import CS keylime-agent-rust-0.2.10-2.el9

2026-08-24 09:14:50 -04:00 · 2026-08-24 09:14:50 -04:00 · 0d658135fa
commit 0d658135fa
parent 64ea5bd262
15 changed files with 870 additions and 1468 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/rust-keylime-0.2.2-vendor.tar.xz
-SOURCES/v0.2.2.tar.gz
+SOURCES/rust-keylime-0.2.10-vendor.tar.zstd
+SOURCES/v0.2.10.tar.gz
--- a/.keylime-agent-rust.metadata
+++ b/.keylime-agent-rust.metadata
@ -1,2 +1,2 @@
-88bd80638a9e933d823dff0b98e2cff849e7e000 SOURCES/rust-keylime-0.2.2-vendor.tar.xz
-f83bc06ae2d04673fb2ed8356bf691ec664ef9f7 SOURCES/v0.2.2.tar.gz
+3c2e80c1da2080f38434b1dada751e4a9b7784db SOURCES/rust-keylime-0.2.10-vendor.tar.zstd
+c20a09b6bb37385d31afb0df22b791ad5722d158 SOURCES/v0.2.10.tar.gz
--- a/SOURCES/0001-rust-keylime-adjust-features.patch
+++ b/SOURCES/0001-rust-keylime-adjust-features.patch
@ -1,29 +0,0 @@
--- a/keylime-agent/Cargo.toml	2025-02-07 17:53:24.436876268 +0100
-+++ b/keylime-agent/Cargo.toml	2025-02-07 17:54:06.501697761 +0100
-@@ -34,11 +34,6 @@
- tss-esapi = {version = "7.2.0", features = ["generate-bindings"]}
- thiserror = "1.0"
- uuid = {version = "1.3", features = ["v4"]}
-zmq = {version = "0.9.2", optional = true}
-# wiremock was moved to be a regular dependency because optional
-# dev-dependencies are not supported
-# see: https://github.com/rust-lang/cargo/issues/1596
-wiremock = {version = "0.5", optional = true}
- 
- [dev-dependencies]
- actix-rt = "2"
-@@ -47,12 +42,12 @@
- # The features enabled by default
- default = []
- # this should change to dev-dependencies when we have integration testing
-testing = ["wiremock"]
-+testing = []
- # Whether the agent should be compiled with support to listen for notification
- # messages on ZeroMQ
- #
- # This feature is deprecated and will be removed on next major release
-with-zmq = ["zmq"]
-+with-zmq = []
- # Whether the agent should be compiled with support for python revocation
- # actions loaded as modules, which is the only kind supported by the python
- # agent (unless the enhancement-55 is implemented). See:
--- a/SOURCES/0001-rust-keylime-metadata.patch
+++ b/SOURCES/0001-rust-keylime-metadata.patch
@ -0,0 +1,57 @@
+--- a/keylime/Cargo.toml	2026-02-13 09:29:02.000000000 +0100
+++ b/keylime/Cargo.toml	2026-02-13 09:48:22.122618066 +0100
+@@ -40,7 +40,6 @@
+ tokio.workspace = true
+ uuid.workspace = true
+ zip.workspace = true
+-zmq = {version = "0.9.2", optional = true}
+
+ [dev-dependencies]
+ tempfile.workspace = true
+@@ -48,6 +47,5 @@
+ wiremock = {version = "0.6"}
+
+ [features]
+default = []
+ testing = []
+-# This feature is deprecated and will be removed on next major release
+-with-zmq = ["zmq"]
+--- a/keylime-agent/Cargo.toml	2026-02-13 09:29:02.000000000 +0100
+++ b/keylime-agent/Cargo.toml	2026-02-13 09:48:27.988361994 +0100
+@@ -28,7 +28,6 @@
+ thiserror.workspace = true
+ uuid.workspace = true
+ zip.workspace = true
+-zmq = {version = "0.9.2", optional = true}
+
+ [dev-dependencies]
+ actix-rt.workspace = true
+@@ -37,18 +36,6 @@
+ # The features enabled by default
+ default = []
+ testing = []
+-# Whether the agent should be compiled with support to listen for notification
+-# messages on ZeroMQ
+-#
+-# This feature is deprecated and will be removed on next major release
+-with-zmq = ["zmq"]
+-# Whether the agent should be compiled with support for python revocation
+-# actions loaded as modules, which is the only kind supported by the python
+-# agent (unless the enhancement-55 is implemented). See:
+-# https://github.com/keylime/enhancements/blob/master/55_revocation_actions_without_python.md
+-#
+-# This feature is deprecated and will be removed on next major release
+-legacy-python-actions = []
+
+ [package.metadata.deb]
+ section = "net"
+--- a/keylime-push-model-agent/Cargo.toml	2026-02-13 09:29:02.000000000 +0100
