Skip to content

Conversation

ansasaki
Copy link
Contributor

@ansasaki ansasaki commented Aug 4, 2025

Disclaimer: this is an AI generated rewrite. We should be careful reviewing it.

Adds a modern Rust replacement for keylime_tenant with full API compatibility and improved usability.

Features

  • Agent Management: add, remove, update, status, reactivate commands
  • Policy Management: runtime and measured boot policy CRUD operations
  • Resource Listing: agents, policies with detailed/basic views
  • Multi-format Output: JSON, table, YAML with configurable verbosity
  • Robust Error Handling: typed errors with context and retry logic
  • TLS Support: mutual authentication with certificate validation
  • Configuration: file-based config with CLI overrides

Implementation

  • 8,512 lines of documented Rust code
  • 158 comprehensive unit tests (100% pass rate)
  • 0 clippy warnings, full type safety
  • Modular architecture with proper abstractions
  • IPv6 support and exponential backoff retry

Usage

keylimectl agent add <uuid> --ip 192.168.1.100 --port 9002
keylimectl policy create web-policy --file policy.json
keylimectl list agents --detailed

Replaces Python keylime_tenant while maintaining backward compatibility.

@ansasaki ansasaki marked this pull request as draft August 4, 2025 12:04
@ansasaki ansasaki force-pushed the keylimectl branch 2 times, most recently from b55ee8e to da44cbc Compare August 4, 2025 15:43
Copy link

codecov bot commented Aug 5, 2025

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 44.59%. Comparing base (cbf60a7) to head (dbe4a6c).

Files with missing lines Patch % Lines
keylime-push-model-agent/src/attestation.rs 0.00% 1 Missing ⚠️
Additional details and impacted files
Flag Coverage Δ
e2e-testsuite 44.59% <0.00%> (-14.34%) ⬇️
upstream-unit-tests 44.59% <0.00%> (-14.34%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
keylime-push-model-agent/src/struct_filler.rs 0.00% <ø> (-23.63%) ⬇️
keylime-push-model-agent/src/attestation.rs 0.00% <0.00%> (-45.66%) ⬇️

... and 49 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ansasaki ansasaki force-pushed the keylimectl branch 3 times, most recently from 7cd11bf to 9609be7 Compare August 7, 2025 10:19
Assisted-by: Claude 4 Sonnet
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Also fixed linting issues reported by clippy

Assisted-by: Claude 4 Sonnet
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Assisted-by: Claude 4 Sonnet
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Test and document list, measured_boot, and policy commands.

Assisted-by: Claude 4 Sonnet
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
When the configuration file is not found, use the default values.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Use a common client implementation and make error handling uniform
throughout the code.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
This is necessary because keylime certificates don't properly set the
Subject Alternative Name (SAN).

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
The agent UUID was enforced to be a well formed UUID, but the agent ID
can be any string.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
The /version endpoint was removed. To test if the API version is
supported, the applications should try a GET request to the /v3.0/
endpoint instead.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
In version 3.0, the add operation should make a POST request to the
/v3.0/agents/ without the ID of the agent being added.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
The old verifier replies with 200 OK to GET /v3.0/, even though it does
not support that version. To workaround this, first try the /version
endpoint and if the reply is 410 gone, then try the /v3.0/ endpoint to
confirm that it is a newer verifier.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Use the response from /version endpoint instead of trying all the API
versions right away.

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants