TEE infrastructure for Calimero: mero-kms-phala (Key Management Service for Phala Cloud) and GCP node-image build (Packer-based merod node images with TDX attestation).
Full documentation: Architecture Reference
| Component | Description |
|---|---|
| mero-kms-phala | KMS that validates TDX attestations and releases storage encryption keys to merod nodes running in Phala CVMs |
| mero-tee/ | GCP Packer build for locked merod node images (debug, debug-read-only, locked-read-only profiles) |
| attestation-verifier/ | Public web tool for verifying KMS and node attestations via Intel Trust Authority |
cargo build --releaseRequires Rust. Dependencies on calimero-tee-attestation and calimero-server-primitives via git dependency on calimero-network/core.
See mero-tee/README.md. Requires Packer, Ansible, and GCP credentials.
# Verify all release trust assets for a tag
scripts/release/verify-release-assets.sh X.Y.Z
# Generate pinned merod KMS config from signed release policy
scripts/policy/generate-merod-kms-phala-attestation-config.sh \
--profile locked-read-only X.Y.Z https://<kms-url>/All detailed documentation lives in the Architecture Reference:
| Topic | Page |
|---|---|
| High-level architecture & system map | System Overview |
| KMS, node images, attestation verifier | Components |
| Mutual attestation & trust boundaries | Trust Model |
| Challenge/get-key protocol | Key Release Flow |
| KMS self-attestation & public verifier | Attestation Flow |
| MRTD/RTMR, compose hash, operator verify | Verification |
| Release classes, CI/CD, pipeline flows | Release Pipeline |
| Staging probes, policy promotion, ADRs | Policy Management |
| Phala KMS, GCP nodes, blue-green rollout | Runbooks |
| All environment variables | Config Reference |
| ServiceError variants & HTTP codes | Error Handling |
| TEE terms & definitions | Glossary |
- Merge version bump PR (
Cargo.tomlandversions.jsonaligned) - Node release runs first; KMS release waits, then creates draft
- Human reviews and publishes KMS draft release
update-compatibility-catalogworkflow updatescompatibility-catalog.json
Two artifact families per version:
- mero-kms-vX.Y.Z: KMS binaries, attestation policies, compatibility map, Sigstore signatures
- mero-tee-vX.Y.Z: published-mrtds.json, release provenance, SBOM, checksums, Sigstore signatures
- calimero-network/core – merod, node runtime
MIT OR Apache-2.0