chore: fix dependency to TPM simulator

[zeschg]

No description provided.

[hseuschek]

Looks fine for me, It's just a change in a download URL for an external dependency.

[StefanSchroeder]

I am aware that the downloaded dependency is only run in a sandbox, but as a matter of principle I think it's not a good idea to run code from an untrusted source. I'd suggest to compute a checksum on the downloaded tarball after download and only continue if it's the expected value. Since the tarballs seem to be versioned, I wouldn't expect it to change. Just my 2 cents.

[hseuschek]

I am aware that the downloaded dependency is only run in a sandbox, but as a matter of principle I think it's not a good idea to run code from an untrusted source. I'd suggest to compute a checksum on the downloaded tarball after download and only continue if it's the expected value. Since the tarballs seem to be versioned, I wouldn't expect it to change. Just my 2 cents.

good point ;-). The issue is solved in PR #36