+++ b/keylime-push-model-agent/Cargo.toml	2026-02-13 09:48:36.030812674 +0100
+@@ -34,7 +34,6 @@
+ # The features enabled by default
+ default = []
+ testing = ["keylime/testing"]
+-legacy-python-actions = []
+
+ [package.metadata.deb]
+ section = "net"
--- a/SOURCES/0002-rust-keylime-do-not-require-usr-libexec.patch
+++ b/SOURCES/0002-rust-keylime-do-not-require-usr-libexec.patch
@ -0,0 +1,73 @@
+diff --git a/keylime/src/config/base.rs b/keylime/src/config/base.rs
+index c171c85..d2e889a 100644
+--- a/keylime/src/config/base.rs
+++ b/keylime/src/config/base.rs
+@@ -625,27 +625,15 @@ pub(crate) fn config_translate_keywords(
+             });
+         }
+
+-        let actions_dir = match config.revocation_actions_dir.as_ref() {
+-            "" => {
+-                error!("The option 'enable_revocation_notifications' is set as 'true' but the revocation actions directory was set as empty in 'revocation_actions_dir'");
+-                return Err(KeylimeConfigError::IncompatibleOptions {
+-                    option_a: "enable_revocation_notifications".into(),
+-                    value_a: "true".into(),
+-                    option_b: "revocation_actions_dir".into(),
+-                    value_b: "empty".into(),
+-                });
+-            }
+-            dir => Path::new(dir),
+        if config.revocation_actions_dir.is_empty() {
+            error!("The option 'enable_revocation_notifications' is set as 'true' but the revocation actions directory was set as empty in 'revocation_actions_dir'");
+            return Err(KeylimeConfigError::IncompatibleOptions {
+                option_a: "enable_revocation_notifications".into(),
+                value_a: "true".into(),
+                option_b: "revocation_actions_dir".into(),
+                value_b: "empty".into(),
+            });
+         };
+-
+-        // Validate that the revocation actions directory exists
+-        let _revocation_actions_dir =
+-            &actions_dir.canonicalize().map_err(|e| {
+-                KeylimeConfigError::MissingActionsDir {
+-                    path: keylime_dir.display().to_string(),
+-                    source: e,
+-                }
+-            })?;
+     }
+
+     let revocation_cert = config_get_file_path(
+@@ -938,32 +926,6 @@ mod tests {
+         assert!(result.is_ok());
+     }
+
+-    #[test]
+-    fn test_invalid_revocation_actions_dir() {
+-        let tempdir = tempfile::tempdir()
+-            .expect("failed to create temporary directory");
+-
+-        let test_config = AgentConfig {
+-            keylime_dir: tempdir.path().display().to_string(),
+-            enable_revocation_notifications: true,
+-            revocation_actions_dir: "/invalid".to_string(),
+-            ..Default::default()
+-        };
+-        let result = config_translate_keywords(&test_config);
+-        // Expect error due to the inexistent directory
+-        assert!(result.is_err());
+-        let test_config = AgentConfig {
+-            keylime_dir: tempdir.path().display().to_string(),
+-            enable_revocation_notifications: false,
+-            revocation_actions_dir: "/invalid".to_string(),
+-            ..Default::default()
+-        };
+-
+-        // Now unset enable_revocation_notifications and check that is allowed
+-        let result = config_translate_keywords(&test_config);
+-        assert!(result.is_ok());
+-    }
+-
+     #[test]
+     fn test_keylime_dir_option() {
+         let dir = tempfile::tempdir()
--- a/SOURCES/0002-rust-keylime-openssl-0.10.70.patch
+++ b/SOURCES/0002-rust-keylime-openssl-0.10.70.patch
@ -1,635 +0,0 @@
-diff --git a/Cargo.lock b/tmp/Cargo.lock
-index b91be43..6642d88 100644
--- a/Cargo.lock
-+++ b/tmp/Cargo.lock
-@@ -1,6 +1,6 @@
- # This file is automatically @generated by Cargo.
