp -d ${TMPDIR:-/tmp}/tpm2_test_XXXXXX)
+    echo "creating simulator working dir: $tpm2_test_cwd"
+    pushd "$tpm2_test_cwd"
+    echo "Switched to CWD: $(pwd)"
+}
+
+function switch_back_from_test_dir() {
+    popd
+}
+
+tpm2_sim_pid=""
+tpm2_abrmd_pid=""
+tpm2_tcti_opts=""
+tpm2tools_tcti=""
+
+sock_tool="unknown"
+OS=$(uname)
+
+if [ "$OS" == "Linux" ]; then
+    sock_tool="ss -lntp4"
+elif [ "$OS" == "FreeBSD" ]; then
+    sock_tool="sockstat -l4"
+fi
+
+function start_sim() {
+    local max_cnt=10
+
+    # if a user is specifying the sim port, then only attempt it once
+    if [ -n "$TPM2_SIMPORT" ]; then
+        max_cnt=1
+    fi
+
+    while [ $max_cnt -gt 0 ]; do
+        # If either the requested simulator port or the port that will be used
+        # by mssim TCTI which is tpm2_sim_port + 1 is occupied (ESTABLISHED, TIME_WAIT, etc...),
+        # just continue up to 10 retries
+        # (See : https://github.com/tpm2-software/tpm2-tss/blob/master/src/tss2-tcti/tcti-mssim.c:559)
+        if [ -z "$TPM2_SIMPORT" ]; then
+            tpm2_sim_port="$(shuf -i 2321-65534 -n 1)"
+        else
+            tpm2_sim_port=$TPM2_SIMPORT
+        fi
+        tpm2_sim_cmd_port=$((tpm2_sim_port + 1))
+        echo "Attempting to start simulator on port: $tpm2_sim_port"
+        $TPM2_SIM -port $tpm2_sim_port &
+        tpm2_sim_pid=$!
+        sleep 1
+
+        ${sock_tool} 2>/dev/null | grep ${TPM2_SIM} | grep ${tpm2_sim_pid} | grep ${tpm2_sim_port}
+        tpm2_sim_port_rc=$?
+        ${sock_tool} 2>/dev/null | grep ${TPM2_SIM} | grep ${tpm2_sim_pid} | grep ${tpm2_sim_cmd_port}
+        tpm2_sim_cmd_port_rc=$?
+
+        if [[ $tpm2_sim_port_rc -eq 0 ]] && [[ $tpm2_sim_cmd_port_rc -eq 0 ]]; then
+            echo "Started simulator on port $tpm2_sim_port in dir \"$PWD\""
+            TPM2_SIMPORT=$tpm2_sim_port
+            # set a possible tools tcti to use mssim
+            tpm2tools_tcti="mssim:host=localhost,port=$TPM2_SIMPORT"
+            echo "tpm2tools_tcti=\"$tpm2tools_tcti\""
+            return 0
+        else
+            echo "Could not start simulator at port: $tpm2_sim_port"
+            kill "$tpm2_sim_pid"
+            let "max_cnt=max_cnt-1"
+            echo "Tries left: $max_cnt"
+        fi
+    done
+
+    echo "Maximum attempts reached. Aborting"
+    return 1
+}
+
+function start_abrmd() {
+
+        local tpm2_tabrmd_opts
+
+        # if we don't have an explicit TCTI to connect to, generate it
+        if [ -z "$TPM2ABRMD_TCTI" ]; then
+            echo "TPM2ABRMD_TCTI is empty, configuring"
+
+            if [ -z "$TPM2_SIMPORT" ]; then
+                echo "No simulator port found, can not determine ABRMD TCTI conf"
+                return 1
+            fi
+
+            # TCTI information for use with ABRMD
+            local name="com.intel.tss2.Tabrmd${TPM2_SIMPORT}"
+            tpm2_tabrmd_opts="--session --dbus-name=$name --tcti=mssim:port=$TPM2_SIMPORT"
+            echo "TPM2ABRMD_TCTI=\"$tpm2_tabrmd_opts\""
+            TPM2ABRMD_TCTI="$tpm2_tabrmd_opts"
+        fi
+
+    if [ $UID -eq 0 ]; then
+        tpm2_tabrmd_opts="--allow-root $tpm2_tabrmd_opts"
+    fi
+
+    echo "tpm2-abrmd command: $TPM2_ABRMD $tpm2_tabrmd_opts $TPM2ABRMD_TCTI"
+    $TPM2_ABRMD $tpm2_tabrmd_opts $TPM2ABRMD_TCTI &
+    tpm2_abrmd_pid=$!
+    sleep 2
+
+    if ! kill -0 "$tpm2_abrmd_pid"; then
+        (>&2 echo "Could not start tpm2-abrmd \"$TPM2_ABRMD\", exit code: $?")
+        kill -9 $tpm2_abrmd_pid
+        return 1
+    fi
+
+    # set a possible tools tcti to use abrmd
+    tpm2tools_tcti="tabrmd:bus_type=session,bus_name=$name"
+    echo "tpm2tools_tcti=\"$tpm2tools_tcti\""
+
+    return 0
+}
+
+#
+# This start up routine performs the following actions and should
+# be called by testing scripts if they need a TCTI. It also outputs
+# information for how to recreate the test outside of the test harness.
+#
+# 1. Start the simulator if specified via env var TPM2_SIM. if TPM2_SIMPORT
+#    is set, it attempts to start the simulator AT that port, else it tries
+#    a random port, and sets TPM2_SIMPORT to the random port if successful.
+#
+# 2. Start abrmd if specified via env var TPM2_ABRMD. if TPM2ABRMD_TCTI is
+#    set it starts abrmd using that TCTI, else it uses the value of TPM2_SIMPORT.
+#
+# 3. Pick a TCTI for the tools based on:
+#    a) TPM2TOOLS_TEST_TCTI user specified, just use it.
+#    b) TPM2TOOLS_TEST_TCTI not specified, the start_sim and start_anrmd routines
+#       set tpm2tools_tcti variable, so use that.
+#
+function start_up() {
+
+    switch_to_test_dir
+
+    run_startup=true
+
+    #if [ -n "$TPM2_SIM" ]; then
+    #    # Start the simulator
+    #    echo "Starting the simulator"
+    #    start_sim || exit 1
+    #    echo "Started the simulator"
+    #else
+    #    echo "not starting simulator"
+    #fi
+    #
+    #if [ -n "$TPM2_ABRMD" ]; then
+    #    echo "Starting tpm2-abrmd"
+    #    # Start tpm2-abrmd
+    #    start_abrmd || exit 1
+    #    run_startup=false
+    #else
+    #    echo "not starting abrmd"
+    #fi
+    #
+    #echo "TPM2TOOLS_TEST_TCTI=$TPM2TOOLS_TEST_TCTI"
+    #if [ -z "$TPM2TOOLS_TEST_TCTI" ]; then
+    #    echo "TPM2TOOLS_TEST_TCTI not set, attempting to figure out default"
+    #    if [ -z "$tpm2tools_tcti" ]; then
+    #        echo "The simulator not abrmd was started, cannot determine a TCTI for tools."
+    #        exit 1;
+    #    fi
+    #    TPM2TOOLS_TEST_TCTI="$tpm2tools_tcti"
+    #fi
+    #
+    #echo "export TPM2TOOLS_TCTI=\"$TPM2TOOLS_TEST_TCTI\""
+    export TPM2TOOLS_TCTI="$TPM2TOOLS_TEST_TCTI"
+
+    #recreate_info
+
+    #echo "run_startup: $run_startup"
+
+    if [ $run_startup = true ]; then
+        tpm2_startup -c
+    fi
+
+    if ! tpm2_clear; then
+        exit 1
+    fi
+}
+
+function shut_down() {
+
+    #echo "Shutting down"
+
+    switch_back_from_test_dir
+
+    fail=0
+    if [ -n "$tpm2_abrmd_pid" ]; then
+        if kill -0 "$tpm2_abrmd_pid"; then
+            if ! kill -9 "$tpm2_abrmd_pid"; then
+                (>&2 echo "ERROR: could not kill tpm2_abrmd on pid: $tpm2_abrmd_pid")
+                fail=1
+            fi
+        else
+            (>&2 echo "WARNING: tpm2_abrmd already stopped ($tpm2_abrmd_pid)")
+        fi
+    fi
+    tpm2_abrmd_pid=""
+
+    if [ -n "$tpm2_sim_pid" ]; then
+        if kill -0 "$tpm2_sim_pid"; then
+            if ! kill -9 "$tpm2_sim_pid"; then
+                (>&2 echo "ERROR: could not kill tpm2 simulator on pid: $tpm2_sim_pid")
+                fail=1
+            fi
+        else
+            (>&2 echo "WARNING: TPM simulator already stopped ($tpm2_sim_pid)")
+        fi
+    fi
+    tpm2_sim_pid=""
+
+    #echo "Removing sim dir: $tpm2_test_cwd"
+    rm -rf "$tpm2_test_cwd" 2>/dev/null
+
+    if [ $fail -ne 0 ]; then
+        exit 1
+    fi
+}
+
+#
+# Set the default EXIT handler to always shut down, tests
+# can override this.
+#
+trap shut_down EXIT
+
+#
+# Set the default on ERR handler to print the line number
+# and failed command.
+#
+onerror() {
+    echo "$BASH_COMMAND on line ${BASH_LINENO[0]} failed: $?"
+    exit 1
+}
+trap onerror ERR
+
+#
+# print 0 if the list of arguments 1 to n-1 contains the last argument n
+# print 1 otherwise
+#
+function ina() {
+    local n=$#
+    local value=${!n}
+    for ((i=1;i < $#;i++)) {
+        if [ "${!i}" == "${value}" ]; then
+            echo 0
+            return
+        fi
+    }
+    echo 1
+}
+
+# Causes a test to skip by exiting with error code 77
+# See the automake manual for the exit codes:
+#   https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html
+function skip_test() {
+	exit 77
+}
+
+function setup_fapi() {
+    tempdir=`pwd`/$(mktemp -d tss2_fapi.XXXXXX)
+
+    KEYSTORE_USER=keystore_user
+    KEYSTORE_SYSTEM=keystore_system
+    LOG_DIR=log
+    PROFILE_NAME=P_RSA
+
+    mkdir -p $tempdir/$KEYSTORE_USER/policy $tempdir/$KEYSTORE_SYSTEM/policy \
+        $tempdir/$LOG_DIR
+
+cat > $tempdir/fapi_config.json <<EOF
+{
+    "profile_name": "${PROFILE_NAME}",
+    "profile_dir": "$tempdir/",
+    "user_dir": "$tempdir/${KEYSTORE_USER}",
+    "system_dir": "$tempdir/${KEYSTORE_SYSTEM}",
+    "tcti": "${TPM2TOOLS_TCTI}",
+    "system_pcrs" : [],
+    "ek_cert_less": "yes",
+    "log_dir" : "$tempdir/${LOG_DIR}",
+}
+EOF
+
+    export TSS2_FAPICONF=$tempdir/fapi_config.json
+    export TEMP_DIR=$tempdir
+
+    PATH=${BUILDDIR}/tools/fapi:$PATH
+
+    setup_profile $tempdir
+    setup_policies $tempdir
+    resetPCR16
+
+}
+
+# Reset PCR 16. Important when using physical TPM
+function resetPCR16(){
+    tpm2_pcrreset 16
+}
+
+function setup_profile() {
+# Setup Profile
+cat > $tempdir/${PROFILE_NAME}.json <<EOF
+{
+    "type": "TPM2_ALG_RSA",
+    "nameAlg":"TPM2_ALG_SHA256",
+    "srk_template": "system,restricted,decrypt",
+    "srk_persistent": 0,
+    "ek_template":  "system,restricted,decrypt",
+    "ecc_signing_scheme": {
+        "scheme":"TPM2_ALG_ECDSA",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA256"
+        },
+    },
+    "rsa_signing_scheme": {
+        "scheme":"TPM2_ALG_RSAPSS",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA256"
+        }
+    },
+    "rsa_decrypt_scheme": {
+        "scheme":"TPM2_ALG_OAEP",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA256"
+        }
+    },
+    "sym_mode":"TPM2_ALG_CFB",
+    "sym_parameters": {
+        "algorithm":"TPM2_ALG_AES",
+        "keyBits":"128",
+        "mode":"TPM2_ALG_CFB"
+    },
+    "sym_block_size": 16,
+    "pcr_selection": [
+        { "hash": "TPM2_ALG_SHA1",
+          "pcrSelect": [ 9, 15, 13 ]
+        },
+        { "hash": "TPM2_ALG_SHA256",
+          "pcrSelect": [ 8, 16, 14 ]
+        }
+    ],
+    "exponent": 0,
+    "keyBits": 2048
+}
+EOF
+}
+
+function setup_policies() {
+    tempdir=$1
+
+# Setup Policy Authorize
+cat > $tempdir/pol_authorize.json <<EOF
+{
+    "description":"Description pol_authorize",
+    "policy":[
+        {
+            "type": "POLICYAUTHORIZE",
+            "keyPath": "/HS/SRK/myPolicySignKey"
+        }
+    ]
+}
+EOF
+
+# Setup Policy Authorize with reference value
+cat > $tempdir/pol_authorize_ref.json <<EOF
+{
+    "description":"Description pol_authorize",
+    "policy":[
+        {
+            "type": "POLICYAUTHORIZE",
+            "keyPath": "/HS/SRK/myPolicySignKey",
+            "policyRef": "f0f1f2f3f4f5f6f7f8f9"
+        }
+    ]
+}
+EOF
+
+# Setup Policy Authorize NV
+cat > $tempdir/pol_authorize_nv.json <<EOF
+{
+    "description":"Description pol_authorize_nv",
+    "policy":[
+        {
+            "type": "POLICYAUTHORIZENV",
+            "nvPath": "/nv/Owner/myNV",
+        }
+  ]
+}
+EOF
+
+# Setup Policy Duplicate
+cat > $tempdir/pol_duplicate.json <<EOF
+{
+    "description":"Description pol_duplicate",
+    "policy":[
+        {
+            "type": "POLICYDUPLICATIONSELECT",
+            "newParentPath": "ext/myNewParent",
+        }
+    ]
+}
+EOF
+
+# Setup Policy PCR
+cat > $tempdir/pol_pcr16_0.json <<EOF
+{
+    "description":"Description pol_16_0",
+    "policy":[
+        {
+            "type":"POLICYPCR",
+            "pcrs":[
+                {
+                    "pcr":16,
+                    "hashAlg":"TPM2_ALG_SHA",
+                    "digest":"0000000000000000000000000000000000000000"
+                }
+            ]
+        }
+    ]
+}
+EOF
+
+# Setup Policy Signed
+cat > $tempdir/pol_signed.json <<EOF
+{
+    "description":"Description pol_signed",
+    "policy":[
+        {
+            "type": "POLICYSIGNED",
+            "keyPEM": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoGL6IrCSAznmIIzBessI\nmW7tPOUy78uWTIaub32KnYHn78KXprrZ3ykp6WDrOQeMjv4AA+14mJbg77apVYXy\nEnkFdOMa1hszSJnp6cJvx7ILngLvFUxzbVki\/ehvgS3nRk67Njal+nMTe8hpe3UK\nQeV\/Ij+F0r6Yz91W+4LPmncAiUesRZLetI2BZsKwHYRMznmpIYpoua1NtS8QpEXR\nMmsUue19eS\/XRAPmmCfnb5BX2Tn06iCpk6wO+RfMo9etcX5cLSAuIYEQYCvV2\/0X\nTfEw607vttBN0Y54LrVOKno1vRXd5sxyRlfB0WL42F4VG5TfcJo5u1Xq7k9m9K57\n8wIDAQAB\n-----END PUBLIC KEY-----\n"
+        }
+    ]
+}
+EOF
+
+}
diff --git a/data/tpm2-tools-4.1.1/integration/tests/activecredential.sh b/data/tpm2-tools-4.1.1/integration/tests/activecredential.sh
new file mode 100755
index 0000000..e079409
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/activecredential.sh
@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f secret.data ek.pub ak.pub ak.name mkcred.out actcred.out ak.out \
+    ak.ctx session.ctx
+
+    # Evict persistent handles, we want them to always succeed and never trip
+    # the onerror trap.
+    tpm2_evictcontrol -Q -C o -c 0x81010009 2>/dev/null || true
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+echo 12345678 > secret.data
+
+tpm2_createek -Q -c 0x81010009 -G rsa -u ek.pub
+
+tpm2_createak -C 0x81010009 -c ak.ctx -G rsa -g sha256 -s rsassa -u ak.pub \
+-n ak.name -p akpass> ak.out
+
+# Capture the yaml output and verify that its the same as the name output
+loaded_key_name_yaml=`python3 << pyscript
+from __future__ import print_function
+
+import yaml
+
+with open('ak.out', 'r') as f:
+    doc = yaml.safe_load(f)
+    print(doc['loaded-key']['name'])
+pyscript`
+
+# Use -c in xxd so there is no line wrapping
+file_size=`ls -l ak.name | awk {'print $5'}`
+loaded_key_name=`cat ak.name | xxd -p -c $file_size`
+
+test "$loaded_key_name_yaml" == "$loaded_key_name"
+
+tpm2_makecredential -Q -e ek.pub -s secret.data -n $loaded_key_name \
+-o mkcred.out
+
+TPM2_RH_ENDORSEMENT=0x4000000B
+tpm2_startauthsession --policy-session -S session.ctx
+tpm2_policysecret -S session.ctx -c $TPM2_RH_ENDORSEMENT
+tpm2_activatecredential -Q -c ak.ctx -C 0x81010009 -i mkcred.out \
+-o actcred.out -p akpass -P"session:session.ctx"
+tpm2_flushcontext session.ctx
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/attestation.sh b/data/tpm2-tools-4.1.1/integration/tests/attestation.sh
new file mode 100755
index 0000000..fa30d43
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/attestation.sh
@@ -0,0 +1,113 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+handle_ek=0x81010009
+context_ak=ak.ctx
+handle_nv=0x1500018
+handle_hier=0x40000001
+ek_alg=rsa
+ak_alg=rsa
+digestAlg=sha256
+signAlg=rsassa
+ownerpw=ownerpass
+endorsepw=endorsepass
+akpw=akpass
+rand_pcr_value=6ea40aa7267bb71251c1de1c3605a3df759b86b22fa9f62aa298d4197cd88a38
+debug_pcr=16
+debug_pcr_list=15,16,22
+
+file_input_data=secret.data
+file_input_key=nv.data
+output_ek_pub_pem=ekpub.pem
+output_ek_pub=ek.pub
+output_ak_pub_pem=akpub.pem
+output_ak_pub=ak.pub
+output_ak_pub_name=ak.name
+output_mkcredential=mkcred.out
+output_actcredential=actcred.out
+output_quote=quote.out
+output_quotesig=quotesig.out
+output_quotepcr=quotepcr.out
+
+cleanup() {
+  rm -f $file_input_data $file_input_key $output_ek_pub $output_ek_pub_pem \
+  $output_ak_pub $output_ak_pub_pem $output_ak_pub_name $output_mkcredential \
+  $output_actcredential $output_quote $output_quotesig $output_quotepcr \
+  $context_ak rand.out session.ctx
+
+  tpm2_pcrreset -Q $debug_pcr
+  tpm2_evictcontrol -Q -C o -c $handle_ek -P "$ownerpw" 2>/dev/null || true
+  tpm2_evictcontrol -Q -C o -c $context_ak -P "$ownerpw" 2>/dev/null || true
+
+  tpm2_nvundefine -Q $handle_nv -C $handle_hier \
+  -P "$ownerpw" 2>/dev/null || true
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+    shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+cleanup "no-shut-down"
+
+echo 12345678 > $file_input_data
+echo 1234567890123456789012345678901 > $file_input_key
+
+getrandom() {
+  loaded_randomness=`tpm2_getrandom --hex $1`
+}
+
+tpm2_changeauth -c o "$ownerpw"
+tpm2_changeauth -c e "$endorsepw"
+
+# Key generation
+tpm2_createek -Q -c $handle_ek -G $ek_alg -u $output_ek_pub_pem -f pem \
+-w "$ownerpw" -P "$endorsepw"
+tpm2_readpublic -Q -c $handle_ek -o $output_ek_pub
+
+tpm2_createak -Q -C $handle_ek -c $context_ak -G $ak_alg -g $digestAlg \
+-s $signAlg -u $output_ak_pub_pem -f pem -n $output_ak_pub_name -p "$akpw" \
+-P "$endorsepw"
+tpm2_readpublic -Q -c $context_ak -o $output_ak_pub
+
+
+# Validate keys (registrar)
+file_size=`ls -l $output_ak_pub_name | awk {'print $5'}`
+loaded_key_name=`cat $output_ak_pub_name | xxd -p -c $file_size`
+tpm2_makecredential -Q -T none -e $output_ek_pub -s $file_input_data \
+-n $loaded_key_name -o $output_mkcredential
+
+TPM2_RH_ENDORSEMENT=0x4000000B
+tpm2_startauthsession --policy-session -S session.ctx
+tpm2_policysecret -S session.ctx -c $TPM2_RH_ENDORSEMENT $endorsepw
+tpm2_activatecredential -Q -c $context_ak -C $handle_ek \
+-i $output_mkcredential -o $output_actcredential -p "$akpw" \
+-P "session:session.ctx"
+tpm2_flushcontext session.ctx
+diff $file_input_data $output_actcredential
+
+
+# Quoting
+tpm2_pcrreset -Q $debug_pcr
+tpm2_pcrextend -Q $debug_pcr:sha256=$rand_pcr_value
+tpm2_pcrread -Q
+getrandom 20
+tpm2_quote -Q -c $context_ak -l $digestAlg:$debug_pcr_list \
+-q $loaded_randomness -m $output_quote -s $output_quotesig -o $output_quotepcr \
+-g $digestAlg -p "$akpw"
+
+
+# Verify quote
+tpm2_checkquote -Q -u $output_ak_pub_pem -m $output_quote -s $output_quotesig \
+-f $output_quotepcr -g $digestAlg -q $loaded_randomness
+
+
+# Save U key from verifier
+tpm2_nvdefine -Q $handle_nv -C $handle_hier -s 32 -a "ownerread|ownerwrite" \
+-p "indexpass" -P "$ownerpw"
+tpm2_nvwrite -Q $handle_nv -C $handle_hier -P "$ownerpw" -i $file_input_key
+tpm2_nvread -Q $handle_nv -C $handle_hier -s 32 -P "$ownerpw"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/certify.sh b/data/tpm2-tools-4.1.1/integration/tests/certify.sh
new file mode 100755
index 0000000..e398815
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/certify.sh
@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f primary.ctx certify.ctx certify.pub certify.priv certify.name \
+    attest.out sig.out &>/dev/null
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear -Q
+
+tpm2_createprimary -Q -C e -g sha256 -G rsa -c primary.ctx
+
+tpm2_create -Q -g sha256 -G rsa -u certify.pub -r certify.priv -C primary.ctx
+
+tpm2_load -Q -C primary.ctx -u certify.pub -r certify.priv -n certify.name \
+-c certify.ctx
+
+tpm2_certify -Q -c primary.ctx -C certify.ctx -g sha256 -o attest.out -s sig.out
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/certifycreation.sh b/data/tpm2-tools-4.1.1/integration/tests/certifycreation.sh
new file mode 100755
index 0000000..fb902bf
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/certifycreation.sh
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f  primary.ctx creation.data creation.digest creation.ticket rsa.pub \
+    rsa.priv signature.bin attestation.bin sslpub.pem qual.dat sec_key.pub \
+    sec_key.priv sec_key.ctx
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear -Q
+
+tpm2_createprimary -C o -c primary.ctx --creation-data creation.data \
+-d creation.digest -t creation.ticket -Q
+
+tpm2_create -G rsa -u rsa.pub -r rsa.priv -C primary.ctx -c signing_key.ctx -Q
+
+tpm2_readpublic -c signing_key.ctx -f pem -o sslpub.pem
+
+tpm2_certifycreation -C signing_key.ctx -c primary.ctx -d creation.digest \
+-t creation.ticket -g sha256 -o signature.bin --attestation attestation.bin \
+-f plain -s rsassa
+
+openssl dgst -verify sslpub.pem -keyform pem -sha256 -signature signature.bin \
+attestation.bin
+
+#
+# Test with qualifier data
+#
+dd if=/dev/urandom of=qual.dat bs=1 count=32
+
+tpm2_certifycreation -C signing_key.ctx -c primary.ctx -d creation.digest \
+-t creation.ticket -g sha256 -o signature.bin --attestation attestation.bin \
+-f plain -s rsassa -q qual.dat
+
+openssl dgst -verify sslpub.pem -keyform pem -sha256 -signature signature.bin \
+attestation.bin
+
+#
+# Test certification with non primary keys
+#
+tpm2_create -C primary.ctx -u sec_key.pub -r sec_key.priv -t creation.ticket \
+-d creation.digest --creation-data creation.data -Q
+
+tpm2_load -C primary.ctx -u sec_key.pub -r sec_key.priv -c sec_key.ctx -Q
+
+tpm2_certifycreation -C signing_key.ctx -c sec_key.ctx -d creation.digest \
+-t creation.ticket -g sha256 -o signature.bin --attestation attestation.bin \
+-f plain -s rsassa
+
+openssl dgst -verify sslpub.pem -keyform pem -sha256 -signature signature.bin \
+attestation.bin
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/changeauth.sh b/data/tpm2-tools-4.1.1/integration/tests/changeauth.sh
new file mode 100755
index 0000000..175e141
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/changeauth.sh
@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm key.ctx key.pub key.priv primary.ctx
+
+    shut_down
+}
+trap cleanup EXIT
+
+start_up
+
+ownerPasswd=abc123
+endorsePasswd=abc123
+lockPasswd=abc123
+new_ownerPasswd=newpswd
+new_endorsePasswd=newpswd
+new_lockPasswd=newpswd
+
+tpm2_clear
+
+tpm2_changeauth -c o $ownerPasswd
+tpm2_changeauth -c e $endorsePasswd
+tpm2_changeauth -c l $lockPasswd
+
+tpm2_changeauth -c o -p $ownerPasswd $new_ownerPasswd
+tpm2_changeauth -c e -p $endorsePasswd $new_endorsePasswd
+tpm2_changeauth -c l -p $lockPasswd $new_lockPasswd
+
+tpm2_clear $new_lockPasswd
+
+tpm2_changeauth -c o $ownerPasswd
+tpm2_changeauth -c e $endorsePasswd
+tpm2_changeauth -c l $lockPasswd
+
+tpm2_clear $lockPasswd
+
+# Test changing an objects auth
+tpm2_createprimary -Q -C o -c primary.ctx
+tpm2_create -Q -C primary.ctx -p foo -u key.pub -r key.priv
+tpm2_load -Q -C primary.ctx -u key.pub -r key.priv -c key.ctx
+tpm2_changeauth -C primary.ctx -p foo -c key.ctx -r new.priv bar
+
+# Test changing an NV index auth
+tpm2_startauthsession -S session.ctx
+tpm2_policycommandcode -S session.ctx -L policy.nvchange TPM2_CC_NV_ChangeAuth
+tpm2_flushcontext session.ctx
+NVIndex=0x1500015
+tpm2_nvdefine   $NVIndex -C o -s 32 -a "authread|authwrite" -L policy.nvchange
+tpm2_startauthsession --policy-session -S session.ctx
+tpm2_policycommandcode -S session.ctx -L policy.nvchange TPM2_CC_NV_ChangeAuth
+tpm2_changeauth -p session:session.ctx -c $NVIndex newindexauth
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/checkquote.sh b/data/tpm2-tools-4.1.1/integration/tests/checkquote.sh
new file mode 100755
index 0000000..401c028
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/checkquote.sh
@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+handle_ek=0x81010009
+handle_ak=0x8101000a
+ek_alg=rsa
+ak_alg=rsa
+digestAlg=sha256
+signAlg=rsassa
+akpw=akpass
+ak_ctx=ak.ctx
+
+output_ek_pub_pem=ekpub.pem
+output_ak_pub_pem=akpub.pem
+output_ak_pub_name=ak.name
+output_quote=quote.out
+output_quotesig=quotesig.out
+output_quotepcr=quotepcr.out
+
+cleanup() {
+  rm -f $output_ek_pub_pem $output_ak_pub_pem $output_ak_pub_name \
+  $output_quote $output_quotesig $output_quotepcr rand.out $ak_ctx
+
+  tpm2_pcrreset 16
+  tpm2_evictcontrol -C o -c $handle_ek 2>/dev/null || true
+  tpm2_evictcontrol -C o -c $handle_ak 2>/dev/null || true
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+    shut_down
+    echo "shutdown"
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+getrandom() {
+  tpm2_getrandom -o rand.out $1
+  local file_size=`ls -l rand.out | awk {'print $5'}`
+  loaded_randomness=`cat rand.out | xxd -p -c $file_size`
+}
+
+# Key generation
+tpm2_createek -c $handle_ek -G $ek_alg -u $output_ek_pub_pem -f pem
+
+tpm2_createak -C $handle_ek -c $ak_ctx -G $ak_alg -g $digestAlg -s $signAlg \
+-u $output_ak_pub_pem -f pem -n $output_ak_pub_name -p "$akpw"
+tpm2_evictcontrol -Q -c $ak_ctx $handle_ak
+
+# Quoting
+getrandom 20
+tpm2_quote -c $handle_ak -l sha256:15,16,22 -q $loaded_randomness \
+-m $output_quote -s $output_quotesig -o $output_quotepcr -g $digestAlg -p "$akpw"
+
+# Verify quote
+tpm2_checkquote -u $output_ak_pub_pem -m $output_quote -s $output_quotesig \
+-f $output_quotepcr -g $digestAlg -q $loaded_randomness
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/clear.sh b/data/tpm2-tools-4.1.1/integration/tests/clear.sh
new file mode 100755
index 0000000..bf7ba76
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/clear.sh
@@ -0,0 +1,37 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+
+    shut_down
+}
+trap cleanup EXIT
+
+start_up
+
+lockPasswd=lockoutpass
+platPasswd=platformpass
+
+#Test tpm2_clear works with blank lockout auth as default
+tpm2_clear
+
+#Test tpm2_clear works with non-empy lockout auth as default
+tpm2_changeauth -c l $lockPasswd
+tpm2_clear $lockPasswd
+
+#Test tpm2_clear works with non-empy lockout auth and specified auth hierarchy
+tpm2_changeauth -c l $lockPasswd
+tpm2_clear -c l $lockPasswd
+
+# XXX non-empy platform auth does not work with 4.1.1 (S. PINEAU 20/04/17)
+exit 0
+
+#Test tpm2_clear works with non-empy platform auth and specified auth hierarchy
+tpm2_changeauth -c p $platPasswd
+tpm2_clear -c p $platPasswd
+
+#Undo change of platform auth
+tpm2_changeauth -c p -p $platPasswd
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/clockrateadjust.sh b/data/tpm2-tools-4.1.1/integration/tests/clockrateadjust.sh
new file mode 100755
index 0000000..d8bc6cb
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/clockrateadjust.sh
@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+	tpm2_changeauth -c o -p newowner 2>/dev/null || true
+	tpm2_changeauth -c p -p newplatform 2>/dev/null || true
+
+	rm -f clock.yaml
+
+	if [ "$1" != "no-shut-down" ]; then
+		shut_down
+	fi
+}
+trap cleanup EXIT
+
+start_up
+
+tpm2_clockrateadjust s
+tpm2_clockrateadjust ss
+tpm2_clockrateadjust sss
+
+tpm2_clockrateadjust f
+tpm2_clockrateadjust ff
+tpm2_clockrateadjust fff
+
+# validate hierarchies and passwords
+tpm2_changeauth -c o newowner
+# XXX tpm2_changeauth -c p newplatform
+
+tpm2_clockrateadjust -c o -p newowner ss
+# XXX tpm2_clockrateadjust -c p -p newplatform ff
+
+trap - err
+
+tpm2_clockrateadjust -c o -p newowner ssss
+if [ $? -eq 0 ]; then
+  echo "expected ssss to fail"
+  exit 1
+fi
+
+tpm2_clockrateadjust -c o -p newowner sfss
+if [ $? -eq 0 ]; then
+  echo "expected ssss to fail"
+  exit 1
+fi
+
+tpm2_clockrateadjust -c o -p newowner sfs
+if [ $? -eq 0 ]; then
+  echo "expected sfs to fail"
+  exit 1
+fi
+
+tpm2_clockrateadjust -c o -p newowner qqq
+if [ $? -eq 0 ]; then
+  echo "expected qqq to fail"
+  exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/create.sh b/data/tpm2-tools-4.1.1/integration/tests/create.sh
new file mode 100755
index 0000000..f41e660
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/create.sh
@@ -0,0 +1,107 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+  rm -f key.pub key.priv policy.bin out.pub key.ctx
+
+  if [ $(ina "$@" "keep-context") -ne 0 ]; then
+    rm -f context.out
+  fi
+
+  rm -f key*.ctx out.yaml
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+    shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_createprimary -Q -C o -g sha1 -G rsa -c context.out
+
+# Keep the algorithm specifiers mixed to test friendly and raw
+# values.
+for gAlg in `populate_hash_algs`; do
+    for GAlg in rsa keyedhash ecc aes; do
+        echo "tpm2_create -Q -C context.out -g $gAlg -G $GAlg -u key.pub \
+        -r key.priv"
+        tpm2_create -Q -C context.out -g $gAlg -G $GAlg -u key.pub -r key.priv
+        cleanup "keep-context" "no-shut-down"
+    done
+done
+
+cleanup "keep-context" "no-shut-down"
+
+policy_orig=f28230c080bbe417141199e36d18978228d8948fc10a6a24921b9eba6bb1d988
+echo "$policy_orig" | xxd -r -p > policy.bin
+
+tpm2_create -C context.out -g sha256 -G rsa -L policy.bin -u key.pub \
+-r key.priv -a 'sign|fixedtpm|fixedparent|sensitivedataorigin' > out.pub
+
+policy_new=$(yaml_get_kv out.pub "authorization policy")
+
+test "$policy_orig" == "$policy_new"
+
+#
+# Test the extended format specifiers
+#
+# aes128cfb (mandatory for PCClient TPMs)
+tpm2_create -Q -C context.out -g sha256 -G aes128cfb -u key.pub -r key.priv
+tpm2_load -Q -C context.out -u key.pub -r key.priv -c key1.ctx
+tpm2_readpublic -c key1.ctx > out.yaml
+keybits=$(yaml_get_kv out.yaml "sym-keybits")
+mode=$(yaml_get_kv out.yaml "sym-mode" "value")
+test "$keybits" -eq "128"
+test "$mode" == "cfb"
+
+# aes256ofb (if supported)
+if is_alg_supported aes256ofb; then
+  mode="$(populate_alg_modes $strongest_aes | head -n1)" # e.g. aes128ecb
+  tpm2_create -Q -C context.out -g sha256 -G aes256ofb -u key.pub -r key.priv
+  tpm2_load -Q -C context.out -u key.pub -r key.priv -c key2.ctx
+  tpm2_readpublic -c key2.ctx > out.yaml
+  keybits=$(yaml_get_kv out.yaml "sym-keybits")
+  mode=$(yaml_get_kv out.yaml "sym-mode" "value")
+  test "$keybits" -eq "256"
+  test "$mode" == "ofb"
+fi
+
+exit 0
+
+#
+# Test scheme support
+#
+
+for alg in "rsa1024:rsaes" "ecc384:ecdaa4-sha256"; do
+  if is_alg_supported $alg; then
+    tpm2_create -Q -C context.out -g sha256 -G "$alg" -u key.pub -r key.priv
+  fi
+done
+
+# Test createloaded support
+tpm2_create -C context.out -u key.pub -r key.priv -c key.ctx
+tpm2_readpublic -c key.ctx 2>/dev/null
+
+# Test that creation data has the specified outside info
+tpm2_createprimary -C o -c prim.ctx -Q
+
+dd if=/dev/urandom of=outside.info bs=1 count=32
+tpm2_create -C prim.ctx -u key.pub -r key.priv --creation-data creation.data \
+-q outside.info -Q
+
+xxd -p creation.data | tr -d '\n' | grep `xxd -p outside.info | tr -d '\n'`
+
+# Test that selected pcrs digest is present in the creation data
+tpm2_pcrread sha256:0 -o pcr_data.bin
+
+tpm2_create -C prim.ctx -u key.pub -r key.priv --creation-data creation.data \
+-l sha256:0 -Q
+
+xxd -p creation.data | tr -d '\n' | \
+grep `cat pcr_data.bin | openssl dgst -sha256 -binary | xxd -p | tr -d '\n'`
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/createak.sh b/data/tpm2-tools-4.1.1/integration/tests/createak.sh
new file mode 100755
index 0000000..7e922c7
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/createak.sh
@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f ek.pub ak.pub ak.name ak.name ak.log
+
+    # Evict persistent handles, we want them to always succeed and never trip
+    # the onerror trap.
+    tpm2_evictcontrol -Q -C o -c 0x8101000b 2>/dev/null || true
+    tpm2_evictcontrol -Q -C o -c 0x8101000c 2>/dev/null || true
+
+    # clear tpm state
+    tpm2_clear
+
+    if [ "$1" != "no-shut-down" ]; then
+      shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_createek -Q -c 0x8101000b -G rsa -u ek.pub
+
+tpm2_createak -Q -C 0x8101000b -c ak.ctx -G rsa -g sha256 -s rsassa -u ak.pub \
+-n ak.name
+
+# Find a vacant persistent handle
+tpm2_createak -C 0x8101000b -c ak.ctx -G rsa -g sha256 -s rsassa -u ak.pub \
+-n ak.name
+tpm2_evictcontrol -c ak.ctx > ak.log
+phandle=`yaml_get_kv ak.log "persistent-handle"`
+tpm2_evictcontrol -Q -C o -c $phandle
+
+# Test tpm2_createak with endorsement password
+cleanup "no-shut-down"
+tpm2_changeauth -c e endauth
+tpm2_createek -Q -P endauth -c 0x8101000b -G rsa -u ek.pub
+tpm2_createak -Q -P endauth -C 0x8101000b -c ak.ctx -G rsa -u ak.pub -n ak.name
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/createek.sh b/data/tpm2-tools-4.1.1/integration/tests/createek.sh
new file mode 100755
index 0000000..b632216
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/createek.sh
@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f ek.pub ek.log ek.template ek.nonce ek.ctx
+
+    # Evict persistent handles, we want them to always succeed and never trip
+    # the onerror trap.
