Bug#1141891: ITP: attezt -- An open-source TPM device-attest-01 CA server

Simon Josefsson <[email protected]> Sun, 12 Jul 2026 12:40:56 +0200

Newsgroups	gmane.linux.debian.devel.general
Message-ID	<878q7gsd6v.fsf__13529.7854941868$1783853018$gmane$org@josefsson.org>

Package: wnpp
Severity: wishlist
Owner: Simon Josefsson <[email protected]>

* Package name    : attezt
  Version         : 0.0~git20260321.c4c2d28-1
  Upstream Author : Morten Linderud
* URL             : https://github.com/Foxboron/attezt
* License         : Expat
  Programming Lang: Go
  Description     : An open-source TPM device-attest-01 CA server

 attezt is a suite of remote attestation tools.
 .
 It provides several components that allows Linux systems to have
 hardware backed device certificates over the device-attest-01 ACME
 challenge. This is useful for environments where you want a strong
 device identity claim for things like x509 certificates used for mTLS
 setups.
 .
 It currently supports smallstep, but also has it's own client
 implementation to administer device certificates.
 .
 atteztd provides an Attestation Certificate Authority. It has an backend
 inventory API that is able to query a CMDB setup for device inventory
 and validate devices.
 .
 attezt-agent provides a client agent that can serve the TPM certificate
 over a PKCS11 agent. This agent can be used for things like mTLS over
 browsers to certify authenticity.
 .
 attezt is the program to manage attezt-agent and atteztd deployments. It
 allows you to check the enrollment of the device, provision
 certificates. Or administer the attestation certificate authority.

Since the upstream project is a WIP I'll keep this on Salsa, or possibly
into experimental once I get it to build, but wanted to file a ITP bug
in case someone else is interested and wants to take over or help move
this along.

https://salsa.debian.org/go-team/packages/attezt
https://salsa.debian.org/jas/attezt/-/pipelines

/Simon

signature.asc (application/pgp-signature, 1.2 KB)