feat(agent): add pure-Go attestation-agent library (agent-go)

[jialez0]

What

Adds attestation-agent/agent-go, a pure-Go re-implementation of the attestation-agent library crate (attestation-agent/attestation-agent), layered on top of attester-go. It exposes the attestation-agent service API (AttestationAPIs) to Go programs with no cgo and no external shared library.

Why

To let Go programs use the full attestation-agent flow — not just evidence collection (attester-go) but also token retrieval, init-data binding and, most importantly, runtime measurement extension with AAEL recording — in-process, as a pure-Go module. The default build is CGO_ENABLED=0.

What it implements

• AttestationAgent / AttestationAPIs — GetEvidence, GetAdditionalEvidence, GetToken, ExtendRuntimeMeasurement, BindInitData, GetTeeType, GetAdditionalTees, plus New / Init / SetInitdataToml.
• config — AA config parsing (TOML or JSON) with the same defaults, and aa_kbc_params resolution from the environment / kernel command line.
• eventlog — the AA Event Log (AAEL): TCG2 event encoding, extend-into-register through the attester, and a write-ahead log (WAL) that makes the "extend register + append log" pair crash-recoverable. The TCG2 event-data digest is byte-compatible with the Rust implementation (locked by the same unit-test vectors).
• initdata — parse the Initdata TOML and compute its digest.
• token — CoCoAS token getter (fully implemented).

Scope / differences from the Rust crate

All following the scope already established by attester-go:

• No cgo / no shared library. Every platform is reached through attester-go's native kernel interfaces.
• instance_info is not ported (AA instance info / heartbeat). An [aa_instance] section in an existing config file is ignored.
• KBS token is not ported. It needs the KBS background-check protocol (the Rust kbs_protocol crate: RCAR handshake + TEE key pair), which has no Go port yet; token.KbsTokenGetter.GetToken returns token.ErrKbsNotImplemented. The CoCoAS token is fully implemented.
• No additional (device) attesters. attester-go exposes none, so GetAdditionalEvidence returns empty and GetAdditionalTees is empty.

Testing

go test ./... passes (incl. -race). Coverage:

• TCG2 digest byte-compatibility vectors (identical to the Rust attestation-agent tests).
• Event-log extend + WAL crash-recovery paths, driven by an in-memory attester.
• Config TOML/JSON parsing and defaults, aa_kbc_params, Initdata digest, token dispatch and CoCoAS URL resolution.

Notes

• New self-contained Go module under attestation-agent/agent-go; does not touch the existing Rust crates.
• Consumes attester-go via a relative module replace. The only new external dependency is a pure-Go TOML parser (github.com/BurntSushi/toml).

[shankailun-aliyun]

@jialez0 ，您好，您的请求已接收，请耐心等待结果。

[shankailun-aliyun]

@jialez0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。

[shankailun-aliyun]

@jialez0 ，您好，您的请求已接收，请耐心等待结果。

[shankailun-aliyun]

@jialez0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。