+    tpm2_evictcontrol -Q -C o -c 0x81010005 2>/dev/null || true
+
+    if [ "$1" != "no-shut-down" ]; then
+      shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_createek -c 0x81010005 -G rsa -u ek.pub
+
+cleanup "no-shut-down"
+
+tpm2_createek -c - -G rsa -u ek.pub > ek.log
+phandle=`yaml_get_kv ek.log "persistent-handle"`
+tpm2_evictcontrol -Q -C o -c $phandle
+
+cleanup "no-shut-down"
+
+tpm2_createek -G rsa -u ek.pub -c ek.ctx
+
+cleanup "no-shut-down"
+
+ek_nonce_index=0x01c00003
+ek_template_index=0x01c00004
+
+# Define RSA EK template
+nbytes=$(wc -c $TPM2_TOOLS_TEST_FIXTURES/ek-template-default.bin | awk {'print $1'})
+tpm2_nvdefine -Q $ek_template_index -C o -s $nbytes \
+-a "ownerread|policywrite|ownerwrite"
+tpm2_nvwrite -Q $ek_template_index -C o \
+-i $TPM2_TOOLS_TEST_FIXTURES/ek-template-default.bin
+
+# Define RSA EK nonce
+echo -n -e '\0' > ek.nonce
+tpm2_nvdefine -Q $ek_nonce_index -C o -s 1 \
+-a "ownerread|policywrite|ownerwrite"
+tpm2_nvwrite -Q $ek_nonce_index -C o -i ek.nonce
+
+tpm2_createek -t -G rsa -u ek.pub -c ek.ctx
+
+cleanup "no-shut-down"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/createpolicy.sh b/data/tpm2-tools-4.1.1/integration/tests/createpolicy.sh
new file mode 100755
index 0000000..7828dd0
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/createpolicy.sh
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+###this script use for test the implementation tpm2_createpolicy
+
+cleanup() {
+    rm -f pcr.in policy.out
+
+    if [ "$1" != "no-shut-down" ]; then
+      shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+declare -A digestlengths=\
+([sha1]=20
+ [sha256]=32)
+declare -A expected_policy_digest=\
+([sha1]=f28230c080bbe417141199e36d18978228d8948fc10a6a24921b9eba6bb1d988
+ [sha256]=33e36e786c878632494217c3f490e74ca0a3a122a8a4f3c5302500df3b32b3b8)
+
+tpm2_pcrread -V sha1
+
+for halg in ${!digestlengths[@]}
+do
+    cleanup "no-shut-down"
+
+    # Create file containing expected PCR value
+    head -c $((${digestlengths[$halg]} - 1)) /dev/zero > pcr.in
+    echo -n -e '\x03' >> pcr.in
+
+    tpm2_createpolicy --policy-pcr -l $halg:0 -f pcr.in -L policy.out
+
+    # Test the policy creation hashes against expected
+    if [ $(xxd -p policy.out | tr -d '\n' ) != \
+    "${expected_policy_digest[${halg}]}" ]; then
+        echo "Failure: Creating Policy Digest with PCR policy for index 0 and \
+        ${halg} pcr index hash"
+        echo "Got: $(xxd -p policy.out | tr -d '\n')"
+        echo "Expected: ${expected_policy_digest[${halg}]}"
+        exit 1
+    fi
+done
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/createprimary.sh b/data/tpm2-tools-4.1.1/integration/tests/createprimary.sh
new file mode 100755
index 0000000..fc268e5
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/createprimary.sh
@@ -0,0 +1,90 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+start_up
+
+cleanup() {
+
+  rm -f policy.bin obj.pub pub.out primary.ctx
+
+  if [ $(ina "$@" "keep-context") -ne 0 ]; then
+    rm -f context.out
+  fi
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+    shut_down
+  fi
+}
+trap cleanup EXIT
+
+cleanup "no-shut-down"
+
+# Keep the algorithm specifiers mixed to test friendly and raw
+# values.
+for gAlg in `populate_hash_algs 'and alg != "keyedhash"'`; do
+    for GAlg in rsa xor ecc aes; do
+        echo tpm2_createprimary -Q -g $gAlg -G $GAlg -c context.out
+        tpm2_createprimary -Q -g $gAlg -G $GAlg -c context.out
+        cleanup "no-shut-down" "keep-context"
+        for Atype in o e n; do
+            tpm2_createprimary -Q -C $Atype -g $gAlg -G $GAlg -c context.out
+            cleanup "no-shut-down" "keep-context"
+        done
+    done
+done
+
+policy_orig=f28230c080bbe417141199e36d18978228d8948fc10a6a24921b9eba6bb1d988
+
+#test for createprimary objects with policy authorization structures
+echo -n "$policy_orig" | xxd -r -p > policy.bin
+
+tpm2_createprimary -Q -C o -G rsa -g sha256 -c context.out -L policy.bin \
+  -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin'
+
+tpm2_readpublic -c context.out > pub.out
+
+policy_new=$(yaml_get_kv pub.out "authorization policy")
+
+test "$policy_orig" == "$policy_new"
+
+# Test that -u can be specified to pass a TPMU_PUBLIC_ID union
+# in this case TPM2B_PUBLIC_KEY_RSA (256 bytes of zero)
+printf '\x00\x01' > ud.1
+dd if=/dev/zero bs=256 count=1 of=ud.2
+cat ud.1 ud.2 > unique.dat
+tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c prim.ctx \
+-a "restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|\
+noda" -u unique.dat
+test -f prim.ctx
+
+# Test that -g/-G do not need to be specified.
+tpm2_createprimary -Q -c context.out
+
+# Test that -o does not need to be specified.
+tpm2_createprimary -Q
+
+# Test that creation data has the specified outside info
+dd if=/dev/urandom of=outside.info bs=1 count=32
+
+tpm2_createprimary -C o -c context.out --creation-data creation.data \
+-q outside.info
+
+xxd -p creation.data | tr -d '\n' | grep `xxd -p outside.info | tr -d '\n'`
+
+# Test that selected pcrs digest is present in the creation data
+tpm2_pcrread sha256:0 -o pcr_data.bin
+
+tpm2_createprimary -C o -c context.out --creation-data creation.data \
+-l sha256:0
+
+xxd -p creation.data | tr -d '\n' | \
+grep `cat pcr_data.bin | openssl dgst -sha256 -binary | xxd -p | tr -d '\n'`
+
+# Test for session leaks
+BEFORE=$(tpm2_getcap handles-loaded-session; tpm2_getcap handles-saved-session)
+tpm2_createprimary -Q
+AFTER=$(tpm2_getcap handles-loaded-session; tpm2_getcap handles-saved-session)
+test "${BEFORE}" = "${AFTER}"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/dictionarylockout.sh b/data/tpm2-tools-4.1.1/integration/tests/dictionarylockout.sh
new file mode 100755
index 0000000..f8e7b98
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/dictionarylockout.sh
@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+###this script use for test the implementation tpm2_dictionarylockout
+
+source helpers.sh
+
+out=out.yaml
+
+cleanup() {
+    rm -f $out
+    shut_down
+}
+trap cleanup EXIT
+
+start_up
+
+tpm2_dictionarylockout -Q -V -c &>/dev/null
+
+tpm2_dictionarylockout -s -n 5 -t 6 -l 7
+
+tpm2_getcap properties-variable > $out
+v=$(yaml_get_kv "$out" "TPM2_PT_MAX_AUTH_FAIL")
+if [ $v -ne 5 ];then
+  echo "Failure: setting up the number of allowed tries in the lockout \
+  parameters"
+  exit 1
+fi
+
+v=$(yaml_get_kv "$out" "TPM2_PT_LOCKOUT_INTERVAL")
+if [ $v -ne 6 ];then
+  echo "Failure: setting up the lockout period in the lockout parameters"
+  exit 1
+fi
+
+v=$(yaml_get_kv "$out" "TPM2_PT_LOCKOUT_RECOVERY")
+if [ $v -ne 7 ];then
+  echo "Failure: setting up the lockout recovery period in the lockout \
+  parameters"
+  exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/duplicate.sh b/data/tpm2-tools-4.1.1/integration/tests/duplicate.sh
new file mode 100755
index 0000000..67becd6
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/duplicate.sh
@@ -0,0 +1,125 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f primary.ctx new_parent.prv new_parent.pub new_parent.ctx policy.dat \
+    session.dat key.prv key.pub key.ctx duppriv.bin dupseed.dat key2.prv \
+    key2.pub key2.ctx sym_key_in.bin
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+create_duplication_policy() {
+    tpm2_startauthsession -Q -S session.dat
+    tpm2_policycommandcode -Q -S session.dat -L policy.dat TPM2_CC_Duplicate
+    tpm2_flushcontext -Q session.dat
+    rm session.dat
+}
+
+start_duplication_session() {
+    tpm2_startauthsession -Q --policy-session -S session.dat
+    tpm2_policycommandcode -Q -S session.dat -L policy.dat TPM2_CC_Duplicate
+}
+
+end_duplication_session() {
+    tpm2_flushcontext -Q session.dat
+    rm session.dat
+}
+
+dump_duplication_session() {
+    rm session.dat
+}
+
+dd if=/dev/urandom of=sym_key_in.bin bs=1 count=16 status=none
+
+tpm2_createprimary -Q -C o -g sha256 -G rsa -c primary.ctx
+
+# Create a new parent, we will only use the public portion
+tpm2_create -Q -C primary.ctx -g sha256 -G rsa -r new_parent.prv \
+-u new_parent.pub -a "decrypt|fixedparent|fixedtpm|restricted|\
+sensitivedataorigin"
+
+# Create the key we want to duplicate
+create_duplication_policy
+tpm2_create -Q -C primary.ctx -g sha256 -G rsa -r key.prv -u key.pub \
+-L policy.dat -a "sensitivedataorigin|sign|decrypt"
+tpm2_load -Q -C primary.ctx -r key.prv -u key.pub -c key.ctx
+
+tpm2_loadexternal -Q -C o -u new_parent.pub -c new_parent.ctx
+
+## Null parent, Null Sym Alg
+start_duplication_session
+tpm2_duplicate -Q -C null -c key.ctx -G null -p "session:session.dat" \
+-r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+## Null Sym Alg
+start_duplication_session
+tpm2_duplicate -Q -C new_parent.ctx -c key.ctx -G null \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+## Null parent
+start_duplication_session
+tpm2_duplicate -Q -C null -c key.ctx -G aes -i sym_key_in.bin \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+## AES Sym Alg, user supplied key
+start_duplication_session
+tpm2_duplicate -Q -C new_parent.ctx -c key.ctx -G aes -i sym_key_in.bin \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+## AES Sym Alg, no user supplied key
+start_duplication_session
+tpm2_duplicate -Q -C new_parent.ctx -c key.ctx -G aes -o sym_key_out.bin \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+## Repeat the tests with a key that requires encrypted duplication
+tpm2_create -Q -C primary.ctx -g sha256 -G rsa -r key2.prv -u key2.pub \
+-L policy.dat -a "sensitivedataorigin|sign|decrypt|encryptedduplication"
+tpm2_load -Q -C primary.ctx -r key2.prv -u key2.pub -c key2.ctx
+
+## AES Sym Alg, user supplied key
+start_duplication_session
+tpm2_duplicate -Q -C new_parent.ctx -c key2.ctx -G aes -i sym_key_in.bin \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+## AES Sym Alg, no user supplied key
+start_duplication_session
+tpm2_duplicate -Q -C new_parent.ctx -c key2.ctx -G aes -o sym_key_out.bin \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+end_duplication_session
+
+trap - ERR
+
+## Null parent - should fail (TPM_RC_HIERARCHY)
+start_duplication_session
+tpm2_duplicate -Q -C null -c key2.ctx -G aes -i sym_key_in.bin \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+if [ $? -eq 0 ]; then
+  echo "Expected \"tpm2_duplicate -C null \" to fail."
+  exit 1
+fi
+dump_duplication_session
+
+## Null Sym Alg - should fail (TPM_RC_SYMMETRIC)
+start_duplication_session
+tpm2_duplicate -Q -C new_parent.ctx -c key2.ctx -G null \
+-p "session:session.dat" -r dupprv.bin -s dupseed.dat
+if [ $? -eq 0 ]; then
+  echo "Expected \"tpm2_duplicate -G null \" to fail."
+  exit 1
+fi
+dump_duplication_session
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/evictcontrol.sh b/data/tpm2-tools-4.1.1/integration/tests/evictcontrol.sh
new file mode 100755
index 0000000..46023b2
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/evictcontrol.sh
@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+  rm -f primary.ctx decrypt.ctx key.pub key.priv key.name decrypt.out \
+        encrypt.out secret.dat key.dat evict.log primary.ctx key.ctx
+
+  if [ "$1" != "no-shut-down" ]; then
+      shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear -Q
+
+tpm2_createprimary -Q -C e -g sha256 -G rsa -c primary.ctx
+
+tpm2_create -Q -g sha256 -G aes -u key.pub -r key.priv -C primary.ctx
+
+tpm2_load -Q -C primary.ctx  -u key.pub  -r key.priv -n key.name -c key.dat
+
+# Load the context into a specific handle, delete it
+tpm2_evictcontrol -Q -c key.dat 0x81010003
+
+tpm2_evictcontrol -Q -c 0x81010003 0x81010003
+
+# Load the context into a specific handle, delete it without an explicit -p
+tpm2_evictcontrol -Q -C o -c key.dat 0x81010003
+
+tpm2_evictcontrol -Q -C o -c 0x81010003
+
+# Load the context into an available handle, delete it
+tpm2_evictcontrol -C o -c key.dat > evict.log
+phandle=$(yaml_get_kv evict.log "persistent-handle")
+tpm2_evictcontrol -Q -C o -c $phandle
+
+yaml_verify evict.log
+
+# XXX platform hierarchy does not work (S. PINEAU 20/04/17)
+exit 0
+
+# verify that platform hierarchy auto selection for persistent handle works
+tpm2_createprimary -C p -c primary.ctx
+tpm2_create -C primary.ctx -c key.ctx
+tpm2_evictcontrol -C p -c key.ctx > evict.log
+
+phandle=$(yaml_get_kv evict.log persistent-handle)
+tpm2_evictcontrol -C p -c $phandle
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/flushcontext.sh b/data/tpm2-tools-4.1.1/integration/tests/flushcontext.sh
new file mode 100755
index 0000000..1a6d7f0
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/flushcontext.sh
@@ -0,0 +1,37 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+start_up
+
+cleanup() {
+    rm -f saved_session.ctx
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+cleanup "no-shut-down"
+tpm2_clear
+
+# Test for flushing the specified handle
+tpm2_createprimary -Q -C o -g sha256 -G rsa
+# tpm2-abrmd may save the transient object and restore it when using
+res=`tpm2_getcap handles-transient`
+if [ -n "$res" ]; then
+    tpm2_flushcontext -Q -c 0x80000000
+fi
+
+# Test for flushing a transient object
+tpm2_createprimary -Q -C o -g sha256 -G rsa
+tpm2_flushcontext -Q -t
+
+# Test for flushing a loaded session
+tpm2_createpolicy -Q --policy-session --policy-pcr -l sha256:0
+tpm2_flushcontext -Q -l
+
+cleanup "no-shut-down"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/getcap.sh b/data/tpm2-tools-4.1.1/integration/tests/getcap.sh
new file mode 100755
index 0000000..03a8ba2
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/getcap.sh
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+start_up
+
+out=out.yaml
+
+cleanup() {
+    rm -f $out
+
+    shut_down
+}
+trap cleanup EXIT
+
+function yaml_to_list() {
+
+python3 << pyscript
+from __future__ import print_function
+
+import sys
+import yaml
+
+with open("$1") as f:
+    try:
+        y = yaml.safe_load(f)
+        print(' '.join(y))
+    except yaml.YAMLError as exc:
+        sys.exit(exc)
+pyscript
+}
+
+tpm2_getcap -l > $out
+
+caplist=$(yaml_to_list $out)
+
+for c in $caplist; do
+    tpm2_getcap "$c" > $out
+    yaml_verify $out
+done;
+
+# negative tests
+trap - ERR
+
+# Regression test, ensure that getcap -c never accepts prefix matches
+tpm2_getcap -Q --capability="comma" 2>/dev/null
+if [ $? -eq -1 ]; then
+  echo "Expected \"tpm2_getcap -Q --capability=\"comma\"\" to fail."
+  exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/getekcertificate.sh b/data/tpm2-tools-4.1.1/integration/tests/getekcertificate.sh
new file mode 100755
index 0000000..33f4f8b
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/getekcertificate.sh
@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+handle=0x81000000
+opass=abc123
+epass=abc123
+
+cleanup() {
+    rm -f test_ek.pub ECcert.bin ECcert2.bin
+
+    shut_down
+}
+trap cleanup EXIT
+
+start_up
+
+# Sample ek public from a real platform
+echo "013a0001000b000300b20020837197674484b3f81a90cc8d46a5d724fd52
+d76e06520b64f2a1da1b331469aa00060080004300100800000000000100
+c320e2f244a8601aacf3e01d26c665249935562de1da197e9e7f076c4696
+13cfb653e98ec2c386fc1d133f2c8c6cc338b732f0b208bd838a877a3e5b
+bc3e1d4084e835c7c8906a1c05b4d2d30fdbebc1dbad950fa6b165bd4b6a
[phone]c0c4f59d489011ef1f928deea6e90061f3d375e564627315
+1ef622252098be1a4ab01dc0a12227c609fdaceb115af408d4693a6f4991
+9774695b0c12bc18a1ff7120a7337b2fb5f1951d8bb7f094d5b554c11c95
+23b30729fe64787d0a13b9e630488dab4dfd86634a5270ec72fcc5a44dc6
+79a8f32938dd8197e29dae839f5b4ca0f5de27c9522c23c54e1c2ce57859
+525118bd4470b18180eef78ae4267bcd" | xxd -r -p > test_ek.pub
+
+if [ -z "$(curl -V 2>/dev/null)" ]; then
+    echo "curl is not not installed. Skipping connection check."
+else
+    if [ "$(curl --silent --output /dev/null --write-out %{http_code} \
+    'https://ekop.intel.com/')" != '200' ]; then
+        echo 'No connection to https://ekop.intel.com/'
+        exit 77
+    fi
+fi
+
+tpm2_getekcertificate -u test_ek.pub -x -X -o ECcert.bin \
+https://ekop.intel.com/ekcertservice/
+
+# Test that stdoutput is the same
+tpm2_getekcertificate -u test_ek.pub -x https://ekop.intel.com/ekcertservice/ \
+-X > ECcert2.bin
+
+# stdout file should match -E file.
+cmp ECcert.bin ECcert2.bin
+
+# Retrieved certificate should be valid
+if [ $(md5sum ECcert.bin| awk '{ print $1 }') != \
+"56af9eb8a271bbf7ac41b780acd91ff5" ]; then
+ echo "Failed: retrieving endorsement certificate"
+ exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/getrandom.sh b/data/tpm2-tools-4.1.1/integration/tests/getrandom.sh
new file mode 100755
index 0000000..8d81e8d
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/getrandom.sh
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f random.out
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# test file output
+tpm2_getrandom -o random.out 32
+s=`ls -l random.out | awk {'print $5'}`
+test $s -eq 32
+
+#test stdout
+tpm2_getrandom --hex 4 > random.out
+s=`ls -l random.out | awk {'print $5'}`
+test $s -eq 8
+
+yaml_verify random.out
+
+# test stdout and -Q
+tpm2_getrandom -Q --hex 4 > random.out
+s=`ls -l random.out | awk {'print $5'}`
+test $s -eq 0
+
+# negative tests
+trap - ERR
+
+# larger than any known hash size should fail
+tpm2_getrandom 2000 &> /dev/null
+if [ $? -eq 0 ]; then
+    echo "tpm2_getrandom should fail with too big of request"
+    exit 1
+fi
+
+# verify that tpm2_getrandom requires a TCTI
+./tools/tpm2_getrandom -T none &> /dev/null
+if [ $? -eq 0 ]; then
+    echo "tpm2_getrandom should fail with tcti: \"none\""
+    exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/gettestresult.sh b/data/tpm2-tools-4.1.1/integration/tests/gettestresult.sh
new file mode 100755
index 0000000..9c9b399
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/gettestresult.sh
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tempfile=$(mktemp)
+
+# Verify that tests have succeeded
+tpm2_gettestresult > "${tempfile}"
+yaml_get_kv "${tempfile}" "status" | grep "success"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/gettime.sh b/data/tpm2-tools-4.1.1/integration/tests/gettime.sh
new file mode 100755
index 0000000..da668d0
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/gettime.sh
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+	rm -f attest.sig attest.data
+}
+trap cleanup EXIT
+
+start_up
+
+tpm2_createprimary -C e -c primary.ctx
+
+tpm2_create -G rsa -u rsa.pub -r rsa.priv -C primary.ctx
+
+tpm2_load -C primary.ctx -u rsa.pub -r rsa.priv -c rsa.ctx
+
+tpm2_gettime -c rsa.ctx -o attest.sig --attestation attest.data
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/hash.sh b/data/tpm2-tools-4.1.1/integration/tests/hash.sh
new file mode 100755
index 0000000..d181760
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/hash.sh
@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+#this script is for hash case testing
+
+source helpers.sh
+
+ticket_file=ticket.out
+hash_out_file=hash.out
+hash_in_file=hash.in
+out=out.yaml
+
+cleanup() {
+  rm -f $ticket_file $hash_out_file $hash_in_file $out
+
+  if [ "$1" != "no-shut-down" ]; then
+      shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+echo "T0naX0u123abc" > $hash_in_file
+
+# Test with ticket and hash output files (binary) and verify that the output
+# hash is correct. Ticket is not stable and changes run to run, don't verify it.
+tpm2_hash -C e -g sha1 -o $hash_out_file -t $ticket_file $hash_in_file
+
+expected=`shasum -a 1 $hash_in_file | awk '{print $1}'`
+actual=`cat $hash_out_file | xxd -p -c 20`
+
+test "$expected" == "$actual"
+
+cleanup "no-shut-down"
+
+# Test platform hierarchy with multiple files & verify output against sha256sum
+# Test a file redirection as well. Output files are binary.
+echo "T0naX0u123abc" > $hash_in_file
+tpm2_hash -C p -g sha256 -o $hash_out_file -t $ticket_file < $hash_in_file
+
+expected=`shasum -a 256 $hash_in_file | awk '{print $1}'`
+actual=`cat $hash_out_file | xxd -p -c 32`
+
+test "$expected" == "$actual"
+
+cleanup "no-shut-down"
+
+# Test stdout output as well as no options.
+# Validate that hash outputs are in hex as expected.
+tpm_hash_val=`echo 1234 | tpm2_hash -C n --hex`
+sha1sum_val=`echo 1234 | shasum -a 1  | cut -d\  -f 1-2 | tr -d '[:space:]'`
+if [ "$tpm_hash_val" != "$sha1sum_val" ]; then
+  echo "Expected tpm and sha1sum to produce same hashes."
+  echo "Got:"
+  echo "  tpm2_hash: $tpm_hash_val"
+  echo "  sha1sum:   $sha1sum_val"
+  exit 1
+fi
+
+# Test a file that cannot be done in 1 update call.
+# The tpm works on a 1024 block size.
+dd if=/dev/urandom of=$hash_in_file bs=2093 count=1 2>/dev/null
+tpm_hash_val=`tpm2_hash --hex $hash_in_file`
+sha1sum_val=`shasum -a 1 $hash_in_file | cut -d\  -f 1-2 | tr -d '[:space:]'`
+if [ "$tpm_hash_val" != "$sha1sum_val" ]; then
+  echo "Expected tpm and sha1sum to produce same hashes"
+  echo "Got:"
+  echo "  tpm2_hash: $tpm_hash_val"
+  echo "  sha1sum:   $sha1sum_val"
+  exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/hmac.sh b/data/tpm2-tools-4.1.1/integration/tests/hmac.sh
new file mode 100755
index 0000000..6504faf
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/hmac.sh
@@ -0,0 +1,103 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+alg_primary_obj=sha256
+alg_primary_key=rsa
+alg_create_key=hmac
+
+handle_hmac_key=0x81010013
+
+file_primary_key_ctx=primary.ctx
+file_hmac_key_pub=key.pub
+file_hmac_key_priv=key.priv
+file_hmac_key_name=name.dat
+file_hmac_key_ctx=key.ctx
+file_hmac_output=hmac.out
+file_hmac_key_handle=key.handle
+
+file_input_data=secret.data
+
+cleanup() {
+  rm -f $file_primary_key_ctx $file_hmac_key_pub $file_hmac_key_priv \
+        $file_hmac_key_name $file_hmac_output ticket.out
+
+  if [ $(ina "$@" "keep-context") -ne 0 ]; then
+    rm -f $file_hmac_key_ctx $file_input_data
+    # attempt to evict the hmac persistent key handle, but don't cause failures
+    # if this fails as it may not be loaded.
+    tpm2_evictcontrol -c $file_hmac_key_handle 2>/dev/null || true
+  fi
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+    shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+echo "12345678" > $file_input_data
+
+tpm2_clear
+
+tpm2_createprimary -Q -C e -g $alg_primary_obj -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -G $alg_create_key -u $file_hmac_key_pub -r $file_hmac_key_priv \
+-C $file_primary_key_ctx
+
+tpm2_load -Q -C $file_primary_key_ctx -u $file_hmac_key_pub \
+-r $file_hmac_key_priv -n $file_hmac_key_name -c $file_hmac_key_ctx
+
+# verify that persistent object can be used via a serialized handle
+tpm2_evictcontrol -C o -c $file_hmac_key_ctx -o $file_hmac_key_handle
+
+cat $file_input_data | tpm2_hmac -Q -c $file_hmac_key_handle \
+-o $file_hmac_output
+
+cleanup "keep-context" "no-shut-down"
+
+# Test large file, ie sequence hmac'ing.
+dd if=/dev/urandom of=$file_input_data bs=2093 count=1 2>/dev/null
+tpm2_hmac -Q -c $file_hmac_key_ctx -o $file_hmac_output $file_input_data
+
+####handle test
+rm -f $file_hmac_output
+
+cleanup "no-shut-down"
+
+# Test stdin
+echo "12345678" > $file_input_data
+
+tpm2_clear
+
+tpm2_createprimary -Q -C e -g $alg_primary_obj -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -G $alg_create_key -u $file_hmac_key_pub -r $file_hmac_key_priv \
+-C $file_primary_key_ctx
+
+tpm2_load -Q -C $file_primary_key_ctx -u $file_hmac_key_pub \
+-r $file_hmac_key_priv -n $file_hmac_key_name -c $file_hmac_key_ctx
+
+cat $file_input_data | tpm2_hmac -Q -c $file_hmac_key_ctx -o $file_hmac_output
+
+# test ticket option
+cat $file_input_data | tpm2_hmac -Q -c $file_hmac_key_ctx -o $file_hmac_output \
+-t ticket.out
+test -f ticket.out
+
+# test no output file
+cat $file_input_data | tpm2_hmac -c $file_hmac_key_ctx 1>/dev/null
+
+# verify that silent is indeed silent
+stdout=`cat $file_input_data | tpm2_hmac -Q -c $file_hmac_key_ctx`
+if [ -n "$stdout" ]; then
+    echo "Expected no output when run in quiet mode, got\"$stdout\""
+    exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/import.sh b/data/tpm2-tools-4.1.1/integration/tests/import.sh
new file mode 100755
index 0000000..0f7b900
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/import.sh
@@ -0,0 +1,234 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f import_key.ctx import_key.name import_key.priv import_key.pub \
+    parent.ctx plain.dec.ssl  plain.enc plain.txt sym.key import_rsa_key.pub \
+    import_rsa_key.priv import_rsa_key.ctx import_rsa_key.name private.pem \
+    public.pem plain.rsa.enc plain.rsa.dec public.pem data.in.raw \
+    data.in.digest data.out.signed ticket.out ecc.pub ecc.priv ecc.name \
+    ecc.ctx private.ecc.pem public.ecc.pem passfile aes.key policy.dat \
+    aes.priv aes.pub
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+run_aes_import_test() {
+
+    dd if=/dev/urandom of=sym.key bs=1 count=$3 2>/dev/null
+
+    #Symmetric Key Import Test
+    echo "tpm2_import -Q -G aes -g "$name_alg" -i sym.key -C $1 \
+    -u import_key.pub -r import_key.priv"
+
+    tpm2_import -Q -G aes -g "$name_alg" -i sym.key -C $1 -u import_key.pub \
+    -r import_key.priv
+
+    tpm2_load -Q -C $1 -u import_key.pub -r import_key.priv -n import_key.name \
+    -c import_key.ctx
+
+    echo "plaintext" > "plain.txt"
+
+    if is_cmd_supported "EncryptDecrypt"; then
+        tpm2_encryptdecrypt -c import_key.ctx -o plain.enc plain.txt
+
+        openssl enc -in plain.enc -out plain.dec.ssl -d -K `xxd -c 256 -p sym.key` \
+        -iv 0 -$2
+
+        diff plain.txt plain.dec.ssl
+    else
+        tpm2_readpublic -c import_key.ctx >out.pub
+        alg=$(yaml_get_kv out.pub "sym-alg" "value")
+        if [ "$alg" != "aes" ]; then
+            echo "Algorithm parsed from tpm2_readpublic is '$alg' but should be \
+                  'aes'"
+            exit 1
+        fi
+        rm out.pub
+    fi
+
+    rm import_key.ctx
+}
+
+run_rsa_import_test() {
+
+    #Asymmetric Key Import Test
+    openssl genrsa -out private.pem $2
+    openssl rsa -in private.pem -pubout > public.pem
+
+    # Test an import without the parent public info data to force a readpublic
+    tpm2_import -Q -G rsa -g "$name_alg" -i private.pem -C $1 \
+    -u import_rsa_key.pub -r import_rsa_key.priv
+
+    tpm2_load -Q -C $1 -u import_rsa_key.pub -r import_rsa_key.priv \
+    -n import_rsa_key.name -c import_rsa_key.ctx
+
+    openssl rsa -in private.pem -out public.pem -outform PEM -pubout
+    openssl rsautl -encrypt -inkey public.pem -pubin -in plain.txt \
+    -out plain.rsa.enc
+
+    tpm2_rsadecrypt -c import_rsa_key.ctx -o plain.rsa.dec plain.rsa.enc
+
+    diff plain.txt plain.rsa.dec
+
+    # test verifying a sigature with the imported key, ie sign in tpm and
+    # verify with openssl
+    echo "data to sign" > data.in.raw
+
+    shasum -a 256 data.in.raw | awk '{ print "000000 " $1 }' | xxd -r -c 32 > \
+    data.in.digest
+
+    tpm2_sign -Q -c import_rsa_key.ctx -g sha256 -d -f plain \
+    -o data.out.signed data.in.digest
+
+    openssl dgst -verify public.pem -keyform pem -sha256 -signature \
+    data.out.signed data.in.raw
+
+    # Sign with openssl and verify with TPM
+    openssl dgst -sha256 -sign private.pem -out data.out.signed data.in.raw
+
+    # Verify with the TPM
+    tpm2_verifysignature -Q -c import_rsa_key.ctx -g sha256 -m data.in.raw \
+    -f rsassa -s data.out.signed -t ticket.out
+
+    rm import_rsa_key.ctx
+}
+
+run_ecc_import_test() {
+    #
+    # Test loading an OSSL PEM format ECC key, and verifying a signature
+    # external to the TPM
+    #
+
+    #
+    # Generate a Private and Public ECC pem file
+    #
+    openssl ecparam -name $2 -genkey -noout -out private.ecc.pem
+    openssl ec -in private.ecc.pem -out public.ecc.pem -pubout
+
+    # Generate a hash to sign
+    echo "data to sign" > data.in.raw
+    shasum -a 256 data.in.raw | awk '{ print "000000 " $1 }' | xxd -r -c 32 > \
+    data.in.digest
+
+    tpm2_import -Q -G ecc -g "$name_alg" -i private.ecc.pem -C $1 -u ecc.pub \
+    -r ecc.priv
+
+    tpm2_load -Q -C $1 -u ecc.pub -r ecc.priv -n ecc.name -c ecc.ctx
+
+    # Sign in the TPM and verify with OSSL
+    tpm2_sign -Q -c ecc.ctx -g sha256 -d -f plain -o data.out.signed \
+    data.in.digest
+    openssl dgst -verify public.ecc.pem -keyform pem -sha256 \
+    -signature data.out.signed data.in.raw
+
+    # Sign with openssl and verify with TPM.
+    openssl dgst -sha256 -sign private.ecc.pem -out data.out.signed data.in.raw
+    tpm2_verifysignature -Q -c ecc.ctx -g sha256 -m data.in.raw -f ecdsa \
+    -s data.out.signed
+
+    rm ecc.ctx
+}
+
+run_rsa_import_passin_test() {
+
+    if [ "$3" != "stdin" ]; then
+        tpm2_import -Q -G rsa -i "$2" -C "$1" \
+            -u "import_rsa_key.pub" -r "import_rsa_key.priv" \
+            --passin "$3"
+    else
+        tpm2_import -Q -G rsa -i "$2" -C "$1" \
+            -u "import_rsa_key.pub" -r "import_rsa_key.priv" \
+            --passin "$3" < "$4"
+    fi;
+}
+
+run_aes_policy_import_test() {
+
+	dd if=/dev/urandom of=aes.key bs=16 count=1
+	dd if=/dev/urandom of=policy.dat bs=32 count=1
+
+	tpm2_import -C "$1" -G aes -i aes.key -L policy.dat -u aes.pub -r aes.priv
+
+	tpm2_load -C "$1" -u aes.priv -u aes.pub -r aes.priv -c aes.ctx
+
+	trap - ERR
+	echo 'foo' | tpm2_encryptdecrypt -c aes.ctx -o plain.rsa.dec plain.rsa.enc
+	if [ $? -eq 0 ]; then
+		echo "expected tpm2_encryptdecrypt to fail"
+		exit 1
+	fi
+        trap onerror ERR
+}
+
+run_test() {
+
+    cleanup "no-shut-down"
+
+    parent_alg=$1
+    name_alg=$2
+
+    tpm2_createprimary -Q -G "$parent_alg" -g "$name_alg" -C o -c parent.ctx
+
+    # 128 bit AES is 16 bytes
+    if is_alg_supported aes128; then
+        run_aes_import_test parent.ctx aes-128-cfb 16
+    fi
+    # 256 bit AES is 32 bytes
+    if is_alg_supported aes256; then
+        run_aes_import_test parent.ctx aes-256-cfb 32
+    fi
+
+    run_rsa_import_test parent.ctx 1024
+    run_rsa_import_test parent.ctx 2048
+
+    run_ecc_import_test parent.ctx prime256v1
+}
+
+#
+# Run the tests against:
+#   - RSA2048 with AES CFB 128 and 256 bit parents
+#   - SHA256 object (not parent) name algorithms
+#
+parent_algs=("rsa2048:aes128cfb" "rsa2048:aes256cfb" "ecc256:aes128cfb")
+halgs=`populate_hash_algs 'and alg != "sha1"'`
+echo "halgs: $halgs"
+for pa in "${parent_algs[@]}"; do
+  for name in $halgs; do
+    if is_alg_supported $pa; then
+        echo "$pa - $name"
+        run_test "$pa" "$name"
+    fi
+  done;
+done;
+
+#
+# Test the passin options
+#
+
+tpm2_createprimary -Q -c parent.ctx
+
+openssl genrsa -aes128 -passout "pass:mypassword" -out "private.pem" 1024
+
+run_rsa_import_passin_test "parent.ctx" "private.pem" "pass:mypassword"
+
+export envvar="mypassword"
+run_rsa_import_passin_test "parent.ctx" "private.pem" "env:envvar"
+
+echo -n "mypassword" > "passfile"
+run_rsa_import_passin_test "parent.ctx" "private.pem" "file:passfile"
+
+exec 42<> passfile
+run_rsa_import_passin_test "parent.ctx" "private.pem" "fd:42"
+
+run_rsa_import_passin_test "parent.ctx" "private.pem" "stdin" "passfile"
+
+run_aes_policy_import_test "parent.ctx"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/import_tpm.sh b/data/tpm2-tools-4.1.1/integration/tests/import_tpm.sh
new file mode 100755
index 0000000..ff48185
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/import_tpm.sh
@@ -0,0 +1,146 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+rm -f primary.ctx \
+          new_parent.prv new_parent.pub new_parent.ctx \
+          ipolicy.dat dpolicy.dat session.dat \
+          key.prv key.pub key.ctx \
+          dup.prv dup.pub dup.seed \
+          key2.prv key2.pub key2.ctx \
+          sym_key_in.bin \
+          dup.ctx
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+create_policy() {
+    tpm2_startauthsession -Q -S session.dat
+    tpm2_policycommandcode -Q -S session.dat -L $1 $2
+    tpm2_flushcontext -Q session.dat
+    rm session.dat
+}
+
+start_session() {
+    tpm2_startauthsession -Q --policy-session -S session.dat
+    tpm2_policycommandcode -Q -S session.dat -L $1 $2
+}
+
+end_session() {
+    tpm2_flushcontext -Q session.dat
+    rm session.dat
+}
+
+create_load_new_parent() {
+    # Create new parent
+    tpm2_create -Q -C primary.ctx -g sha256 -G rsa -r new_parent.prv \
+    -u new_parent.pub -a "restricted|sensitivedataorigin|decrypt|userwithauth"
+    # Load new parent key, only the public part
+    tpm2_loadexternal -Q -C o -u new_parent.pub -c new_parent.ctx
+}
+
+load_new_parent() {
+    # Load new parent key, public & private parts
+    tpm2_load -Q -C primary.ctx -r new_parent.prv -u new_parent.pub \
+    -c new_parent.ctx
+}
+
+create_load_duplicatee() {
+    # Create the key we want to duplicate
+    create_policy dpolicy.dat TPM2_CC_Duplicate
+    tpm2_create -Q -C primary.ctx -g sha256 -G $1 -p foo -r key.prv -u key.pub \
+    -L dpolicy.dat -a "sensitivedataorigin|decrypt|userwithauth"
+    # Load the key
+    tpm2_load -Q -C primary.ctx -r key.prv -u key.pub -c key.ctx
+    # Extract the public part for import later
+    tpm2_readpublic -Q -c key.ctx -o dup.pub
+}
+
+do_duplication() {
+    start_session dpolicy.dat TPM2_CC_Duplicate
+    if [ "$2" = "aes" ]
+    then
+        tpm2_duplicate -Q -C new_parent.ctx -c key.ctx -G aes -o sym.key \
+        -p "session:session.dat" -r dup.dup -s dup.seed
+    else
+        tpm2_duplicate -Q -C new_parent.ctx -c key.ctx -G null \
+        -p "session:session.dat" -r dup.dup -s dup.seed
+    fi
+    end_session
+}
+
+do_import_load() {
+    if [ "$2" = "aes" ]
+    then
+        tpm2_import -Q -C new_parent.ctx -k sym.key -u dup.pub -i dup.dup \
+        -r dup.prv -s dup.seed -L dpolicy.dat
+    else
+        tpm2_import -Q -C new_parent.ctx -u dup.pub -i dup.dup -r dup.prv \
+        -s dup.seed -L dpolicy.dat
+    fi
+    tpm2_load -Q -C new_parent.ctx -r dup.prv -u dup.pub -c dup.ctx
+}
+
+test() {
+    # New parent ...
