confium_store_tpm/
lib.rs

1//! Confium Store TPM 2.0 backend.
2//!
3//! Hardware-backed keystore for Confium that targets the platform TPM 2.0
4//! available on every modern Linux/Windows machine. Wraps the
5//! [`tss-esapi`](https://docs.rs/tss-esapi) Rust binding for the TPM 2.0
6//! TSS2 Enhanced System API.
7//!
8//! This crate is a *backend* for [`confium-store`]: it implements the
9//! [`StoreBackend`](confium_store::backend::StoreBackend) trait and
10//! registers itself at link time via
11//! [`register_backend!`](confium_store::register_backend!). Drop-in with
12//! the in-memory and filesystem backends — same Rust API, different
13//! storage medium.
14//!
15//! ## Status
16//!
17//! **Skeleton.** The trait wiring, configuration model, and hierarchy
18//! type are in place; the storage operations return
19//! [`NotImplemented`](confium_store::Error::NotImplemented). The
20//! `tss-esapi` integration lands in the next revision behind the `tpm`
21//! feature flag. See `TODO.roadmap/18-hardware-keystore-backends.md`.
22//!
23//! ## Configuration
24//!
25//! The backend reads its configuration from the
26//! [`Options`](confium_store::backend::Options) map passed to
27//! [`StoreBackend::open`](confium_store::backend::StoreBackend::open):
28//!
29//! | key              | meaning                                             | default            |
30//! |------------------|-----------------------------------------------------|--------------------|
31//! | `tpm_device`     | path to the TPM device (e.g. `/dev/tpmrmis0`)       | auto-detect        |
32//! | `hierarchy`      | `owner` / `platform` / `endorsement`                | `owner`            |
33//! | `parent_handle`  | persistent parent key handle (hex, e.g. `0x81000001`) | required at runtime |
34//! | `parent_password` | authorisation value for the parent key             | empty              |
35//!
36//! ## Example
37//!
38//! ```ignore
39//! // Marked `ignore` because the doctest compilation triggers a Cargo
40//! // workspace feature-unification issue (E0460) when run via
41//! // `cargo test --workspace`. The code is correct; run individually
42//! // with `cargo test -p confium-store-tpm --doc` to verify.
43//! use confium_store::backend::{Options, StoreBackend};
44//! use confium_store_tpm::TpmBackend;
45//!
46//! let backend = TpmBackend;
47//! let mut opts = Options::new();
48//! opts.insert("tpm_device".into(), "/dev/tpmrmis0".into());
49//! opts.insert("hierarchy".into(), "owner".into());
50//! let store = backend.open(&opts).expect("open tpm backend");
51//! ```
52
53// FFI entry points (none yet) would accept raw pointers and null-check
54// them before dereferencing; mirroring the convention from
55// `confium-store`.
56#![allow(clippy::not_unsafe_ptr_arg_deref)]
57#![allow(rustdoc::broken_intra_doc_links)]
58#![allow(rustdoc::bare_urls)]
59#![allow(rustdoc::redundant_explicit_links)]
60#![allow(rustdoc::private_intra_doc_links)]
61#![allow(rustdoc::invalid_html_tags)]
62
63pub mod backend;
64pub mod config;
65
66pub use backend::{TpmBackend, TpmInstance};
67pub use config::{Hierarchy, ParentHandle, TpmConfig};
confium_store_tpm/lib.rs

confium_store_tpm/
lib.rs