- # It is not intended for manual editing.
-version = 3
-+version = 4
- 
- [[package]]
- name = "actix-codec"
-@@ -8,7 +8,7 @@ version = "0.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "57a7559404a7f3573127aab53c08ce37a6c6a315c374a31070f3c91cd1b4a7fe"
- dependencies = [
- "bitflags",
-+ "bitflags 1.3.2",
-  "bytes",
-  "futures-core",
-  "futures-sink",
-@@ -32,7 +32,7 @@ dependencies = [
-  "actix-utils",
-  "ahash 0.8.3",
-  "base64 0.21.0",
- "bitflags",
-+ "bitflags 1.3.2",
-  "bytes",
-  "bytestring",
-  "derive_more",
-@@ -48,7 +48,7 @@ dependencies = [
-  "mime",
-  "percent-encoding",
-  "pin-project-lite",
- "rand 0.8.5",
-+ "rand",
-  "sha1",
-  "smallvec",
-  "tokio",
-@@ -206,7 +206,7 @@ version = "0.7.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
- dependencies = [
- "getrandom 0.2.7",
-+ "getrandom",
-  "once_cell",
-  "version_check",
- ]
-@@ -218,7 +218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
- dependencies = [
-  "cfg-if",
- "getrandom 0.2.7",
-+ "getrandom",
-  "once_cell",
-  "version_check",
- ]
-@@ -281,33 +281,6 @@ dependencies = [
-  "windows-sys 0.48.0",
- ]
- 
-[[package]]
-name = "anyhow"
-version = "1.0.65"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98161a4e3e2184da77bb14f02184cdd111e83bbbcc9979dfee3c44b9a85f5602"
-
-[[package]]
-name = "assert-json-diff"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"
-dependencies = [
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "async-channel"
-version = "1.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14485364214912d3b19cc3435dde4df66065127f05fa0d75c712f36f12c2f28"
-dependencies = [
- "concurrent-queue",
- "event-listener",
- "futures-core",
-]
-
- [[package]]
- name = "async-trait"
- version = "0.1.57"
-@@ -354,7 +327,7 @@ version = "0.63.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "36d860121800b2a9a94f9b5604b332d5cffb234ce17609ea479d723dbc9d3885"
- dependencies = [
- "bitflags",
-+ "bitflags 1.3.2",
-  "cexpr",
-  "clang-sys",
-  "lazy_static",
-@@ -382,6 +355,12 @@ version = "1.3.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
- 
-+[[package]]
-+name = "bitflags"
-+version = "2.8.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
-+
- [[package]]
- name = "block-buffer"
- version = "0.10.3"
-@@ -412,12 +391,6 @@ dependencies = [
-  "bytes",
- ]
- 
-[[package]]
-name = "cache-padded"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1db59621ec70f09c5e9b597b220c7a2b43611f4710dc03ceb8748637775692c"
-
- [[package]]
- name = "cc"
- version = "1.0.73"
-@@ -509,15 +482,6 @@ dependencies = [
-  "vcpkg",
- ]
- 
-[[package]]
-name = "concurrent-queue"
-version = "1.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af4780a44ab5696ea9e28294517f1fffb421a83a25af521333c838635509db9c"
-dependencies = [
- "cache-padded",
-]
-
- [[package]]
- name = "config"
- version = "0.13.3"
-@@ -529,7 +493,7 @@ dependencies = [
-  "nom",
-  "pathdiff",
-  "serde",
- "toml 0.5.9",
-+ "toml",
- ]
- 
- [[package]]
-@@ -557,25 +521,6 @@ dependencies = [
-  "typenum",
- ]
- 
-[[package]]
-name = "deadpool"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "421fe0f90f2ab22016f32a9881be5134fdd71c65298917084b0c7477cbc3856e"
-dependencies = [
- "async-trait",
- "deadpool-runtime",
- "num_cpus",
- "retain_mut",
- "tokio",
-]
-
-[[package]]
-name = "deadpool-runtime"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaa37046cc0f6c3cc6090fbdbf73ef0b8ef4cfcc37f6befc0020f63e8cf121e1"
-
- [[package]]
- name = "derive_more"
- version = "0.99.17"
-@@ -668,18 +613,6 @@ dependencies = [
-  "libc",
- ]
- 
-[[package]]
-name = "error-chain"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9435d864e017c3c6afeac1654189b06cdb491cf2ff73dbf0d73b0f292f42ff8"