+    create_load_new_parent
+    # Key to be duplicated
+    create_load_duplicatee $1
+    # Duplicate the key
+    do_duplication $2
+    # Remove, we're done with it
+    rm new_parent.ctx
+    # Load the full thing this time
+    load_new_parent
+    # Import & load the duplicate
+    do_import_load $2
+}
+
+# Part 1 : Duplicate 3 varieties of key (aes, rsa or ecc)
+# and protect them using sym_alg null or aes, verify they
+# can be imported & loaded
+for dup_key_type in aes rsa ecc; do
+    for sym_key_type in aes null; do
+        tpm2_createprimary -Q -C o -g sha256 -G rsa -c primary.ctx
+        test $dup_key_type $sym_key_type
+        cleanup "no-shut-down"
+    done
+done
+
+# Part 2 :
+# Create a rsa key (Kd)
+# Encrypt a message using Kd
+# Duplicate Kd
+# Import & Load Kd
+# Decrypt the message and verify
+tpm2_createprimary -Q -C o -g sha256 -G rsa -c primary.ctx
+# New parent ...
+create_load_new_parent
+# Key to be duplicated
+create_load_duplicatee rsa
+# Encrypt a secret message
+echo "Mary had a little lamb ..." > plain.txt
+tpm2_rsaencrypt -Q -c key.ctx -o cipher.txt plain.txt
+# Duplicate the key
+do_duplication null
+# Remove, we're done with it
+rm new_parent.ctx
+# Load the full thing this time
+load_new_parent
+# Import & load the duplicate
+do_import_load null
+# Decrypt the secret message using duplicated key
+tpm2_rsadecrypt -Q -p foo -c dup.ctx -o recovered.txt cipher.txt
+# Check we got it right ...
+diff recovered.txt plain.txt
+# Cleanup
+rm plain.txt recovered.txt cipher.txt
+cleanup "no-shut-down"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/incrementalselftest.sh b/data/tpm2-tools-4.1.1/integration/tests/incrementalselftest.sh
new file mode 100755
index 0000000..c6c59b7
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/incrementalselftest.sh
@@ -0,0 +1,71 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# Get the list of remaining algs to be tested
+temp=$(mktemp)
+tpm2_incrementalselftest > "${temp}"
+cat ${temp}
+alglist="$(yaml_get_kv "${temp}" "remaining" || true)"
+rm -f "${temp}"
+
+# If the list of remaining algs is not empty, we can test
+# the behaviour of tpm2_incrementalselftest and see
+# each alg become scheduled and tested. If there are
+# some leftovers, just print them
+if [ -n "${alglist}" ]; then
+    for i in ${alglist}; do
+        if ! tpm2_incrementalselftest "${i}" ; then
+            echo "${i} failed to be tested."
+            exit 1
+        fi
+    done
+    localtmp=$(mktemp)
+    tpm2_incrementalselftest > "${localtmp}"
+    alglist="$(yaml_get_kv "${localtmp}" "remaining" || true)"
+    rm -f "${localtmp}"
+
+    if [ -n "${alglist}" ]; then
+        echo "Algorithm suite remaning : ${alglist}"
+    else
+        true
+    fi
+fi
+
+# Finally just verify that every algorithm are
+# effectively being already tested
+aesmodes="$(populate_algs "details['encrypting'] and details['symmetric']")"
+hashalgs="$(populate_algs "details['hash'] and not details['method'] \
+                                        and not details['signing'] \
+                                        and not details['symmetric'] \
+                                        and alg is not None")"
+eccmethods="$(populate_algs "details['signing'] and not details['hash'] \
+and \"ec\" in alg")"
+rsamethods="$(populate_algs "details['signing'] and not details['hash'] \
+and \"rsa\" in alg")"
+
+# Check testing of AES modes
+tpm2_incrementalselftest ${aesmodes} | grep -q "complete"
+
+# Check testing of Hash algorithms
+tpm2_incrementalselftest ${hashalgs} | grep -q "complete"
+
+# Check testing of ECC methods
+tpm2_incrementalselftest ${eccmethods} | grep -q "complete"
+
+# Check testing of RSA methods
+tpm2_incrementalselftest ${rsamethods} | grep -q "complete"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/load.sh b/data/tpm2-tools-4.1.1/integration/tests/load.sh
new file mode 100755
index 0000000..5669612
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/load.sh
@@ -0,0 +1,70 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+start_up
+
+alg_primary_obj=sha256
+alg_primary_key=rsa
+alg_create_obj=sha256
+alg_create_key=hmac
+
+alg_load=sha1
+
+file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key"
+file_load_key_pub=opu_"$alg_create_obj"_"$alg_create_key"
+file_load_key_priv=opr_"$alg_create_obj"_"$alg_create_key"
+file_load_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-\
+"$alg_create_obj"_"$alg_create_key"
+file_load_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-\
+"$alg_create_obj"_"$alg_create_key"
+file_load_output=load_"$file_load_key_ctx"
+
+Handle_parent=0x81010018
+Handle_ek_load=0x81010017
+
+cleanup() {
+
+  rm -f $file_load_key_pub $file_load_key_priv $file_load_key_name \
+  $file_load_key_ctx
+
+  tpm2_evictcontrol -Q -Co -c $Handle_parent 2>/dev/null || true
+
+  if [ $(ina "$@" "keep_ctx") -ne 0 ]; then
+    rm -f $file_primary_key_ctx
+  fi
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+          shut_down
+  fi
+}
+trap cleanup EXIT
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+#####file test
+
+tpm2_createprimary -Q -C e -g $alg_primary_obj -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -g $alg_create_obj -G $alg_create_key -u $file_load_key_pub \
+-r $file_load_key_priv -C $file_primary_key_ctx
+
+tpm2_load -Q -C $file_primary_key_ctx -u $file_load_key_pub \
+-r $file_load_key_priv -n $file_load_key_name -c $file_load_key_ctx
+
+#####handle test
+
+cleanup "keep_ctx" "no-shut-down"
+
+tpm2_evictcontrol -Q -C o -c $file_primary_key_ctx $Handle_parent
+
+tpm2_create -Q -C $Handle_parent -g $alg_create_obj -G $alg_create_key \
+-u $file_load_key_pub  -r $file_load_key_priv
+
+tpm2_load -Q -C $Handle_parent -u $file_load_key_pub -r $file_load_key_priv \
+-n $file_load_key_name -c $file_load_key_ctx
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/loadexternal.sh b/data/tpm2-tools-4.1.1/integration/tests/loadexternal.sh
new file mode 100755
index 0000000..b4acbed
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/loadexternal.sh
@@ -0,0 +1,239 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+alg_primary_obj=sha256
+alg_primary_key=rsa
+alg_create_obj=sha256
+alg_create_key=hmac
+
+file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key"
+file_loadexternal_key_pub=opu_"$alg_create_obj"_"$alg_create_key"
+file_loadexternal_key_priv=opr_"$alg_create_obj"_"$alg_create_key"
+file_loadexternal_key_name=name.loadexternal_"$alg_primary_obj"_\
+"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key"
+file_loadexternal_key_ctx=ctx_loadexternal_out_"$alg_primary_obj"_\
+"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key"
+file_loadexternal_output=loadexternal_"$file_loadexternal_key_ctx"
+
+Handle_parent=0x81010019
+
+cleanup() {
+  rm -f $file_primary_key_ctx $file_loadexternal_key_pub \
+  $file_loadexternal_key_priv $file_loadexternal_key_name \
+  $file_loadexternal_key_ctx $file_loadexternal_output private.pem public.pem \
+  plain.txt plain.rsa.dec key.ctx public.ecc.pem private.ecc.pem \
+  data.in.digest data.out.signed ticket.out name.bin stdout.yaml passfile \
+  private.pem
+
+  if [ $(ina "$@" "keep_handle") -ne 0 ]; then
+    tpm2_evictcontrol -Q -Co -c $Handle_parent 2>/dev/null || true
+  fi
+
+  if [ $(ina "$@" "no-shut-down") -ne 0 ]; then
+    shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+run_tss_test() {
+
+    tpm2_createprimary -Q -C e -g $alg_primary_obj -G $alg_primary_key \
+    -c $file_primary_key_ctx
+
+    tpm2_create -Q -g $alg_create_obj -G $alg_create_key \
+    -u $file_loadexternal_key_pub -r $file_loadexternal_key_priv \
+    -C $file_primary_key_ctx
+
+    tpm2_loadexternal -Q -C n -u $file_loadexternal_key_pub \
+    -c $file_loadexternal_key_ctx
+
+    tpm2_evictcontrol -Q -C o -c $file_primary_key_ctx $Handle_parent
+
+    # Test with Handle
+    cleanup "keep_handle" "no-shut-down"
+
+    tpm2_create -Q -C $Handle_parent -g $alg_create_obj -G $alg_create_key \
+    -u $file_loadexternal_key_pub  -r  $file_loadexternal_key_priv
+
+    tpm2_loadexternal -Q -C n -u $file_loadexternal_key_pub \
+    -c $file_loadexternal_key_ctx
+
+    # Test with default hierarchy (and handle)
+    cleanup "keep_handle" "no-shut-down"
+
+    tpm2_create -Q -C $Handle_parent -g $alg_create_obj -G $alg_create_key \
+    -u $file_loadexternal_key_pub -r $file_loadexternal_key_priv
+
+    tpm2_loadexternal -Q -u $file_loadexternal_key_pub \
+    -c $file_loadexternal_key_ctx
+
+    cleanup "no-shut-down"
+}
+
+# Test loading an OSSL generated private key with a password
+run_rsa_test() {
+
+    openssl genrsa -out private.pem $1
+    openssl rsa -in private.pem -out public.pem -outform PEM -pubout
+
+    echo "hello world" > plain.txt
+    openssl rsautl -encrypt -inkey public.pem -pubin -in plain.txt \
+    -out plain.rsa.enc
+
+    tpm2_loadexternal -G rsa -C n -p foo -r private.pem -c key.ctx
+
+    tpm2_rsadecrypt -c key.ctx -p foo -o plain.rsa.dec plain.rsa.enc
+
+    diff plain.txt plain.rsa.dec
+
+    # try encrypting with the public key and decrypting with the private
+    tpm2_loadexternal -G rsa -C n -p foo -u public.pem -c key.ctx
+
+    tpm2_rsaencrypt -c key.ctx plain.txt -o plain.rsa.enc
+
+    openssl rsautl -decrypt -inkey private.pem -in plain.rsa.enc \
+    -out plain.rsa.dec
+
+    diff plain.txt plain.rsa.dec
+
+    cleanup "no-shut-down"
+}
+
+#
+# Verify loading an external AES key.
+#
+# Paramter 1: The AES keysize to create in bytes.
+#
+# Notes: Also tests that name output and YAML output are valid.
+#
+run_aes_test() {
+
+    dd if=/dev/urandom of=sym.key bs=1 count=$(($1 / 8)) 2>/dev/null
+
+    tpm2_loadexternal -G aes -r sym.key -n name.bin -c key.ctx > stdout.yaml
+
+    local name1=$(yaml_get_kv "stdout.yaml" "name")
+    local name2="$(xxd -c 256 -p name.bin)"
+
+    test "$name1" == "$name2"
+
+    echo "plaintext" > "plain.txt"
+
+    if is_cmd_supported "EncryptDecrypt"; then
+        tpm2_encryptdecrypt -c key.ctx -o plain.enc plain.txt
+
+        openssl enc -in plain.enc -out plain.dec.ssl -d -K `xxd -c 256 -p sym.key` \
+        -iv 0 -aes-$1-cfb
+
+        diff plain.txt plain.dec.ssl
+    else
+        tpm2_readpublic -c key.ctx >out.pub
+        alg=$(yaml_get_kv out.pub "sym-alg" "value")
+        len=$(yaml_get_kv out.pub "sym-keybits")
+        if [ "$alg$len" != "aes$1" ]; then
+            echo "Algorithm parsed from tpm2_readpublic is '$alg$len' but \
+                  should be 'aes$1'"
+            exit 1
+        fi
+        rm out.pub
+    fi
+
+    cleanup "no-shut-down"
+}
+
+run_ecc_test() {
+    #
+    # Test loading an OSSL PEM format ECC key, and verifying a signature
+    # external to the TPM
+    #
+
+    #
+    # Generate a NIST P256 Private and Public ECC pem file
+    #
+    openssl ecparam -name $1 -genkey -noout -out private.ecc.pem
+    openssl ec -in private.ecc.pem -out public.ecc.pem -pubout
+
+    # Generate a hash to sign
+    echo "data to sign" > data.in.raw
+    shasum -a 256 data.in.raw | awk '{ print "000000 " $1 }' | xxd -r -c 32 > \
+    data.in.digest
+
+    # Load the private key for signing
+    tpm2_loadexternal -Q -G ecc -r private.ecc.pem -c key.ctx
+
+    # Sign in the TPM and verify with OSSL
+    tpm2_sign -Q -c key.ctx -g sha256 -d -f plain -o data.out.signed \
+    data.in.digest
+    openssl dgst -verify public.ecc.pem -keyform pem -sha256 -signature \
+    data.out.signed data.in.raw
+
+    # Sign with openssl and verify with TPM but only with the public portion of
+    # an object loaded
+    tpm2_loadexternal -Q -G ecc -u public.ecc.pem -c key.ctx
+    openssl dgst -sha256 -sign private.ecc.pem -out data.out.signed data.in.raw
+    tpm2_verifysignature -Q -c key.ctx -g sha256 -m data.in.raw -f ecdsa \
+    -s data.out.signed
+
+    cleanup "no-shut-down"
+}
+
+run_rsa_passin_test() {
+
+    openssl genrsa -aes128 -passout "pass:mypassword" -out "private.pem" 1024
+
+    if [ "$2" != "stdin" ]; then
+        cmd="tpm2_loadexternal -Q -G rsa -r $1 -c key.ctx --passin $2"
+    else
+        cmd="tpm2_loadexternal -Q -G rsa -r $1 -c key.ctx --passin $2 < $3"
+    fi;
+
+    eval $cmd
+
+    cleanup "no-shut-down"
+}
+
+run_tss_test
+
+for len in "1024 2048"; do
+    if is_alg_supported "rsa$len"; then
+        run_rsa_test $len
+    fi
+done
+
+for len in "128 256"; do
+    if is_alg_supported "aes$len"; then
+        run_aes_test $len
+    fi
+done
+
+if is_alg_supported "ecc256"; then
+    run_ecc_test prime256v1
+fi
+
+#
+# Test loadexternal passin option
+#
+run_rsa_passin_test "private.pem" "pass:mypassword"
+
+export envvar="mypassword"
+run_rsa_passin_test "private.pem" "env:envvar"
+
+echo -n "mypassword" > "passfile"
+run_rsa_passin_test "private.pem" "file:passfile"
+
+echo -n "mypassword" > "passfile"
+exec 42<> passfile
+run_rsa_passin_test "private.pem" "fd:42"
+
+echo -n "mypassword" > "passfile"
+run_rsa_passin_test "private.pem" "stdin" "passfile"
+
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/makecredential.sh b/data/tpm2-tools-4.1.1/integration/tests/makecredential.sh
new file mode 100755
index 0000000..228749a
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/makecredential.sh
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+handle_ek=0x81010007
+ak_ctx=ak.ctx
+ek_alg=rsa
+ak_alg=rsa
+digestAlg=sha256
+signAlg=rsassa
+
+file_input_data=secret.data
+output_ek_pub=ek_pub.out
+output_ak_pub=ak_pub.out
+output_ak_pub_name=ak_name_pub.out
+output_mkcredential=mkcredential.out
+
+cleanup() {
+    rm -f $output_ek_pub $output_ak_pub $output_ak_pub_name \
+    $output_mkcredential $file_input_data output_ak grep.txt $ak_ctx
+
+    tpm2_evictcontrol -Q -Co -c $handle_ek 2>/dev/null || true
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+echo "12345678" > $file_input_data
+
+tpm2_createek -Q -c $handle_ek -G $ek_alg -u $output_ek_pub
+
+tpm2_createak -Q -C $handle_ek -c $ak_ctx -G $ak_alg -g $digestAlg -s $signAlg \
+-u $output_ak_pub -n $output_ak_pub_name
+
+# Use -c in xxd so there is no line wrapping
+file_size=`ls -l $output_ak_pub_name | awk {'print $5'}`
+Loadkeyname=`cat $output_ak_pub_name | xxd -p -c $file_size`
+
+tpm2_makecredential -Q -e $output_ek_pub -s $file_input_data -n $Loadkeyname \
+-o $output_mkcredential
+
+# use no tpm backend
+tpm2_makecredential -T none -Q -e $output_ek_pub -s $file_input_data \
+-n $Loadkeyname -o $output_mkcredential
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/nv.sh b/data/tpm2-tools-4.1.1/integration/tests/nv.sh
new file mode 100755
index 0000000..13bb1d1
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/nv.sh
@@ -0,0 +1,288 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+nv_test_index=0x1500018
+
+large_file_name="nv.test_large_w"
+large_file_read_name="nv.test_large_r"
+
+pcr_specification=sha256:0,1,2,3+sha1:0,1,2,3
+file_pcr_value=pcr.bin
+file_policy=policy.data
+
+cleanup() {
+  tpm2_nvundefine -Q   $nv_test_index -C o 2>/dev/null || true
+  tpm2_nvundefine -Q   0x1500016 -C 0x40000001 2>/dev/null || true
+  tpm2_nvundefine -Q   0x1500015 -C 0x40000001 -P owner 2>/dev/null || true
+
+  rm -f policy.bin test.bin nv.test_w $large_file_name $large_file_read_name \
+  nv.readlock foo.dat cmp.dat $file_pcr_value $file_policy nv.out cap.out yaml.out
+
+  if [ "$1" != "no-shut-down" ]; then
+     shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+#Test nvdefine with no options
+tpm2_nvdefine > yaml.out
+tpm2_nvundefine $(yaml_get_kv yaml.out "nv-index")
+
+#Test default values for the hierarchy "-a" parameter
+tpm2_nvdefine -Q   $nv_test_index -s 32 -a "ownerread|policywrite|ownerwrite"
+tpm2_nvundefine -Q   $nv_test_index
+
+#Test writing and reading
+tpm2_nvdefine -Q   $nv_test_index -C o -s 32 \
+-a "ownerread|policywrite|ownerwrite"
+
+echo "please123abc" > nv.test_w
+
+tpm2_nvwrite -Q   $nv_test_index -C o -i nv.test_w
+
+tpm2_nvread -Q   $nv_test_index -C o -s 32 -o 0
+
+tpm2_nvreadpublic > nv.out
+yaml_get_kv nv.out "$nv_test_index" > /dev/null
+yaml_get_kv nv.out "$nv_test_index" "name" > /dev/null
+
+
+# Test writing to and reading from an offset by:
+# 1. writing "foo" into the nv file at an offset
+# 2. writing to the same offset in the nv index
+# 3. reading back the index
+# 4. comparing the result.
+
+echo -n "foo" > foo.dat
+
+dd if=foo.dat of=nv.test_w bs=1 seek=4 conv=notrunc 2>/dev/null
+
+# XXX following test segfault (S. PINEAU 20/04/17)
+## Test a pipe input
+#cat foo.dat | tpm2_nvwrite -Q   $nv_test_index -C o --offset 4 -i -
+tpm2_nvwrite -Q   $nv_test_index -C o --offset 4 -i foo.dat
+
+tpm2_nvread   $nv_test_index -C o -s 13 > cmp.dat
+
+cmp nv.test_w cmp.dat
+
+# Writing at an offset and data size too big shouldn't result in a change
+# to the index value.
+
+trap - ERR
+
+tpm2_nvwrite -Q   $nv_test_index -C o -o 30 -i foo.dat 2>/dev/null
+if [ $? -eq 0 ]; then
+  echo "Writing past the public size shouldn't work!"
+  exit 1
+fi
+trap onerror ERR
+
+tpm2_nvread   $nv_test_index -C o -s 13 > cmp.dat
+
+cmp nv.test_w cmp.dat
+
+tpm2_nvundefine   $nv_test_index -C o
+
+tpm2_pcrread -Q -o $file_pcr_value $pcr_specification
+
+tpm2_createpolicy -Q --policy-pcr -l $pcr_specification -f $file_pcr_value \
+-L $file_policy
+
+tpm2_nvdefine -Q   0x1500016 -C 0x40000001 -s 32 -L $file_policy \
+-a "policyread|policywrite"
+
+# Write with index authorization for now, since tpm2_nvwrite does not support
+# pcr policy.
