crates/nornir-tpm/Cargo.toml
[package]
name = "nornir-tpm"
# ── 0.1.0 — extracted from korp-installer, unchanged ─────────────────────────
# This crate is `korp-installer/src/tpm.rs` moved, not rewritten. It was already
# self-contained — no `use crate::`, no third-party dependency, std only — and it
# was the only TPM 2.0 implementation in the house, so a second consumer
# (nornir-vault, which wants the TPM as a key provider) had the choice of
# depending on the whole installer or copying a security-critical file. Neither
# is acceptable, so the file moved to where both can reach it.
#
# It speaks the TPM 2.0 command protocol directly over /dev/tpmrm0 in pure Rust:
# no tss-esapi FFI, no tpm2-tools subprocess. That is why it can live in an
# initramfs and why it satisfies the pure-Rust law without an FFI exception.
version = "0.1.0"
edition = "2024"
description = "Pure-Rust TPM 2.0 client: seal/unseal against PCR policy, NV counters, quotes, over /dev/tpmrm0"
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/edda"
[dependencies]
# The sealed-blob envelope carries a blake3 checksum over its body, so a
# truncated or spliced blob is refused before it reaches the chip.
blake3 = "1"