-
-[[package]]
-name = "event-listener"
-version = "2.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
-
- [[package]]
- name = "fastrand"
- version = "1.8.0"
-@@ -767,21 +700,6 @@ version = "0.3.27"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "89d422fa3cbe3b40dca574ab087abb5bc98258ea57eea3fd6f1fa7162c778b91"
- 
-[[package]]
-name = "futures-lite"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694489acd39452c77daa48516b894c153f192c3578d5a839b62c58099fcbf48"
-dependencies = [
- "fastrand",
- "futures-core",
- "futures-io",
- "memchr",
- "parking",
- "pin-project-lite",
- "waker-fn",
-]
-
- [[package]]
- name = "futures-macro"
- version = "0.3.27"
-@@ -805,12 +723,6 @@ version = "0.3.27"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "fd65540d33b37b16542a0438c12e6aeead10d4ac5d05bd3f805b8f35ab592879"
- 
-[[package]]
-name = "futures-timer"
-version = "3.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
-
- [[package]]
- name = "futures-util"
- version = "0.3.27"
-@@ -839,17 +751,6 @@ dependencies = [
-  "version_check",
- ]
- 
-[[package]]
-name = "getrandom"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
- [[package]]
- name = "getrandom"
- version = "0.2.7"
-@@ -858,7 +759,7 @@ checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
- dependencies = [
-  "cfg-if",
-  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
-+ "wasi",
- ]
- 
- [[package]]
-@@ -947,27 +848,6 @@ dependencies = [
-  "pin-project-lite",
- ]
- 
-[[package]]
-name = "http-types"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e9b187a72d63adbfba487f48095306ac823049cb504ee195541e91c7775f5ad"
-dependencies = [
- "anyhow",
- "async-channel",
- "base64 0.13.1",
- "futures-lite",
- "http",
- "infer",
- "pin-project-lite",
- "rand 0.7.3",
- "serde",
- "serde_json",
- "serde_qs",
- "serde_urlencoded",
- "url",
-]
-
- [[package]]
- name = "httparse"
- version = "1.8.0"
-@@ -1033,12 +913,6 @@ dependencies = [
-  "hashbrown",
- ]
- 
-[[package]]
-name = "infer"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac"
-
- [[package]]
- name = "instant"
- version = "0.1.12"
-@@ -1141,8 +1015,6 @@ dependencies = [
-  "tokio",
-  "tss-esapi",
-  "uuid",
- "wiremock",
- "zmq",
- ]
- 
- [[package]]
-@@ -1253,17 +1125,6 @@ version = "2.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
- 
-[[package]]
-name = "metadeps"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b122901b3a675fac8cecf68dcb2f0d3036193bc861d1ac0e1c337f7d5254c2"
-dependencies = [
- "error-chain",
- "pkg-config",
- "toml 0.2.1",
-]
-
- [[package]]
- name = "mime"
- version = "0.3.16"
-@@ -1284,7 +1145,7 @@ checksum = "57ee1c23c7c63b0c9250c339ffdc69255f110b298b901b9f6c82547b7b87caaf"
- dependencies = [
-  "libc",
-  "log",
- "wasi 0.11.0+wasi-snapshot-preview1",
-+ "wasi",
-  "windows-sys 0.36.1",
- ]
- 
-@@ -1354,11 +1215,11 @@ checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
- 
- [[package]]
- name = "openssl"
-version = "0.10.55"
-+version = "0.10.70"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "345df152bc43501c5eb9e4654ff05f794effb78d4efe3d53abc158baddc0703d"
-+checksum = "61cfb4e166a8bb8c9b55c500bc2308550148ece889be90f609377e58140f42c6"
- dependencies = [
- "bitflags",
-+ "bitflags 2.8.0",
-  "cfg-if",
-  "foreign-types",
-  "libc",
-@@ -1369,20 +1230,20 @@ dependencies = [
- 
- [[package]]
- name = "openssl-macros"
-version = "0.1.0"
-+version = "0.1.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
-+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
- dependencies = [
-  "proc-macro2",
-  "quote",
- "syn 1.0.100",
-+ "syn 2.0.25",
- ]
- 
- [[package]]
- name = "openssl-sys"