+echo -n "policy locked" | tpm2_nvwrite -Q   0x1500016 -C 0x1500016 \
+-P pcr:$pcr_specification=$file_pcr_value -i -
+
+str=`tpm2_nvread   0x1500016 -C 0x1500016 \
+-P pcr:$pcr_specification=$file_pcr_value -s 13`
+
+test "policy locked" == "$str"
+
+# this should fail because authread is not allowed
+trap - ERR
+tpm2_nvread   0x1500016 -C 0x1500016 -P "index" 2>/dev/null
+trap onerror ERR
+
+tpm2_nvundefine -Q   0x1500016 -C 0x40000001
+
+#
+# Test large writes
+#
+
+tpm2_getcap properties-fixed > cap.out
+large_file_size=`yaml_get_kv cap.out "TPM2_PT_NV_INDEX_MAX" "raw"`
+nv_test_index=0x1000000
+
+# Create an nv space with attributes 1010 = TPMA_NV_PPWRITE and
+# TPMA_NV_AUTHWRITE
+tpm2_nvdefine -Q   $nv_test_index -C o -s $large_file_size -a 0x2000A
+
+base64 /dev/urandom | head -c $(($large_file_size)) > $large_file_name
+
+# XXX following test segfault (S. PINEAU 20/04/17)
+## Test file input redirection
+#tpm2_nvwrite -Q   $nv_test_index -C o -i -< $large_file_name
+#
+#tpm2_nvread   $nv_test_index -C o > $large_file_read_name
+#
+#cmp -s $large_file_read_name $large_file_name
+
+# test per-index readpublic
+tpm2_nvreadpublic "$nv_test_index" > nv.out
+yaml_get_kv nv.out "$nv_test_index" > /dev/null
+
+tpm2_nvundefine -Q   $nv_test_index -C o
+
+#
+# Test NV access locked
+#
+tpm2_nvdefine -Q   $nv_test_index -C o -s 32 \
+-a "ownerread|policywrite|ownerwrite|read_stclear|writedefine"
+
+echo "foobar" > nv.readlock
+
+tpm2_nvwrite -Q   $nv_test_index -C o -i nv.readlock
+
+tpm2_nvread -Q   $nv_test_index -C o -s 6 -o 0
+
+tpm2_nvreadlock -Q   $nv_test_index -C o
+
+# Reset ERR signal handler to test for expected nvread error
+trap - ERR
+
+tpm2_nvread -Q   $nv_test_index -C o -s 6 -o 0 2> /dev/null
+if [ $? != 1 ];then
+ echo "nvread didn't fail!"
+ exit 1
+fi
+
+trap onerror ERR
+
+# Test that write lock works
+tpm2_nvwritelock -C o $nv_test_index
+
+trap - ERR
+
+tpm2_nvwrite  $nv_test_index -C o -i nv.readlock
+if [ $? != 1 ];then
+ echo "nvwrite didn't fail!"
+ exit 1
+fi
+
+tpm2_nvundefine -C o $nv_test_index
+
+trap onerror ERR
+
+#
+# Test that owner and index passwords work by
+# 1. Setting up the owner password
+# 2. Defining an nv index that can be satisfied by an:
+#   a. Owner authorization
+#   b. Index authorization
+# 3. Using index and owner based auth during write/read operations
+# 4. Testing that auth is needed or a failure occurs.
+#
+
+tpm2_changeauth -c o owner
+
+tpm2_nvdefine   0x1500015 -C 0x40000001 -s 32 \
+  -a "policyread|policywrite|authread|authwrite|ownerwrite|ownerread" \
+  -p "index" -P "owner"
+
+# Use index password write/read, implicit -a
+tpm2_nvwrite -Q   0x1500015 -P "index" -i nv.test_w
+tpm2_nvread -Q   0x1500015 -P "index"
+
+# Use index password write/read, explicit -a
+tpm2_nvwrite -Q   0x1500015 -C 0x1500015 -P "index" -i nv.test_w
+tpm2_nvread -Q   0x1500015 -C 0x1500015 -P "index"
+
+# use owner password
+tpm2_nvwrite -Q   0x1500015 -C 0x40000001 -P "owner" -i nv.test_w
+tpm2_nvread -Q   0x1500015 -C 0x40000001 -P "owner"
+
+# Check a bad password fails
+trap - ERR
+tpm2_nvwrite -Q   0x1500015 -C 0x1500015 -P "wrong" -i nv.test_w 2>/dev/null
+if [ $? -eq 0 ];then
+ echo "nvwrite with bad password should fail!"
+ exit 1
+fi
+
+# Check using authorisation with tpm2_nvundefine
+trap onerror ERR
+
+tpm2_nvundefine   0x1500015 -C 0x40000001 -P "owner"
+
+# Check nv index can be specified simply as an offset
+tpm2_nvdefine -Q -C o -s 32 -a "ownerread|ownerwrite" 1 -P "owner"
+tpm2_nvundefine   0x01000001 -C o -P "owner"
+
+# Test setbits
+tpm2_nvdefine -C o -P "owner" -a "nt=bits|ownerread|policywrite|ownerwrite|writedefine" $nv_test_index
+tpm2_nvsetbits -C o -P "owner" -i 0xbadc0de $nv_test_index
+check=$(tpm2_nvread -C o -P "owner" $nv_test_index | xxd -p | sed s/'^0*'/0x/)
+if [ "$check" != "0xbadc0de" ]; then
+	echo "Expected setbits read value of 0xbadc0de, got \"$check\""
+	exit 1
+fi
+
+# Test global writelock
+if is_cmd_supported "NV_GlobalWriteLock"; then
+  tpm2_nvdefine -C o -P "owner" -s 32 -a "ownerread|ownerwrite|globallock" 42
+  tpm2_nvdefine -C o -P "owner" -s 32 -a "ownerread|ownerwrite|globallock" 43
+  tpm2_nvdefine -C o -P "owner" -s 32 -a "ownerread|ownerwrite|globallock" 44
+
+  echo foo | tpm2_nvwrite -C o -P "owner" -i- 42
+  echo foo | tpm2_nvwrite -C o -P "owner" -i- 43
+  echo foo | tpm2_nvwrite -C o -P "owner" -i- 44
+
+  tpm2_nvwritelock -Co -P owner --global
+
+  # These writes should fail now that its in a writelocked state
+  trap - ERR
+  echo foo | tpm2_nvwrite -C o -P "owner" -i- 42
+  if [ $? -eq 0 ]; then
+    echo "Expected tpm2_nvwrite to fail after globalwritelock of index 42"
+    exit 1
+  fi
+
+  echo foo | tpm2_nvwrite -C o -P "owner" -i- 43
+  if [ $? -eq 0 ]; then
+    echo "Expected tpm2_nvwrite to fail after globalwritelock of index 43"
+    exit 1
+  fi
+
+  echo foo | tpm2_nvwrite -C o -P "owner" -i- 44
+  if [ $? -eq 0 ]; then
+    echo "Expected tpm2_nvwrite to fail after globalwritelock of index 44"
+    exit 1
+  fi
+fi
+
+trap onerror ERR
+
+tpm2_nvundefine -C o -P "owner" $nv_test_index
+
+# Test extend
+tpm2_nvdefine -C o -P "owner" -a "nt=extend|ownerread|policywrite|ownerwrite" $nv_test_index
+echo "foo" | tpm2_nvextend -C o -P "owner" -i- $nv_test_index
+check=$(tpm2_nvread -C o -P "owner" $nv_test_index | xxd -p -c 64 | sed s/'^0*'//)
+expected="1c8457de84bb43c18d5e1d75c43e393bdaa7bca8d25967eedd580c912db65e3e"
+if [ "$check" != "$expected" ]; then
+	echo "Expected setbits read value of \"$expected\", got \"$check\""
+	exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/nvcertify.sh b/data/tpm2-tools-4.1.1/integration/tests/nvcertify.sh
new file mode 100755
index 0000000..fe6d861
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/nvcertify.sh
@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f  primary.ctx signing_key.pub signing_key.priv signature.bin attestation.bin \
+    sslpub.pem signing_key.ctx qual.dat
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear -Q
+
+tpm2_createprimary -C o -c primary.ctx -Q
+
+tpm2_create -G rsa -u signing_key.pub -r signing_key.priv -C primary.ctx \
+-c signing_key.ctx -Q
+
+tpm2_readpublic -c signing_key.ctx -f pem -o sslpub.pem -Q
+
+tpm2_nvdefine -s 32 -a "authread|authwrite" 1
+
+dd if=/dev/urandom bs=1 count=32 status=none| tpm2_nvwrite 1 -i-
+
+tpm2_nvcertify -C signing_key.ctx -g sha256 -f plain -s rsassa \
+-o signature.bin --attestation attestation.bin --size 32 1
+
+openssl dgst -verify sslpub.pem -keyform pem -sha256 -signature signature.bin \
+attestation.bin
+
+#
+# Test with qualifier data
+#
+dd if=/dev/urandom of=qual.dat bs=1 count=32
+
+tpm2_nvcertify -C signing_key.ctx -g sha256 -f plain -s rsassa \
+-o signature.bin --attestation attestation.bin --size 32 -q qual.dat 1
+
+openssl dgst -verify sslpub.pem -keyform pem -sha256 -signature signature.bin \
+attestation.bin
+
+#
+# Test if qualifier data was present in the attestation
+#
+xxd -p attestation.bin | tr -d '\n' | grep `xxd -p qual.dat | tr -d '\n'`
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/nvinc.sh b/data/tpm2-tools-4.1.1/integration/tests/nvinc.sh
new file mode 100755
index 0000000..d99f681
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/nvinc.sh
@@ -0,0 +1,152 @@
+# SPDX-License-Identifier: BSD-3-Clause
+#;**********************************************************************;
+
+source helpers.sh
+
+nv_test_index=0x1500018
+
+pcr_specification=sha256:0,1,2,3+sha1:0,1,2,3
+file_pcr_value=pcr.bin
+file_policy=policy.data
+
+cleanup() {
+  tpm2_nvundefine -Q   $nv_test_index -C o 2>/dev/null || true
+  tpm2_nvundefine -Q   0x1500016 -C 0x40000001 2>/dev/null || true
+  tpm2_nvundefine -Q   0x1500015 -C 0x40000001 -P owner 2>/dev/null || true
+
+  rm -f policy.bin test.bin nv.readlock foo.dat $file_pcr_value $file_policy \
+        nv.out cap.out
+
+  if [ "$1" != "no-shut-down" ]; then
+     shut_down
+  fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+tpm2_nvdefine -Q   $nv_test_index -C o -s 8 \
+-a "ownerread|policywrite|ownerwrite|nt=1"
+
+tpm2_nvincrement -Q   $nv_test_index -C o
+
+a=0x$(tpm2_nvread  $nv_test_index -C o -s 8 | xxd -p)
+
+tpm2_nvreadpublic > nv.out
+yaml_get_kv nv.out "$nv_test_index" > /dev/null
+
+# Test writing to and reading from an offset by:
+# 1. incrementing the nv counter
+# 2. reading back the index
+# 3. comparing the result.
+
+tpm2_nvincrement -Q   $nv_test_index -C o
+
+b=0x$(tpm2_nvread  $nv_test_index -C o -s 8 | xxd -p)
+
+if [ $(($a+1)) -ne $(($b)) ]; then
+ echo "Failed to increment: $(($a)) -> $(($b))."
+ exit 1
+fi
+
+tpm2_nvundefine   $nv_test_index -C o
+
+
+tpm2_pcrread -Q -o $file_pcr_value $pcr_specification
+
+tpm2_createpolicy -Q --policy-pcr -l $pcr_specification \
+-f $file_pcr_value -L $file_policy
+
+tpm2_nvdefine -Q   0x1500016 -C 0x40000001 -s 8 -L $file_policy \
+-a "policyread|policywrite|nt=1"
+
+# Increment with index authorization for now, since tpm2_nvincrement does not
+# support pcr policy.
+# Counter is initialised to highest value previously seen (in this case 2) then
+# incremented
+tpm2_nvincrement -Q   0x1500016 -C 0x1500016 \
+-P pcr:$pcr_specification=$file_pcr_value
+
+c=0x$(tpm2_nvread  0x1500016 -C 0x1500016 -P pcr:$pcr_specification=$file_pcr_value -s 8 | xxd -p)
+
+if [ $(($b+1)) -ne $(($c)) ]; then
+ echo "Failed to increment: $(($b)) -> $(($c))."
+ exit 1
+fi
+
+# this should fail because authread is not allowed
+trap - ERR
+tpm2_nvread   0x1500016 -C 0x1500016 -P "index" 2>/dev/null
+trap onerror ERR
+
+tpm2_nvundefine -Q   0x1500016 -C 0x40000001
+
+
+#
+# Test NV access locked
+#
+tpm2_nvdefine -Q   $nv_test_index -C o -s 8 \
+-a "ownerread|policywrite|ownerwrite|read_stclear|nt=1"
+
+tpm2_nvincrement -Q   $nv_test_index -C o
+
+tpm2_nvread -Q   $nv_test_index -C o -s 8
+
+tpm2_nvreadlock -Q   $nv_test_index -C o
+
+# Reset ERR signal handler to test for expected nvread error
+trap - ERR
+
+tpm2_nvread -Q   $nv_test_index -C o -s 8 2> /dev/null
+if [ $? != 1 ];then
+ echo "nvread didn't fail!"
+ exit 1
+fi
+
+#
+# Test that owner and index passwords work by
+# 1. Setting up the owner password
+# 2. Defining an nv index that can be satisfied by an:
+#   a. Owner authorization
+#   b. Index authorization
+# 3. Using index and owner based auth during write/read operations
+# 4. Testing that auth is needed or a failure occurs.
+#
+trap onerror ERR
+
+tpm2_changeauth -c o owner
+
+tpm2_nvdefine   0x1500015 -C 0x40000001 -s 8 \
+  -a "policyread|policywrite|authread|authwrite|ownerwrite|ownerread|nt=1" \
+  -p "index" -P "owner"
+
+# Use index password write/read, implicit -C
+tpm2_nvincrement -Q   0x1500015 -P "index"
+tpm2_nvread -Q   0x1500015 -P "index"
+
+# Use index password write/read, explicit -C
+tpm2_nvincrement -Q   0x1500015 -C 0x1500015 -P "index"
+tpm2_nvread -Q   0x1500015 -C 0x1500015 -P "index"
+
+# use owner password
+tpm2_nvincrement -Q   0x1500015 -C 0x40000001 -P "owner"
+tpm2_nvread -Q   0x1500015 -C 0x40000001 -P "owner"
+
+# Check a bad password fails
+trap - ERR
+tpm2_nvincrement -Q   0x1500015 -C 0x1500015 -P "wrong" 2>/dev/null
+if [ $? -eq 0 ];then
+ echo "nvincrement with bad password should fail!"
+ exit 1
+fi
+
+# Check using authorisation with tpm2_nvundefine
+trap onerror ERR
+
+tpm2_nvundefine   0x1500015 -C 0x40000001 -P "owner"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/output_formats.sh b/data/tpm2-tools-4.1.1/integration/tests/output_formats.sh
new file mode 100755
index 0000000..4214498
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/output_formats.sh
@@ -0,0 +1,118 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+# Purpose of this test is to cover the additional code paths that come into
+# play when non-default output formats for public keys or signatures are used
+# in the various tools.
+#
+# The test covers all available output formats, makes sure the tools
+# successfully run in these cases and checks the output files by feeding them
+# to OpenSSL as appropriate.
+
+alg_ek=rsa
+file_pubek_base=ek_${alg_ek}
+file_pubek_orig=${file_pubek_base}.tss.orig
+handle_ek=0x81010014
+
+alg_ak=rsa
+file_pubak_name="ak.${alg_ak}.name"
+file_pubak_tss="ak.${alg_ak}.tss"
+file_pubak_pem="ak.${alg_ak}.pem"
+handle_ak=0x81010016
+handle_ak_file=ak.handle
+ak_ctx=ak.ctx
+
+file_hash_input="hash.in"
+file_hash_ticket=hash.ticket
+file_hash_result=hash.result
+file_sig_base=hash.sig
+alg_hash=sha256
+
+file_quote_msg=quote.msg
+file_quote_sig_base=quote.sig
+
+cleanup() {
+    rm -f "$file_pubek_base".*
+    rm -f "$file_pubak_tss" "$file_pubak_name" "$file_pubak_pem"
+    rm -f "$file_hash_ticket" "$file_hash_result" "$file_sig_base".*
+    rm -f "$file_quote_msg" "$file_quote_sig_base".* $file_hash_input
+    rm -f primary.ctx ecc.ctx ecc.pub ecc.priv ecc.fmt.pub $ak_ctx
+
+    # Evict persistent handles, we want them to always succeed and never trip
+    # the onerror trap.
+    for handle in $handle_ek $handle_ak; do
+        tpm2_evictcontrol -Q -C o -c $handle 2>/dev/null || true
+    done
+
+    shut_down
+}
+trap cleanup EXIT
+
+start_up
+
+head -c 4096 /dev/urandom > $file_hash_input
+
+tpm2_createek -Q -G $alg_ek -u "$file_pubek_orig" -c $handle_ek
+
+for fmt in tss pem der; do
+
+    this_key="${file_pubek_base}.${fmt}"
+
+    tpm2_readpublic -Q -c $handle_ek -f "$fmt" -o "$this_key"
+
+    if [ "$fmt" = tss ]; then
+        diff "$file_pubek_orig" "$this_key" > /dev/null
+    else
+        openssl rsa -pubin -inform "$fmt" -text -in "$this_key" &> /dev/null
+    fi
+
+done
+
+tpm2_createak -Q -G $alg_ak -C $handle_ek -c $ak_ctx -u "$file_pubak_tss" \
+-n "$file_pubak_name"
+echo "tpm2_evictcontrol -Q -c $ak_ctx -o $handle_ak_file" $handle_ak
+tpm2_evictcontrol -Q -c $ak_ctx -o $handle_ak_file $handle_ak
+
+tpm2_readpublic -Q -c $handle_ak_file -f "pem" -o "$file_pubak_pem"
+
+tpm2_hash -Q -C e -g $alg_hash -t "$file_hash_ticket" -o "$file_hash_result" \
+"$file_hash_input"
+
+for fmt in tss plain; do
+    this_sig="${file_sig_base}.${fmt}"
+    tpm2_sign -Q -c $handle_ak -g $alg_hash -f $fmt -o "${this_sig}" \
+    -t "${file_hash_ticket}" "${file_hash_input}"
+
+    if [ "$fmt" = plain ]; then
+        openssl dgst -verify "$file_pubak_pem" -keyform pem -${alg_hash} \
+        -signature "$this_sig" "$file_hash_input" > /dev/null
+    fi
+done
+
+for fmt in tss plain; do
+    this_sig="${file_quote_sig_base}.${fmt}"
+    tpm2_quote -Q -c $handle_ak -l "$alg_hash":0 -f $fmt -m "$file_quote_msg" \
+    -s "$this_sig"
+
+    if [ "$fmt" = plain ]; then
+        openssl dgst -verify "$file_pubak_pem" -keyform pem -${alg_hash} \
+        -signature "$this_sig" "$file_quote_msg" > /dev/null
+    fi
+done
+
+#
+# Test ECC keys
+#
+tpm2_createprimary -c primary.ctx
+tpm2_create -Q -C primary.ctx -G ecc -u ecc.pub -r ecc.priv
+tpm2_load -C primary.ctx -u ecc.pub -r ecc.priv -c ecc.ctx
+
+for fmt in pem der; do
+
+    tpm2_readpublic -Q -c ecc.ctx -f "$fmt" -o ecc.fmt.pub
+
+    openssl ec -pubin -inform "$fmt" -text -in ecc.fmt.pub &> /dev/null
+done
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/pcrallocate.sh b/data/tpm2-tools-4.1.1/integration/tests/pcrallocate.sh
new file mode 100755
index 0000000..cbdf6e1
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/pcrallocate.sh
@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f pcrs.out
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# Store the old banks because e.g. some TPM-simuators don't support SHA512
+OLDBANKS=$(tpm2_getcap pcrs | grep bank | sed 's/.*bank\: \(.*\)/+\1:all/' | \
+tr -d "\n")
+
+echo "OLDBANKS: $OLDBANKS"
+
+tpm2_pcrallocate -P "" sha1:7,8,9,10,16,17,18,19+sha256:all \
+    | tee out.yml
+yaml_verify out.yml
+
+tpm2_pcrallocate sha1:all+sha256:all | tee out.yml
+yaml_verify out.yml
+
+tpm2_pcrallocate ${OLDBANKS:1}
+
+#Note: We cannot check if the allocations were performed by the TPM, since they
+#      will only take effect once the TPM reboots.
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/pcrevent.sh b/data/tpm2-tools-4.1.1/integration/tests/pcrevent.sh
new file mode 100755
index 0000000..4bc4b18
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/pcrevent.sh
@@ -0,0 +1,74 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+#this script is for hash case testing
+
+source helpers.sh
+
+hash_out_file=hash.out
+hash_in_file=hash.in
+yaml_out_file=pcr_list.yaml
+
+cleanup() {
+  rm -f $hash_in_file $hash_out_file $yaml_out_file
+
+  shut_down
+}
+trap cleanup EXIT
+
+start_up
+
+echo "T0naX0u123abc" > $hash_in_file
+
+# Run FILE and stdin as FILE
+tpm2_pcrevent -Q $hash_in_file
+tpm2_pcrevent -Q < $hash_in_file
+
+# Test that fifo stdin works
+cat $hash_in_file | tpm2_pcrevent > $hash_out_file
+
+yaml_verify $hash_out_file
+
+# Verify output as expected.
+while IFS='' read -r l || [[ -n "$l" ]]; do
+
+  alg=`echo -n $l | cut -d\: -f 1-1`
+  if ! which "$alg"sum >/dev/null 2>&1; then
+      echo "Ignore checking $alg algorithm due to unavailable \"${alg}sum\" program"
+      continue
+  fi
+
+  hash=`echo -n $l | awk {'print $2'}`
+  check=`"$alg"sum $hash_in_file | cut -d' ' -f 1-1`
+  if [ "$check" != "$hash" ]; then
+    echo "Hash check failed for alg \"$alg\", got \"$hash\", expected \"$check\""
+    exit 1
+  fi
+done < $hash_out_file
+
+tpm2_pcrread sha1:9 > $yaml_out_file
+old_pcr_value=`yaml_get_kv $yaml_out_file "sha1" "9"`
+
+# Verify that extend works, and test large files
+dd if=/dev/urandom of=$hash_in_file count=1 bs=2093 2> /dev/null
+tpm2_pcrevent -Q 9 $hash_in_file
+
+tpm2_pcrread sha1:9 > $yaml_out_file
+new_pcr_value=`yaml_get_kv $yaml_out_file "sha1" "9"`
+
+if [ "$new_pcr_value" == "$old_pcr_value" ]; then
+  echo "Expected PCR value to change after pcrevent with index 9."
+  echo "Got the same hash as before: "$new_pcr_value"".
+  exit 1;
+fi
+
+# verify that specifying -P without -i fails
+trap - ERR
+
+cmd="tpm2_pcrevent -Q -P foo $hash_in_file 2> /dev/null"
+eval "$cmd"
+if [ $? -eq 0 ]; then
+  echo "Expected $cmd to fail, passed."
+  exit 1;
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/pcrextend.sh b/data/tpm2-tools-4.1.1/integration/tests/pcrextend.sh
new file mode 100755
index 0000000..04bc3b8
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/pcrextend.sh
@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+start_up
+
+declare -A alg_hashes=(
+  ["sha1"]="f1d2d2f924e986ac86fdf7b36c94bcdf32beec15"
+  ["sha256"]="6ea40aa7267bb71251c1de1c3605a3df759b86b22fa9f62aa298d4197cd88a38"
+  ["sha384"]="ecf669bad80a9b2b267d8671bd7d012d92e8cd30fd28d88dcdbcc2ddffbb995c7f226011ac24ae92dcfb493e0a5ecf89"
+  ["sha512"]="18b7381f36cdf5dd7c0b64835e0bf5041a52a38e3c3f4cbabcc4099d52590bf9916808138de511fb172cb64fcc11601f07d114f03e95e3d5ceacb330ce0f856a"
+  ["sm3_256"]="2b14a1fc49869413b0beb707069cffc0c6b0a51f3fedb9ce072c80709652b3ae"
+)
+
+digests=""
+# test a single algorithm based on what is supported
+for alg in `tpm2_getcap pcrs | grep sha |awk {'print $2'} | awk -F: {'print $1'}`; do
+
+  hash=${alg_hashes[$alg]}
+
+  if [ ! -z $digests ]; then
+      digests="$digests,"
+  fi
+
+  digests="$digests$alg=$hash"
+
+  tpm2_pcrextend 9:$alg=$hash
+
+done;
+
+#
+# To keep things simple, compound specifications are just done with
+# the supported sha1 algorithms to guarantee the command to succeed.
+#
+tpm2_pcrextend 8:$digests
+
+# Extend a PCR for all supported banks like in the previous test but
+# try extending two PCR in the same command.
+tpm2_pcrextend 8:$digests 9:$digests
+
+# Over-length hash should fail
+if tpm2_pcrextend 8:$digests,sha1=${alg_hashes["sha256"]}; then
+    echo "tpm2_pcrextend with over-length hash didn't fail!"
+    exit 1
+else
+    true
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/pcrlist.sh b/data/tpm2-tools-4.1.1/integration/tests/pcrlist.sh
new file mode 100755
index 0000000..fccf6db
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/pcrlist.sh
@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    rm -f pcrs.out
+
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_pcrread > pcrs.out
+yaml_verify pcrs.out
+
+tpm2_pcrread -Q 0x04
+
+tpm2_pcrread -Q -o pcrs.out 0x04:17,18,19+sha256:0,17,18,19
+
+test -e pcrs.out
+
+tpm2_pcrread -Q
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/pcrreset.sh b/data/tpm2-tools-4.1.1/integration/tests/pcrreset.sh
new file mode 100755
index 0000000..471b3f1
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/pcrreset.sh
@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# Reset a resettable PCR
+tpm2_pcrreset 23
+
+# Reset more than one resettable PCR
+tpm2_pcrreset 16 23
+
+trap - ERR
+
+# Get PCR_Reset bad locality error
+tpm2_pcrreset 0
+if [ $? -eq 0 ]; then
+  echo "Expected PCR reset of 0 to induce bad locality error"
+  exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/print.sh b/data/tpm2-tools-4.1.1/integration/tests/print.sh
new file mode 100755
index 0000000..ebbfb28
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/print.sh
@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+ak_ctx=ak.ctx
+ek_handle=0x81010017
+
+ak_name_file=ak.name
+ak_pubkey_file=ak.pub
+
+quote_file=quote.bin
+print_file=quote.yaml
+
+cleanup() {
+    rm -f $ak_name_file $ak_pubkey_file \
+          $quote_file $print_file $ak_ctx
+
+    if [ "$1" != "no-shut-down" ]; then
+       shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+# Create signing key
+tpm2_createek -Q -G rsa -c $ek_handle
+tpm2_createak -Q -G rsa -g sha256 -s rsassa -C $ek_handle -c $ak_ctx\
+  -u $ak_pubkey_file -n $ak_name_file
+
+# Take PCR quote
+tpm2_quote -Q -c $ak_ctx -l "sha256:0,2,4,9,10,11,12,17" -q "0f8beb45ac" \
+-m $quote_file
+
+# Print TPM's quote file
+tpm2_print -t TPMS_ATTEST $quote_file > $print_file
+
+# Check printed yaml
+python3 << pyscript
+from __future__ import print_function
+
+import sys
+import re
+import yaml
+
+with open("$print_file") as fd:
+    yaml = yaml.safe_load(fd)
+
+    assert(yaml["magic"] == "ff544347")
+    assert(yaml["type"] == 8018)
+    assert(yaml["extraData"] == "0f8beb45ac")
+
+    quote = yaml["attested"]["quote"]
+
+    # there should be only one pcr selection
+    assert(quote["pcrSelect"]["count"] == 1)
+
+    pcr_select = quote["pcrSelect"]["pcrSelections"][0]
+
+    # pcr selection should match above options
+    assert(pcr_select["hash"] == "11 (sha256)")
+    assert(pcr_select["sizeofSelect"] == 3)
+    assert(pcr_select["pcrSelect"] == "151e02")
+
+    # pcrDigest should be lowercase hex encoded sha256sum per above options
+    assert(re.match('^[0-9a-f]{64}$', quote["pcrDigest"]))
+
+    print("OK")
+pyscript
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/quote.sh b/data/tpm2-tools-4.1.1/integration/tests/quote.sh
new file mode 100755
index 0000000..492600b
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/quote.sh
@@ -0,0 +1,96 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+alg_primary_obj=sha256
+alg_primary_key=rsa
+alg_create_obj=0x000B
+alg_create_key=hmac
+
+alg_quote=0x0004
+alg_quote1=0x000b
+
+file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key"
+file_quote_key_pub=opu_"$alg_create_obj"_"$alg_create_key"
+file_quote_key_priv=opr_"$alg_create_obj"_"$alg_create_key"
+file_quote_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-\
+"$alg_create_obj"_"$alg_create_key"
+file_quote_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-\
+"$alg_create_obj"_"$alg_create_key"
+
+Handle_ak_quote=0x81010016
+Handle_ek_quote=0x81010017
+Handle_ak_quote2=0x81010018
+ak2_ctx=ak2.ctx
+
+out=out.yaml
+toss_out=junk.out
+
+cleanup() {
+    rm -f $file_primary_key_ctx $file_quote_key_pub $file_quote_key_priv \
+    $file_quote_key_name $file_quote_key_ ak.pub2 ak.name_2 \
+    $out $toss_out $ak2_ctx
+
+    tpm2_evictcontrol -Q -Co -c $Handle_ek_quote 2>/dev/null || true
+    tpm2_evictcontrol -Q -Co -c $Handle_ak_quote 2>/dev/null || true
+    tpm2_evictcontrol -Q -Co -c $Handle_ak_quote2 2>/dev/null || true
+
+    if [ "$1" != "no-shut-down" ]; then
+       shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+tpm2_getcap properties-fixed | tr -dc '[[:print:]]\r\n' > $out
+maxdigest=$(yaml_get_kv $out "TPM2_PT_MAX_DIGEST" "raw")
+if ! [[ "$maxdigest" =~ ^(0x)*[0-9]+$ ]] ; then
+ echo "error: not a number, got: \"$maxdigest\"" >&2
+ exit 1
+fi
+
+nonce=12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde
+nonce=${nonce:0:2*$maxdigest}
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+tpm2_createprimary -Q -C e -g $alg_primary_obj -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -g $alg_create_obj -G $alg_create_key -u $file_quote_key_pub \
+-r $file_quote_key_priv -C $file_primary_key_ctx
+
+tpm2_load -Q -C $file_primary_key_ctx -u $file_quote_key_pub \
+-r $file_quote_key_priv -n $file_quote_key_name -c $file_quote_key_ctx
+
+tpm2_quote -c $file_quote_key_ctx -l $alg_quote:16,17,18 -q $nonce \
+-m $toss_out -s $toss_out -o $toss_out -g $alg_primary_obj > $out
+
+yaml_verify $out
+
+tpm2_quote -Q -c $file_quote_key_ctx \
+-l $alg_quote:16,17,18+$alg_quote1:16,17,18 -q $nonce -m $toss_out \
+-s $toss_out -o $toss_out -g $alg_primary_obj
+
+#####handle testing
+tpm2_evictcontrol -Q -C o -c $file_quote_key_ctx $Handle_ak_quote
+
+tpm2_quote -Q -c $Handle_ak_quote -l $alg_quote:16,17,18 -q $nonce \
+-m $toss_out -s $toss_out -o $toss_out -g $alg_primary_obj
+
+tpm2_quote -Q -c $Handle_ak_quote -l $alg_quote:16,17,18+$alg_quote1:16,17,18 \
+-q $nonce -m $toss_out -s $toss_out -o $toss_out -g $alg_primary_obj
+
+#####AK
+tpm2_createek -Q -c $Handle_ek_quote -G 0x01
+
+tpm2_createak -Q -C $Handle_ek_quote -c $ak2_ctx -u ak.pub2 -n ak.name_2
+tpm2_evictcontrol -Q -C o -c $ak2_ctx $Handle_ak_quote2
+
+tpm2_quote -Q -c $Handle_ak_quote -l $alg_quote:16,17,18 -q $nonce \
+-m $toss_out -s $toss_out -o $toss_out -g $alg_primary_obj
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/rc_decode.sh b/data/tpm2-tools-4.1.1/integration/tests/rc_decode.sh
new file mode 100755
index 0000000..9ced1e2
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/rc_decode.sh
@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+# We don't need a TPM for this test, so unset the EXIT handler.
+trap - EXIT
+
+# Since this only tests rc_decode tool it on FreeBSD
+if [ "$OS" == "FreeBSD" ]; then
+    exit 0
+fi
+
+#
+# codes was generated from the TPM2_RC constants in:
+# https://github.com/tpm2-software/tpm2-tss/blob/master/include/sapi/tss2_tpm2_types.h#L68
+# Some of these may not be used correctly, which is OK, as tpm2_rc_decode never
+# fails and should attempt to decode it or print some unknown status. This gives
+# us coverage for both known and unknown/malformed inputs.
+#
+# Details on error code encoding can be found at:
+# Section 6.6.2 of t "Trusted Platform Module Library Part 2: Structures Family “2.0” Level 00 Revision 01.38"
+#  - https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
+#
+declare -A codes
+
+tss2_tpm2_types=''
+for dir in "$(pkg-config --variable includedir tss2-esys)" \
+/usr/local/include /usr/include; do
+    if [ -f "$dir/tss2/tss2_tpm2_types.h" ]; then
+        tss2_tpm2_types="$dir/tss2/tss2_tpm2_types.h"
+        break
+    fi
+done
+
+if [ -z "$tss2_tpm2_types" ]; then
+    echo "Could not find TSS2 headers"
+    exit 1
+fi
+
+# Populate the main TPM2_RC values
+eval $(grep -Po "^#define \K(TPM2_RC.*)" "$tss2_tpm2_types" \
+          | grep -v '+' \
+          | sed "s%/*[^/]*/$%%g" \
+          | sed "s%[[:space:]]*((TPM2_RC)[[:space:]]*%=%g" \
+          | sed "s%)%%g")
+
+# Generate the TPM2_RC array based on TSS2 header
+varlist="$(sed -rn "s%^#define (TPM2_RC_[^[:space:]]*)[[:space:]]*\(\(TPM2_RC\) \((TPM2_RC[^\)]*)[^/]*/\* ([^\*]*) \*/%\1=\$\(\(\2\)\):\3%p" "$tss2_tpm2_types")"
+while IFS='=' read key value; do
+    codes[${key}]="${value}"
+done <<< "${varlist}"
+
+fail=0
+
+for key in "${!codes[@]}"; do
+    value="$(printf '0x%03x' "$(eval echo ${codes[$key]%%:*})")"
+    expected_msg="${codes[$key]##*:}"
+    received_msg="$(tpm2_rc_decode ${value} | cut -d':' -f3)"
+
+    if ! grep -iq "${received_msg# }" <<< "${expected_msg}"; then
+        echo "$value raised an invalid error message"
+        echo "      - Expected : ${expected_msg}"
+        echo "      - Seen     : ${received_msg# }"
+        fail=1
+    fi
+done
+
+#
+# Negative tests
+#
+if tpm2_rc_decode 0x6666329840938498293849238 &>/dev/null; then
+    echo "Expected \"$cmd\" to fail."
+    fail=1
+else
+    true
+fi
+
+exit "$fail"
diff --git a/data/tpm2-tools-4.1.1/integration/tests/readclock.sh b/data/tpm2-tools-4.1.1/integration/tests/readclock.sh
new file mode 100755
index 0000000..decbcc7
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/readclock.sh
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+	rm -f clock.yaml
+}
+trap cleanup EXIT
+
+start_up
+
+tpm2_readclock > clock.yaml
+
+# validate we can get each portion of the YAML file
+yaml_get_kv clock.yaml time
+yaml_get_kv clock.yaml clock_info clock
+yaml_get_kv clock.yaml clock_info reset_count
+yaml_get_kv clock.yaml clock_info restart_count
+yaml_get_kv clock.yaml clock_info safe
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/readpublic.sh b/data/tpm2-tools-4.1.1/integration/tests/readpublic.sh
new file mode 100755
index 0000000..e39e562
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/readpublic.sh
@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+alg_primary_obj=sha256
+alg_primary_key=rsa
+alg_create_obj=sha256
+alg_create_key=hmac
+
+file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key"
+file_readpub_key_pub=opu_"$alg_create_obj"_"$alg_create_key"
+file_readpub_key_priv=opr_"$alg_create_obj"_"$alg_create_key"
+file_readpub_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-\
+"$alg_create_obj"_"$alg_create_key"
+file_readpub_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-\
+"$alg_create_obj"_"$alg_create_key"
+file_readpub_output=readpub_"$file_readpub_key_ctx"
+
+Handle_readpub=0x81010014
+
+cleanup() {
+    rm -f $file_primary_key_ctx $file_readpub_key_pub $file_readpub_key_priv \
+    $file_readpub_key_name $file_readpub_key_ctx $file_readpub_output
+
+    tpm2_evictcontrol -Q -C o -c $Handle_readpub 2>/dev/null || true
+
+    if [ "$1" != "no-shut-down" ]; then
+       shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+tpm2_clear
+
+tpm2_createprimary -Q -C e -g $alg_primary_obj -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -g $alg_create_obj -G $alg_create_key -u $file_readpub_key_pub \
+-r $file_readpub_key_priv -C $file_primary_key_ctx
+
+tpm2_load -Q -C $file_primary_key_ctx -u $file_readpub_key_pub \
+-r $file_readpub_key_priv -n $file_readpub_key_name -c $file_readpub_key_ctx
+
+tpm2_readpublic -Q -c $file_readpub_key_ctx -o $file_readpub_output
+
+tpm2_evictcontrol -Q -C o -c $file_readpub_key_ctx $Handle_readpub
+
+rm -f $file_readpub_output
+tpm2_readpublic -Q -c $Handle_readpub -o $file_readpub_output
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/rsadecrypt.sh b/data/tpm2-tools-4.1.1/integration/tests/rsadecrypt.sh
new file mode 100755
index 0000000..e86a795
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/rsadecrypt.sh
@@ -0,0 +1,102 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+file_primary_key_ctx=context.p_B1
+file_rsaencrypt_key_pub=opuB1_B8
+file_rsaencrypt_key_priv=oprB1_B8
+file_rsaencrypt_key_ctx=context_loadext_out_B1_B8
+file_rsadecrypt_key_ctx=context_load_out_B1_B8
+file_rsaencrypt_key_name=name.load.B1_B8
+
+file_rsa_en_output_data=rsa_en.out
+file_rsa_de_output_data=rsa_de.out
+file_input_data=secret.data
+
+alg_hash=sha256
+alg_primary_key=rsa
+alg_rsaencrypt_key=rsa
+
+cleanup() {
+    rm -f $file_input_data $file_primary_key_ctx $file_rsaencrypt_key_pub \
+    $file_rsaencrypt_key_priv $file_rsaencrypt_key_ctx \
+    $file_rsaencrypt_key_name $file_output_data $file_rsa_en_output_data \
+    $file_rsa_de_output_data $file_rsadecrypt_key_ctx label.dat
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+echo "12345678" > $file_input_data
+
+tpm2_clear
+
+tpm2_createprimary -Q -C e -g $alg_hash -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -g $alg_hash -p foo -G $alg_rsaencrypt_key \
+-u $file_rsaencrypt_key_pub -r $file_rsaencrypt_key_priv \
+-C $file_primary_key_ctx
+
+tpm2_loadexternal -Q -C n -u $file_rsaencrypt_key_pub \
+-c $file_rsaencrypt_key_ctx
+
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -o $file_rsa_en_output_data < \
+$file_input_data
+
+tpm2_load -Q -C $file_primary_key_ctx -u $file_rsaencrypt_key_pub \
+-r $file_rsaencrypt_key_priv -n $file_rsaencrypt_key_name \
+-c $file_rsadecrypt_key_ctx
+
+tpm2_rsadecrypt -Q -c $file_rsadecrypt_key_ctx -p foo -o \
+$file_rsa_de_output_data $file_rsa_en_output_data
+
+# Test the diffeent padding schemes ...
