key-vault 1.0.0

Enterprise-grade key management vault for Rust. 9-layer defense-in-depth: fragmentation, decoy bytes, codex transform, mlock + zeroize, constant-time ops, security monitoring. Pluggable key fetchers (TPM, keychain, file, env). Sub-microsecond access. REPS-compliant.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

//! Integration tests for the TEE detection probe.
//!
//! These exercise the public surface of `key_vault::tee` from outside the
//! crate, which is the perspective downstream consumers (e.g. `crypt-io`)
//! will see.

use key_vault::tee::{Detection, detect_tee_capabilities};

#[test]
fn detect_completes_and_returns_consistent_snapshot() {
    // Calling the probe must not panic, must not block, and must return the
    // same snapshot across consecutive calls (capabilities don't change at
    // runtime).
    let first = detect_tee_capabilities();
    let second = detect_tee_capabilities();
    assert_eq!(first, second);
}

#[test]
fn detection_variants_are_self_consistent() {
    let caps = detect_tee_capabilities();
    for d in [
        caps.sgx,
        caps.tdx,
        caps.sev,
        caps.sev_snp,
        caps.trustzone,
        caps.secure_enclave,
        caps.nitro,
    ] {
        if d.is_detected() {
            assert!(matches!(d, Detection::Detected));
        } else {
            assert!(matches!(d, Detection::NotDetected | Detection::Unknown));
        }
    }
}

#[cfg(target_arch = "x86_64")]
#[test]
fn x86_64_returns_known_detection_for_intel_amd_probes() {
    let caps = detect_tee_capabilities();
    // On x86_64, SGX/TDX/SEV/SEV-SNP probes must complete — they should never
    // be Unknown on a supported architecture.
    for d in [caps.sgx, caps.tdx, caps.sev, caps.sev_snp] {
        assert_ne!(d, Detection::Unknown);
    }
}