keylimectl: A replacement for `keylime_tenant` in rust#1068

Draft

ansasaki wants to merge 49 commits into

keylime:masterfrom

ansasaki:keylimectl

Commits on Jun 16, 2026

keylimectl: Initial implementation of all commands

ansasaki
and
claude
committed
keylimectl: Replace insecure LCG nonce generator with CSPRNG

ansasaki
and
claude
committed
crypto: Make pkey_pub_from_pem and rsa_oaep_encrypt public

ansasaki
and
claude
committed
keylimectl: Use the RSA-OAEP encryption from the crypto module

ansasaki
and
claude
committed
keylimectl: Add optional TPM quote validation behind feature flag

ansasaki
and
claude
committed
keylimectl: Zeroize secret key material on drop

ansasaki
and
claude
committed
keylimectl: Make TLS hostname verification configurable and enforce TLS 1.2

ansasaki
and
claude
committed
keylimectl: add api-v2/api-v3 feature flags and gate v2-only modules

ansasaki
and
claude
committed
keylimectl: Gate verifier methods behind v2/v3 feature flags

ansasaki
and
claude
committed
keylimectl: add test matrix for api-v2/api-v3 feature combinations

ansasaki
and
claude
committed
keylimectl: gate registrar version detection behind feature flags

ansasaki
and
claude
committed
keylimectl: Add negative security tests

ansasaki
and
claude
committed
keylimectl: Make push model default with auto-detection

ansasaki
and
claude
committed
keylimectl: Add configuration and usability features

ansasaki
and
claude
committed
keylimectl: Add diagnostics with info command

ansasaki
and
claude
committed
keylimectl: Make policy a module with new CLI subcommands

ansasaki
and
claude
committed
keylimectl: add runtime, measured boot, and TPM policy schema types

ansasaki
and
claude
committed
keylimectl: implement IMA log parsing and runtime policy generation

ansasaki
and
claude
committed
keylimectl: Add filesystem scanning and policy merging

ansasaki
and
claude
committed
keylimectl: implement DSSE policy signing and signature verification

ansasaki
and
claude
committed
keylimectl: Implement policy validation

ansasaki
and
claude
committed

Commits on Jun 17, 2026