Repository navigation

[DRAFT][DONTMERGE] Add a new PQC Tang pin - #583

Draft

sarroutbi wants to merge 36 commits into

latchset:masterfrom

sarroutbi:tang-kem-pub

Draft

[DRAFT][DONTMERGE] Add a new PQC Tang pin#583
sarroutbi wants to merge 36 commits into
latchset:masterfrom
sarroutbi:tang-kem-pub

Commits on Sep 24, 2026
- tang: skip storing adv when server supports tang_pub
  
  sarroutbi
  and
  claude
  committed
  1c30171
Commits on Sep 30, 2026
- tang: add hybrid ECC+KEM post-quantum provisioning and recovery
  
  sarroutbi
  and
  claude
  committed
  72d3b68
Commits on Oct 2, 2026
- tang: add secure transport for KEM recovery channel
  
  sarroutbi
  and
  claude
  committed
  9cf04e4
- tang: align variable and field names with protocol specification
  
  sarroutbi
  and
  claude
  committed
  50c89ea
- Add /adv-kem request to get specific KEM public key
  sarroutbi
  committed
  e847a8d
Commits on Oct 5, 2026
- tang: add hybrid PQC pin for ECC+ML-KEM post-quantum encryption
  
  sarroutbi
  and
  claude
  committed
  cdb936e
- tang: remove PQC hybrid code from classical pin scripts
  
  sarroutbi
  and
  claude
  committed
  ac7b8a5
- tang-pqc: fix trust prompt and document dependencies
  
  sarroutbi
  and
  claude
  committed
  95ecdc4
- tang-pqc: add dracut module and initramfs-tools hook
  
  sarroutbi
  and
  claude
  committed
  fe6c357
- tang: inline tang_pub recovery logic in clevis-decrypt-tang
  
  sarroutbi
  and
  claude
  committed
  af3b133
- Remove never used again xxd/openssl commands
  sarroutbi
  committed
  299c899
- Fix clevis-luks-bind to find tang-pqc pin
  sarroutbi
  committed
  8306d22
- tang-pqc: add tang-pqc support to SSS pin listing and regen
  
  sarroutbi
  and
  claude
  committed
  9007856
- Fix clevis-luks-report and tests for tang_pub compatibility
  
  sarroutbi
  and
  claude
  committed
  d19648b
- tang-pqc: add offline advertisement binding support
  
  sarroutbi
  and
  claude
  committed
  099c5fd
- tang-pqc: add integration test suite
  
  sarroutbi
  and
  claude
  committed
  4ba7170
- Fix clevis-luks-report rotation detection for tang_pub mode
  
  sarroutbi
  and
  claude
  committed
  09278f6
Commits on Oct 6, 2026
- tang-pqc: gate build on jose ML-KEM KEM API availability
  
  sarroutbi
  and
  claude
  committed
  fb1070c
- Disable shellcheck issues due to dracut well known variables
  sarroutbi
  committed
  bd44ab5
- Make C++ dependency conditional on jose ML-KEM API availability
  
  sarroutbi
  and
  claude
  committed
  1ecebdb
- Include gcc-c++ (not gcc-g++) to the dependencies
  sarroutbi
  committed
  13d8d4a
- Adjust to closer spec definitions for secure transport
  sarroutbi
  committed
  baafcad
- Remove unused parameter
  sarroutbi
  committed
  6de7127
- Remove curl/openssl (leftover from legacy Tang)
  sarroutbi
  committed
  13173b9
Commits on Oct 7, 2026
- Remove unused deleter
  sarroutbi
  committed
  098fe18
- Cleanse possible compromisable information
  sarroutbi
  committed
  3837b92
Commits on Oct 9, 2026
- Harden tang-pqc pin against security findings
  
  sarroutbi
  and
  claude
  committed
  1e5c5fa
Commits on Oct 15, 2026
- Validate untrusted inputs in tang-pqc pin
  
  sarroutbi
  and
  claude
  committed
  376a5aa
- Skip version test if Tang does not support it
  sarroutbi
  committed
  a9cc701
- Restrict curl protocols to http/https
  sarroutbi
  committed
  8a49f29
- RAII cleansing for sensitive data in tang-pqc pin
  
  sarroutbi
  and
  claude
  committed
  3fee20f
- Limit HTTP response size to prevent OOM from malicious server
  
  sarroutbi
  and
  claude
  committed
  be47917
- Bound stdin reads to prevent OOM from oversized input
  
  sarroutbi
  and
  claude
  committed
  5ee37c3
- Enforce response size limit in writeCallback
  
  sarroutbi
  and
  claude
  committed
  5083d01
- Delete copy semantics on CleansedString/Vector
  
  sarroutbi
  and
  claude
  committed
  78fa42a
- Bound offline advertisement file reads
  
  sarroutbi
  and
  claude
  committed
  91c1d69

Commits

Commits on Sep 24, 2026

Commits on Sep 30, 2026

Commits on Oct 2, 2026

Commits on Oct 5, 2026

Commits on Oct 6, 2026

Commits on Oct 7, 2026

Commits on Oct 9, 2026

Commits on Oct 15, 2026