keyd

keyd is the private key and trust authority service for filesystem providers. It is launched by rootd after ramfsd and before e2fsd, has no named registration, and exists so encrypted and verity-capable filesystem media can require explicit authority instead of ambient secrets.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX filesystem key authority service. Its purpose in EriX is to provide typed private key and trust material to authorized filesystem providers.

Functionally, it retains the validated count-derived startup table and serves typed lookups on the private endpoint delegated only to e2fsd. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• retain a borrowed, validated key/trust table whose capacity follows the encoded startup row count
• rely on the private endpoint capability, not request-body identity claims, to authorize key and trust lookups
• parse runtime IPC requests in place from the receive buffer so lookup service does not retain oversized transient request copies
• block without a service-local receive deadline, retain accepted replies through transient backpressure, and retire every unexpected capability receipt before rejecting its call
• derive the requested material namespace from the exact lookup operation

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Validation

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo clippy --all-targets --all-features -- -D warnings
RUSTFLAGS="-D warnings" cargo test --all-targets --all-features

Dynamic Boot Artifact Evidence

The runtime image contract documents keyd as a dynamic boot artifact. The image build packages the key service daemon as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd through procd staged dynamic creation before dynlinkd; authority remains explicit private key-service startup peers. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service-discovery, provider-bypass, block-device, or dynlinkd authority. keyd receives only the documented startup endpoints, peers, and capabilities for its role.

Governance Principles

keyd governance is scoped to private filesystem key and trust-material authority.

The scoped governance rules are:

• It loads only typed, validated key and trust rows from boot configuration; it imposes no row-count ceiling below the startup transport capacity.
• It serves key and trust material only through the endpoint delegated to e2fsd.
• It must reject ambiguous, duplicate, overlong, wrong-operation, or wrong-material requests.
• Request bodies and startup rows never carry a caller role or another self-asserted authority claim.
• Malformed receipt state, failed alias retirement, or terminal transport loss terminates keyd so process teardown removes any authority whose cleanup is uncertain.

Authority Boundaries

• keyd has no public named entry and no ambient key discovery path.
• Adding public key-management functions requires a separately delegated endpoint type and bounded IPC contract.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.