Prebuilt Linux binary does not appear to include TPM support
- Dominant language
- Rust
- Stars
- 25
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
## Description
Hi.
I'm testing sshenc on Linux with a TPM 2.0, but sshenc agent fails with this error: `Error: failed to initialize backend: hardware security module not available`
Looking at [hardware-enclave](https://github.com/godaddy/hardware-enclave/blob/main/crates/hardware-enclave/Cargo.toml#L93) , Linux TPM support is disabled by default:
```
# ── linux-tpm: opt-in native Linux TPM 2.0 backend (requires libtss2).
# Off by default since most Linux consumers use the keyring backend or the
# WSL→Windows bridge. Enable explicitly when native TPM 2.0 is required.
linux-tpm = []
```
However, this feature is not enabled in [cargo config](https://github.com/godaddy/sshenc/blob/v0.6.101/Cargo.toml#L33):
```
hardware-enclave = { version = "0.2.5", features = ["signing", "encryption"] }
```
## Steps to Reproduce
```
# sshenc agent
Error: failed to initialize backend: hardware security module not available
# sshenc --version
sshenc 0.6.101
# file /usr/local/bin/sshenc
/usr/local/bin/sshenc: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=cf0708a018d73a1575cea13ccf39fcdcbf3b387a, not stripped
# ls /dev/tpm*
/dev/tpm0 /dev/tpmrm0
# tpm2_getcap -T device:/dev/tpmrm0 ecc-curves
TPM2_ECC_NIST_P256: 0x3
TPM2_ECC_NIST_P384: 0x4
TPM2_ECC_BN_P256: 0x10
TPM2_ECC_SM2_P256: 0x20
```
## Expected Behavior
The prebuilt GNU/Linux binary should include native Linux TPM 2.0 support.
## Actual Behavior
See above.
## Environment
- OS: Linux (Fedora 43)
- Hardware: Lenovo ThinkBook 16 G6 IRL
- sshenc version: 0.6.101 (gnu)
Contributor guide
Research direction
Start in Cargo.toml at the hardware-enclave dependency and compare its enabled features with the upstream linux-tpm option described in the issue. Build or inspect the GNU/Linux release configuration, then run sshenc agent on a Linux system with /dev/tpm0 or /dev/tpmrm0; done means the prebuilt binary initializes the native TPM backend instead of reporting that the hardware security module is unavailable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100