feat: add snphost config/commit test module

[amd-aliem]

Add host-side tests for snphost config set, config reset, and commit subcommands. The module runs 8 test cases during the test stage. Expected to rework/extend this test to support guest-side tests in the future (verifying reported TCB levels in attestation reports).

• Output is structured JSON lines tagged with LogExtraFields (SEV_VERSION, SEV_TEST_GROUP) for journal-based result collection.
• Also adds a structured certificate generator that parses the JSON test results from journald.
• Add a small fix to transient sync issue with snpguest-ok.service where it was running before systemd-modules-load.service (msr wasn't loaded)
• Currently capping milestone to c3.0.0-0 until all planned tests in c3.0.0-1 are implemented.

Testing:

• ubuntu 25.10 SEV certification v3.0.0-1 amd-aliem/sev-certify#156 (see https://github.com/amd-aliem/sev-certify/issues for all runs) note: fixed an issue with certificate title not being capped at 3.0.0-0.

[Copilot]

Pull request overview

Adds a new host-side test module for snphost config set/reset and snphost commit, and extends reporting to support structured JSON test output collected from journald. Also fixes a guest boot ordering issue so snpguest ok runs after modules are loaded.

Changes:

• Add snphost-config-commit systemd service + bash test runner emitting structured JSON step/summary lines.
• Extend SEV certificate generation to parse structured JSON results from journald for new certification levels, and update combined certificate file naming.
• Update beacon reporting to pick the highest achieved certificate file and cap the reported milestone; adjust snpguest-ok.service ordering.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
modules/test/host/test-done/mkosi.extra/usr/local/lib/systemd/system/test-done.service	Make test barrier depend on the new host test service.
modules/test/host/snphost-config-commit/mkosi.extra/usr/local/lib/systemd/system/snphost-config-commit.service	Add oneshot service to run the new snphost config/commit test script with structured logging fields.
modules/test/host/snphost-config-commit/mkosi.extra/usr/local/lib/scripts/snphost_config_commit.sh	Implement 8-case host-side test runner emitting JSON step/summary lines.
modules/test/host/mkosi.conf	Include the new host test module in the host test image build.
modules/system/guest/snpguest-ok/mkosi.extra/usr/local/lib/systemd/system/snpguest-ok.service	Fix ordering so it runs after systemd-modules-load.service and correct service dependencies/spelling.
modules/stop/host/beacon-report/mkosi.extra/usr/local/lib/scripts/beacon-report.sh	Report based on the highest achieved certificate file and cap the milestone.
modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/sev_certificate/sev_certificate_version.py	Add generic structured-results certificate generator that parses journald JSON lines.
modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/sev_certificate/generate_sev_certificate.py	Combine multiple level certificates and write a single output named after the highest achieved level.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.