Delivers lightweight confidential VM images with built-in signing/verification and trusted attribute services for runtime integrity protection.

文件	最后提交记录	最后更新时间
.gitattributes	submit source code package Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
.lfsconfig	submit source code package Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
101-fix-clippy-warnings-4975aa0.patch	fix: 修复告警和机密虚机内存访问问题 Code-Owner: zhangju8@h-partners.com Co-Authored-By: glm-5	1 个月前
102-fix-stop-secret-vm-crash-f51939b.patch	fix: 修复告警和机密虚机内存访问问题 Code-Owner: zhangju8@h-partners.com Co-Authored-By: glm-5	1 个月前
105-enforce-rust-coding-standards-2293fdd.patch	feat: add coding standards and permission patches 新增两个补丁并更新 spec 文件： - 105-enforce-rust-coding-standards-2293fdd.patch：缩小 unsafe 块范围，将 && 右侧副作用操作拆分为嵌套 if - 106-harden-file-permissions-d26f685.patch：通过进程级 umask(0o027) 加固日志/服务/配置目录权限，归档日志设为 440 - spec 文件 Release 3->4，新增 Patch2/Patch3 声明和 changelog Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
106-harden-file-permissions-d26f685.patch	feat: add coding standards and permission patches 新增两个补丁并更新 spec 文件： - 105-enforce-rust-coding-standards-2293fdd.patch：缩小 unsafe 块范围，将 && 右侧副作用操作拆分为嵌套 if - 106-harden-file-permissions-d26f685.patch：通过进程级 umask(0o027) 加固日志/服务/配置目录权限，归档日志设为 440 - spec 文件 Release 3->4，新增 Patch2/Patch3 声明和 changelog Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
README.en.md	submit source code package Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
README.md	submit source code package Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
trustruntime-1.0.0.tar.gz	update source code package Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前
trustruntime.spec	fix: declare /etc/trustruntime and /etc/trt_launcher as %dir with 0750 permission Code-Owner: zhangshouxu@h-partners.com	1 个月前
vendor.tar.gz LFS	submit source code package Code-Owner: zhangshouxu@h-partners.com Co-Authored-By: glm-5	1 个月前

TrustRuntime

提供轻量级机密计算虚机镜像，内置签名/验签与可信属性服务，保障运行时完整性。

仓库内容

文件	说明
`trustruntime-1.0.0.tar.gz`	源码包
`vendor.tar.gz`	Rust 离线依赖
`trustruntime.spec`	RPM 构建 spec 文件

构建产物

本项目构建三个 RPM 包：

trustruntime

CMS 签名验签服务 — 主程序，负责证书管理与签名操作。

二进制：/usr/bin/trustruntime
服务：trustruntime.service
配置：/etc/trustruntime/agent.toml

trustruntime-launcher

VM 启动器 — 用于启动 CCA（机密计算架构）虚机。

二进制：/bin/trt_launcher
服务：trt_launcher.service
配置：/etc/trt_launcher/trt_launcher.conf

trustruntime-builder

VM 镜像构建工具 — 构建机密计算虚机镜像的脚本与配置。

脚本目录：/opt/trt_builder/
- build.sh — 构建脚本
- bootstrapd — 引导初始化
- initrd.list — initrd 文件清单

构建依赖

rust
cargo
openssl-devel >= 3.0.0
gcc
make

构建 RPM

# 1. 安装构建依赖
sudo dnf install rpm-build rust cargo openssl-devel gcc make

# 2. 创建 rpmbuild 目录结构
mkdir -p ~/rpmbuild/{SOURCES,SPECS}

# 3. 放置源文件和 spec 文件
cp trustruntime-1.0.0.tar.gz ~/rpmbuild/SOURCES/
cp vendor.tar.gz ~/rpmbuild/SOURCES/
cp trustruntime.spec ~/rpmbuild/SPECS/

# 4. 构建 RPM（同时生成二进制包和源码包）
cd ~/rpmbuild/SPECS
rpmbuild -ba trustruntime.spec

构建产物：