+
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -o $file_rsa_en_output_data \
+-s rsaes < $file_input_data
+tpm2_rsadecrypt -Q -c $file_rsadecrypt_key_ctx -p foo -o \
+$file_rsa_de_output_data -s rsaes $file_rsa_en_output_data
+
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -o $file_rsa_en_output_data \
+-s null < $file_input_data
+tpm2_rsadecrypt -Q -c $file_rsadecrypt_key_ctx -p foo -o \
+$file_rsa_de_output_data -s null $file_rsa_en_output_data
+
+# Test the label option with a string
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -l mylabel \
+-o $file_rsa_en_output_data < $file_input_data
+tpm2_rsadecrypt -Q -c $file_rsadecrypt_key_ctx -l mylabel -p foo \
+-o $file_rsa_de_output_data $file_rsa_en_output_data
+
+# Test the label option with a file
+echo "my file label" > label.dat
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -l label.dat \
+-o $file_rsa_en_output_data < $file_input_data
+tpm2_rsadecrypt -Q -c $file_rsadecrypt_key_ctx -l label.dat -p foo \
+-o $file_rsa_de_output_data $file_rsa_en_output_data
+
+trap - ERR
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -o $file_rsa_en_output_data \
+-s oaep < $file_input_data
+if [ $? -eq 0 ]; then
+    echo "tpm2_rsaencrypt should fail with 'hash algorithm not supported or not\
+    appropriate'"
+    exit 1
+fi
+
+tpm2_rsadecrypt -Q -c $file_rsadecrypt_key_ctx -p foo -o \
+$file_rsa_de_output_data -s oaep $file_rsa_en_output_data
+if [ $? -eq 0 ]; then
+    echo "tpm2_rsadecrypt should fail with 'hash algorithm not supported or not
+    appropriate'"
+    exit 1
+fi
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/rsaencrypt.sh b/data/tpm2-tools-4.1.1/integration/tests/rsaencrypt.sh
new file mode 100755
index 0000000..8836cfd
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/rsaencrypt.sh
@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+file_primary_key_ctx=context.p_B1
+file_rsaencrypt_key_pub=opuB1_B8
+file_rsaencrypt_key_priv=oprB1_B8
+file_rsaencrypt_key_ctx=context_load_out_B1_B8
+file_rsaencrypt_key_name=name.load.B1_B8
+
+file_rsa_en_output_data=rsa_en.out
+file_input_data=secret.data
+
+alg_hash=sha256
+alg_primary_key=rsa
+alg_rsaencrypt_key=rsa
+
+cleanup() {
+    rm -f $file_input_data $file_primary_key_ctx $file_rsaencrypt_key_pub \
+          $file_rsaencrypt_key_priv $file_rsaencrypt_key_ctx \
+          $file_rsaencrypt_key_name $file_rsa_en_output_data
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+echo "12345678" > $file_input_data
+
+tpm2_clear
+
+tpm2_createprimary -Q -C e -g $alg_hash -G $alg_primary_key \
+-c $file_primary_key_ctx
+
+tpm2_create -Q -g $alg_hash -G $alg_rsaencrypt_key -u $file_rsaencrypt_key_pub \
+-r $file_rsaencrypt_key_priv -C $file_primary_key_ctx
+
+tpm2_loadexternal -Q -C n   -u $file_rsaencrypt_key_pub \
+-c $file_rsaencrypt_key_ctx
+
+#./tpm2_rsaencrypt -c context_loadexternal_out6.out -I secret.data -o rsa_en.out
+tpm2_rsaencrypt -Q -c $file_rsaencrypt_key_ctx -o $file_rsa_en_output_data \
+$file_input_data
+
+# Test stdout output and test that stdin pipe works as well.
+cat $file_input_data | tpm2_rsaencrypt -c $file_rsaencrypt_key_ctx > /dev/null
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/selftest.sh b/data/tpm2-tools-4.1.1/integration/tests/selftest.sh
new file mode 100755
index 0000000..772f3e3
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/selftest.sh
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+    if [ "$1" != "no-shut-down" ]; then
+          shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shut-down"
+
+# Perform simple selftest
+tpm2_selftest
+
+# Perform full selftest
+tpm2_selftest --fulltest
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/send.sh b/data/tpm2-tools-4.1.1/integration/tests/send.sh
new file mode 100755
index 0000000..6598155
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/send.sh
@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+# assume this script is run from the test/ directory
+TPM2_COMMAND_FILE="$TPM2_TOOLS_TEST_FIXTURES/get-capability-tpm-prop-fixed.bin"
+
+start_up
+
+if [ ! -f "${TPM2_COMMAND_FILE}" ]; then
+    echo "No TPM2 command file, cannot run $0"
+    exit 1
+fi
+
+# check default stdin(file fd)/stdout
+tpm2_send < "${TPM2_COMMAND_FILE}" > /dev/null
+
+# check default stdin(pipe fd) with output file
+cat ${TPM2_COMMAND_FILE} | tpm2_send -o /dev/null
+
+# check -o out and argument file input
+tpm2_send -o /dev/null "${TPM2_COMMAND_FILE}"
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/setclock.sh b/data/tpm2-tools-4.1.1/integration/tests/setclock.sh
new file mode 100755
index 0000000..748e282
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/setclock.sh
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+get_new_clock() {
+    tpm2_readclock > clock.yaml
+    local clock=$(yaml_get_kv clock.yaml clock_info clock)
+
+    # the magic number is enough time where where setting the clock to a point
+    # in the future from where we read it.
+    clock=$(($clock + 100000))
+    echo -n $clock
+}
+
+cleanup() {
+	tpm2_changeauth -c o -p newowner 2>/dev/null || true
+	# XXX tpm2_changeauth -c p -p newplatform 2>/dev/null || true
+
+	rm -f clock.yaml
+
+	if [ "$1" != "no-shut-down" ]; then
+		shut_down
+	fi
+}
+trap cleanup EXIT
+
+start_up
+
+tpm2_setclock $(get_new_clock)
+
+# validate hierarchies and passwords
+tpm2_changeauth -c o newowner
+# XXX tpm2_changeauth -c p newplatform
+
+tpm2_setclock -c o -p newowner $(get_new_clock)
+# XXX tpm2_setclock -c p -p newplatform $(get_new_clock)
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/setprimarypolicy.sh b/data/tpm2-tools-4.1.1/integration/tests/setprimarypolicy.sh
new file mode 100755
index 0000000..72b5a0b
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/setprimarypolicy.sh
@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+cleanup() {
+
+    tpm2_flushcontext session.ctx 2>/dev/null || true
+
+    rm -f session.ctx policy.pcr primary.ctx
+
+    if [ "${1}" != "no-shutdown" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+start_up
+
+cleanup "no-shutdown"
+
+tpm2_clear
+
+tpm2_changeauth -c e endorsementpassword
+
+tpm2_startauthsession -S session.ctx
+tpm2_policypcr -l sha256:0 -L policy.pcr -S session.ctx
+tpm2_flushcontext session.ctx
+
+tpm2_setprimarypolicy -C e -L policy.pcr -g sha256 -P endorsementpassword
+
+#
+# Try changing the endorsement hierarchy password with the policy
+#
+tpm2_startauthsession -S session.ctx --policy-session
+tpm2_policypcr -l sha256:0 -S session.ctx
+tpm2_changeauth -c e -p session:session.ctx newendorsementpassword
+tpm2_flushcontext session.ctx
+
+#
+# Use the new password to create a primary key
+#
+tpm2_createprimary -C e -c primary.ctx -P newendorsementpassword
+
+exit 0
diff --git a/data/tpm2-tools-4.1.1/integration/tests/sign.sh b/data/tpm2-tools-4.1.1/integration/tests/sign.sh
new file mode 100755
index 0000000..9f3141d
--- /dev/null
+++ b/data/tpm2-tools-4.1.1/integration/tests/sign.sh
@@ -0,0 +1,294 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+source helpers.sh
+
+file_primary_key_ctx=context.p_B1
+file_signing_key_pub=opuB1_B8
+file_signing_key_priv=oprB1_B8
+file_signing_key_ctx=context_load_out_B1_B8
+file_signing_key_name=name.load.B1_B8
+file_signing_key_pub_pem=oppB1_B8
+file_input_data=secret.data
+file_input_digest=secret.digest
+file_output_data=sig.4
+file_output_ticket=secret.ticket
+file_output_hash=secret.hash
+rsa_key_type=rsa2048
+ecc_key_type=ecc256
+
+handle_signing_key=0x81010005
+
+alg_hash=sha256
+alg_primary_key=rsa
+
+cleanup() {
+    rm -f $file_input_data $file_primary_key_ctx $file_signing_key_pub \
+          $file_signing_key_priv $file_signing_key_ctx $file_signing_key_name \
+          $file_output_data $file_input_digest $file_output_ticket \
+          $file_output_hash $file_signing_key_pub_pem
+
+    tpm2_evictcontrol -Q -Co -c $handle_signing_key 2>/dev/null || true
+
+    if [ "$1" != "no-shut-down" ]; then
+        shut_down
+    fi
+}
+trap cleanup EXIT
+
+test_symmetric() {
+    local alg_signing_key=$1
+
+    echo "12345678" > $file_input_data
+
+    tpm2_clear
+
+    tpm2_createprimary -Q -C e -g $alg_hash -G $alg_primary_key \
+    -c $file_primary_key_ctx
+
+    tpm2_create -Q -g $alg_hash -G $alg_signing_key -u $file_signing_key_pub \
+    -r $file_signing_key_priv -C $file_primary_key_ctx
+
+    tpm2_load -Q -C $file_primary_key_ctx -u $file_signing_key_pub \
+    -r $file_signing_key_priv -n $file_signing_key_name -c $file_signing_key_ctx
+
+    tpm2_sign -Q -c $file_signing_key_ctx -g $alg_hash \
+    -o $file_output_data $file_input_data
+
+    rm -f $file_output_data
+
+    tpm2_evictcontrol -Q -C o -c $file_signing_key_ctx $handle_signing_key
+
+    tpm2_sign -Q -c $handle_signing_key -g $alg_hash -o $file_output_data \
+    $file_input_data
+
+    rm -f $file_output_data
+
+    # generate hash and test validation
+
+    tpm2_hash -Q -C e -g $alg_hash -o $file_output_hash -t $file_output_ticket \
+    $file_input_data
+
+    tpm2_sign -Q -c $handle_signing_key -g $alg_hash -o $file_output_data \
+    -t $file_output_ticket $file_input_data
+
+    rm -f $file_output_data
+
+    # test with digest, no validation
+
+    shasum -a 256 $file_input_data | awk '{ print "000000 " $1 }' | xxd -r -c 32 > \
+    $file_input_digest
+
+    tpm2_sign -Q -c $handle_signing_key -g $alg_hash -d -o $file_output_data \
+    $file_input_digest
+
+    rm -f $file_output_data
+}
+
+create_signature() {
+    local sign_scheme=$1
+    if [ "$sign_scheme" = "" ]; then
+        tpm2_sign -Q -c $file_signing_key_ctx -g $alg_hash -f plain \
+        -o $file_output_data $file_input_data
+    else
+        tpm2_sign -Q -c $file_signing_key_ctx -g $alg_hash -s $sign_scheme \
+        -f plain -o $file_output_data $file_input_data
+    fi
+}
+
+get_openssl_version_number() {
+    # Ubuntu 14.04, 16.04, 18.04 and 19.04:
+    # "OpenSSL 1.0.1f 6 Jan 2014"
+    # "OpenSSL 1.0.2g  1 Mar 2016"
+    # "OpenSSL 1.1.0g  2 Nov 2017"
+    # "OpenSSL 1.1.1b  26 Feb 2019"
+    if [ -z "$1" ]; then
+        local openssl_version=$(openssl version -v)
+    else
+        local openssl_version="$1"
+    fi
+    local openssl_version_parsed=$(echo "$openssl_version" | sed -r 's/^OpenSSL ([0-9]+)\.([0-9]+)\.([0-9]+).*$/\1 \2 \3/')
+    local openssl_v1=$(echo $openssl_version_parsed | cut -d ' ' -f 1)
+    local openssl_v2=$(echo $openssl_version_parsed | cut -d ' ' -f 2)
+    local openssl_v3=$(echo $openssl_version_parsed | cut -d ' ' -f 3)
+    local openssl_version_num=$(("$openssl_v1"<<16 + "$openssl_v2"<<8 + "$openssl_v3"))
+    echo "$openssl_version_num"
+}
+
+verify_signature() {
+    local sign_scheme=$1
+
+    if [ "$sign_scheme" = "rsapss" ] ; then
+        # Explanation:
+
+        # RSA-PSS has a parameter called salt length.
+        # You need to know what value of salt length was used to create the
+        # signature in order to verify the signature.
+        # OpenSSL can actually automatically determine the correct value, so
+        # strictly speaking we could just let it and simplify this test a lot.
+        # But, if you want to verify the signature using some other API,
+        # you might need to know the salt length used by the TPM to produce the
+        # signature.
+        # It can be either "digest" or "max". You can use openssl the check
+        # whether it's "digest", and if it's not then it's "max".
+
+        # From TCG TPM 2.0, Part 1: Architecture, Appendix B.7
+        # "... the random salt length will be the largest size allowed by the
+        #  key size and message digest size."
+
+        # From NIST FIPS PUB 186-4, Section 5.5
+        # "... the length (in bytes) of the salt (sLen) shall satisfy
+        #  0 <= sLen <= hLen, where hLen is the length of the hash function
+        #  output block (in bytes)."
+
+        # From TCG FIPS 140-2 Guidance for TPM 2.0, Section 5.2.1.3
+        # "If the TPM implementation is required to be compliant with FIPS 186-4,
+        #  then the random salt length will be the largest size allowed by that
+        #  specification."
+
+        # Thus, if the TPM is in "FIPS mode", PSS salt length is "digest",
+        #  otherwise PSS salt length is "max".
+        # Either one is accepted by this test.
+        # The IBM TPM software emulator (at least the version in ibmtpm1332.tar.gz)
+        #  uses "digest".
+
+        local openssl_current_version_num=$(get_openssl_version_number)
+        local openssl_1_1_1_version_num=$(get_openssl_version_number "OpenSSL 1.1.1")
+
+        # Explanation:
+        # In version 1.1.1, openssl switched from "-1","-2" (meaning "digest" and
+        # "auto" correspondingly) to "digest", "max" and "auto".
+        # See section "rsa_pss_saltlen:len" in
+        # https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/doc/man1/pkeyutl.pod
+        # and same section in
+        # https://github.com/openssl/openssl/blob/OpenSSL_1_1_0-stable/doc/apps/pkeyutl.pod
+        if [ "$openssl_current_version_num" -ge "$openssl_1_1_1_version_num" ] ; then
+            local pss_salt_len_arg_digest="digest"
+            local pss_salt_len_arg_max="max"
+            local pss_salt_len_arg_auto="auto"
+        else
+            local pss_salt_len_arg_digest="-1"
+            local pss_salt_len_arg_auto="-2"
+        fi
+
+        openssl pkeyutl -verify \
+            -in $file_input_digest \
+            -sigfile $file_output_data \
+            -pubin \
+            -inkey $file_signing_key_pub_pem \
+            -keyform pem \
+            -pkeyopt digest:$alg_hash \
+            -pkeyopt rsa_padding_mode:pss \
+            -pkeyopt rsa_pss_saltlen:$pss_salt_len_arg_digest \
+            |& grep -q '^Signature Verified Successfully' \
+        || \
+        openssl pkeyutl -verify \
+            -in $file_input_digest \
+            -sigfile $file_output_data \
+            -pubin \
+            -inkey $file_signing_key_pub_pem \
+            -keyform pem \
+            -pkeyopt digest:$alg_hash \
+            -pkeyopt rsa_padding_mode:pss \
+            -pkeyopt rsa_pss_saltlen:$pss_salt_len_arg_auto \
+            |& grep -q '^Signature Verified Successfully'
+    else
+        openssl pkeyutl -verify \
+            -in $file_input_digest \
+            -sigfile $file_output_data \
+            -pubin \
+            -inkey $file_signing_key_pub_pem \
+            -keyform pem \
+            -pkeyopt digest:$alg_hash \
+            |& grep -q '^Signature Verified Successfully'
+    fi
+}
+
+test_asymmetric() {
+    local alg_signing_key=$1
+
+    head -c30 /dev/urandom > $file_input_data
+
+    shasum -a 256 $file_input_data | awk '{ print "000000 " $1 }' | \
+    xxd -r -c 32 > $file_input_digest
+
+    tpm2_clear
+
+    tpm2_createprimary -Q -C e -g $alg_hash -G $alg_primary_key \
+    -c $file_primary_key_ctx
+
+    tpm2_create -Q -g $alg_hash -G $alg_signing_key -u $file_signing_key_pub \
+    -r $file_signing_key_priv -C $file_primary_key_ctx
+
+    tpm2_load -Q -C $file_primary_key_ctx -u $file_signing_key_pub \
+    -r $file_signing_key_priv -n $file_signing_key_name -c $file_signing_key_ctx
+
+    tpm2_readpublic -Q -c $file_signing_key_ctx --format=pem \
+    -o $file_signing_key_pub_pem
+
+    local sign_scheme
+
+    if [ "$alg_signing_key" = "$rsa_key_type" ] ; then
+        for sign_scheme in "" "rsassa" "rsapss"
+        do
+            create_signature $sign_scheme
+            verify_signature $sign_scheme
+
+            rm -f $file_output_data
+        done
+    fi
+
+    if [ "$alg_signing_key" = "$ecc_key_type" ]; then
+        for sign_scheme in "" "ecdsa"
+        do
+            create_signature $sign_scheme
+            verify_signature $sign_scheme
+
+            rm -f $file_output_data
+        done
+    fi
+}
+
+start_up
+
+cleanup "no-shut-down"
+
+# make sure commands failing inside the function will cause the script to fail!
+(
+    set -e
+    test_symmetric "hmac"
+    cleanup "no-shut-down"
+)
+
+for key_type in $rsa_key_type $ecc_key_type
+do
+    # make sure commands failing inside the function will cause the script
+    # to fail!
+    (
+        set -e
+        test_asymmetric $key_type
+        cleanup "no-shut-down"
+    )