mirror of
https://github.com/openai/codex.git
synced 2026-09-08 15:50:34 +00:00
5636087e34
Linux needs a hardware-backed path for device keys without treating keyrings or software stores as acceptable substitutes. This provider keeps persistent key material as TPM public/private blobs and delegates key creation, public-key export, and signing to TPM2 tooling at runtime, so the private key remains protected by the TPM boundary. - Wire the device-key crate default provider to a Linux implementation on Linux. - Create TPM-backed ECDSA P-256 keys with tpm2_createprimary and tpm2_create. - Store only TPM public/private blobs under the user data directory using a hash-derived key path. - Re-load TPM key contexts for public-key export and signing. - Return SPKI DER public keys from tpm2_readpublic PEM output and DER ECDSA signatures from tpm2_sign. - Report hardware_tpm, and return hardware-unavailable when TPM2 tooling or TPM access is missing. - cargo test -p codex-device-key - just fix -p codex-device-key - git diff --check - Attempted cargo check -p codex-device-key --target x86_64-unknown-linux-gnu; local Rust target is not installed.