rottweiler: add credential validation

packages/release/encrypt-datastore.service

@@ -19,7 +19,7 @@ ExecCondition=/usr/bin/rottweiler check directory ${DATASTORE_DIR} unencrypted
 ExecStart=/usr/sbin/tune2fs -O encrypt /dev/disk/by-partlabel/BOTTLEROCKET-PRIVATE
 
 # Generate key and encrypt directory.
-ExecStart=/usr/bin/rottweiler generate-key datastore
+ExecStart=/usr/bin/rottweiler generate key datastore
 ExecStart=/usr/bin/rottweiler encrypt directory ${DATASTORE_DIR} datastore
 
 UMask=0077

packages/release/encrypt-local-fs.service

@@ -17,7 +17,7 @@ Environment=BOTTLEROCKET_DATA=/dev/disk/by-partlabel/BOTTLEROCKET-DATA
 ExecCondition=/usr/bin/rottweiler check block-device ${BOTTLEROCKET_DATA} unencrypted
 
 # Generate key and encrypt block device.
-ExecStart=/usr/bin/rottweiler generate-key bottlerocket-data
+ExecStart=/usr/bin/rottweiler generate key bottlerocket-data
 ExecStart=/usr/bin/rottweiler encrypt block-device ${BOTTLEROCKET_DATA} bottlerocket-data
 
 UMask=0077

sources/Cargo.toml

@@ -132,6 +132,7 @@ aws-smithy-runtime-api = "1"
 aws-smithy-types = "1"
 aws-smithy-async = "1"
 aws-types = "1"
+binrw = "0.14"
 bit_field = "0.10"
 bon = "2"
 bytes = "1"

sources/api/apiserver/src/server/ephemeral_storage.rs

@@ -557,7 +557,7 @@ fn encrypt_ephemeral_device(device: &str) -> Result<String> {
 
     if !is_encrypted {
         run_rottweiler_checked(
-            &["generate-key", EPHEMERAL_STORAGE_KEY_ID],
+            &["generate", "key", EPHEMERAL_STORAGE_KEY_ID],
             EPHEMERAL_DATA_LINK,
         )?;
         run_rottweiler_checked(

sources/deny.toml

@@ -21,6 +21,7 @@ allow = [
 ]
 
 exceptions = [
+    { name = "rottweiler", allow = ["LGPL-2.1"], version = "*" },
 ]
 
 # https://github.com/hsivonen/encoding_rs The non-test code that isn't generated from the WHATWG data in this crate is

sources/rottweiler/Cargo.toml

@@ -2,21 +2,29 @@
 name = "rottweiler"
 version = "0.1.0"
 edition = "2024"
-license = "Apache-2.0 OR MIT"
+license = "(Apache-2.0 OR MIT) AND LGPL-2.1-or-later"
 publish = false
 
 [dependencies]
 argh.workspace = true
+base64.workspace = true
+binrw.workspace = true
 bottlerocket-image-features.workspace = true
 envy.workspace = true
 hex.workspace = true
+hex-literal.workspace = true
 hkdf = { workspace = true, features = ["std"] }
 nix = { workspace = true, features = ["fs", "ioctl", "mount"] }
 serde = { workspace = true, features = ["derive"] }
+serde_plain.workspace = true
+serde_json.workspace = true
 sha2.workspace = true
 snafu.workspace = true
 walkdir.workspace = true
 zeroize = { workspace = true, features = ["alloc", "derive"] }
 
+[dev-dependencies]
+test-case.workspace = true
+
 [build-dependencies]
 generate-readme.workspace = true

sources/rottweiler/README.md

@@ -14,7 +14,8 @@ interface for encrypting and managing encrypted storage resources including:
 ### Commands
 
 #### Key Management
-- `generate-key <key-id>` - Generate an encryption key
+- `generate key <key-id>` - Generate an encryption key
+- `dump key <key-id>` - Dump encrypted key structure
 
 #### Block Device Operations
 - `encrypt block-device <path> <key-id>` - Encrypt a block device using LUKS
@@ -28,6 +29,7 @@ interface for encrypting and managing encrypted storage resources including:
 - `lock directory <path>` - Lock an encrypted directory (remove key)
 - `unlock directory <path> <key-id>` - Unlock an encrypted directory (add key)
 - `check directory <path> encrypted|unencrypted` - Check directory encryption state
+- `check directory <path> locked|unlocked` - Check directory lock state
 
 #### TPM Measurement Operations
 - `measure settings` - Measure OS settings into PCR 8