-version = "0.9.90"
-+version = "0.9.105"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374533b0e45f3a7ced10fcaeccca020e66656bc03dac384f852e4e5a7a8104a6"
-+checksum = "8b22d5b84be05a8d6947c7cb71f7c849aa0f112acd4bf51c2a7c1c988ac0a9dc"
- dependencies = [
-  "cc",
-  "libc",
-@@ -1390,12 +1251,6 @@ dependencies = [
-  "vcpkg",
- ]
- 
-[[package]]
-name = "parking"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "427c3892f9e783d91cc128285287e70a59e206ca452770ece88a76f7a3eddd72"
-
- [[package]]
- name = "parking_lot"
- version = "0.12.1"
-@@ -1602,19 +1457,6 @@ dependencies = [
-  "proc-macro2",
- ]
- 
-[[package]]
-name = "rand"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-dependencies = [
- "getrandom 0.1.16",
- "libc",
- "rand_chacha 0.2.2",
- "rand_core 0.5.1",
- "rand_hc",
-]
-
- [[package]]
- name = "rand"
- version = "0.8.5"
-@@ -1622,18 +1464,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
- dependencies = [
-  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.5.1",
-+ "rand_chacha",
-+ "rand_core",
- ]
- 
- [[package]]
-@@ -1643,16 +1475,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
- dependencies = [
-  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-dependencies = [
- "getrandom 0.1.16",
-+ "rand_core",
- ]
- 
- [[package]]
-@@ -1661,16 +1484,7 @@ version = "0.6.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
- dependencies = [
- "getrandom 0.2.7",
-]
-
-[[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
-+ "getrandom",
- ]
- 
- [[package]]
-@@ -1679,7 +1493,7 @@ version = "0.2.16"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
- dependencies = [
- "bitflags",
-+ "bitflags 1.3.2",
- ]
- 
- [[package]]
-@@ -1688,7 +1502,7 @@ version = "0.3.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
- dependencies = [
- "bitflags",
-+ "bitflags 1.3.2",
- ]
- 
- [[package]]
-@@ -1742,12 +1556,6 @@ dependencies = [
-  "winreg",
- ]
- 
-[[package]]
-name = "retain_mut"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4389f1d5789befaf6029ebd9f7dac4af7f7e3d61b69d4f30e2ac02b57e7712b0"
-
- [[package]]
- name = "rustc-hash"
- version = "1.1.0"
-@@ -1778,7 +1586,7 @@ version = "0.37.11"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "85597d61f83914ddeba6a47b3b8ffe7365107221c2e557ed94426489fefb5f77"
- dependencies = [
- "bitflags",
-+ "bitflags 1.3.2",
-  "errno",
-  "io-lifetimes",
-  "libc",
-@@ -1862,17 +1670,6 @@ dependencies = [
-  "serde",
- ]
- 
-[[package]]
-name = "serde_qs"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7715380eec75f029a4ef7de39a9200e0a63823176b759d055b613f5a87df6a6"
-dependencies = [
- "percent-encoding",
- "serde",
- "thiserror",
-]
-
- [[package]]
- name = "serde_urlencoded"
- version = "0.7.1"
-@@ -2139,12 +1936,6 @@ dependencies = [
-  "tracing",
- ]
- 
-[[package]]
-name = "toml"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "736b60249cb25337bc196faa43ee12c705e426f3d55c214d73a4e7be06f92cb4"
-
- [[package]]
- name = "toml"
- version = "0.5.9"
-@@ -2268,7 +2059,6 @@ dependencies = [
-  "form_urlencoded",
-  "idna",
-  "percent-encoding",
- "serde",
- ]
- 
- [[package]]
-@@ -2283,7 +2073,7 @@ version = "1.3.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "5b55a3fef2a1e3b3a00ce878640918820d3c51081576ac657d23af9fc7928fdb"
- dependencies = [
- "getrandom 0.2.7",
-+ "getrandom",
- ]
- 
- [[package]]
-@@ -2298,12 +2088,6 @@ version = "0.9.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
- 
-[[package]]
-name = "waker-fn"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d5b2c62b4012a3e1eca5a7e077d13b3bf498c4073e33ccd58626607748ceeca"
-
- [[package]]
- name = "want"
- version = "0.3.0"
-@@ -2314,12 +2098,6 @@ dependencies = [
-  "try-lock",
- ]
- 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
- [[package]]
- name = "wasi"
- version = "0.11.0+wasi-snapshot-preview1"
-@@ -2562,28 +2340,6 @@ dependencies = [
-  "winapi",
- ]
- 
-[[package]]
-name = "wiremock"
-version = "0.5.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd7b0b5b253ebc0240d6aac6dd671c495c467420577bf634d3064ae7e6fa2b4c"
-dependencies = [
- "assert-json-diff",
- "async-trait",
- "base64 0.21.0",
- "deadpool",
- "futures",
- "futures-timer",
- "http-types",
- "hyper",
- "log",
- "once_cell",
- "regex",
- "serde",
- "serde_json",
- "tokio",
-]
-
- [[package]]
- name = "zeroize"
- version = "1.5.7"
-@@ -2604,25 +2360,3 @@ dependencies = [
-  "syn 1.0.100",
-  "synstructure",
- ]
-
-[[package]]
-name = "zmq"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aad98a7a617d608cd9e1127147f630d24af07c7cd95ba1533246d96cbdd76c66"
-dependencies = [
- "bitflags",
- "libc",
- "log",
- "zmq-sys",
-]
-
-[[package]]
-name = "zmq-sys"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d33a2c51dde24d5b451a2ed4b488266df221a5eaee2ee519933dc46b9a9b3648"
-dependencies = [
- "libc",
- "metadeps",
-]
--- a/SOURCES/0003-Disable-push-model-agent-driven-attestation-for-RHEL.patch
+++ b/SOURCES/0003-Disable-push-model-agent-driven-attestation-for-RHEL.patch
@ -0,0 +1,132 @@
+From 1073747b7bf00868be61d0d25e038fa48d62a6c7 Mon Sep 17 00:00:00 2001
+From: Sergio Correia <scorreia@redhat.com>
+Date: Thu, 9 Jul 2026 20:08:06 -0400
+Subject: [PATCH 3/3] Disable push model (agent-driven attestation) for RHEL 9
+
+Push mode is not yet supported in this build. Gate it off by removing
+the push model agent from the workspace build, removing push-model-only
+configuration options from the shipped agent.conf, and removing the
+Conflicts= reference to the push model systemd service.
+
+The push model crate and shared library support code remain in the tree
+as dead code for easy re-enablement later.
+
+Signed-off-by: Sergio Correia <scorreia@redhat.com>
+---
+ Cargo.toml                                |  1 -
+ dist/systemd/system/keylime_agent.service |  1 -
+ keylime-agent.conf                        | 70 -----------------------
+ 3 files changed, 72 deletions(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 95ca202..e31ca07 100644
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -3,7 +3,6 @@ members = [
+     "keylime",
+     "keylime-agent", "keylime-macros",
+     "keylime-ima-emulator",
+-    "keylime-push-model-agent",
+ ]
+ resolver = "2"
+ 
+diff --git a/dist/systemd/system/keylime_agent.service b/dist/systemd/system/keylime_agent.service
+index 562f975..479cbfb 100644
+--- a/dist/systemd/system/keylime_agent.service
+++ b/dist/systemd/system/keylime_agent.service
+@@ -11,7 +11,6 @@ After=tpm2-abrmd.service
+ # If the service should start only when hardware TPMs are available, uncomment the below lines
+ #ConditionPathExistsGlob=/dev/tpm[0-9]*
+ #ConditionPathExistsGlob=/dev/tpmrm[0-9]*
+-Conflicts=keylime_push_model_agent.service
+ 
+ [Service]
+ ExecStart=/usr/bin/keylime_agent
+diff --git a/keylime-agent.conf b/keylime-agent.conf
+index a9d8220..29d0d6d 100644
+--- a/keylime-agent.conf
+++ b/keylime-agent.conf
+@@ -396,57 +396,6 @@ ima_ml_path = "default"
+ # If set as an absolute path, it will use it without changes
+ measuredboot_ml_path = "default"
+ 
+-# Push attestation model options
+-# The interval in seconds between attestations after a successful attestation,
+-# and also used as the retry delay after a failed attestation attempt.
+-# This option is specific to the push attestation model.
+-# The default is 60 seconds.
+-#
+-# To override attestation_interval_seconds, set
+-# KEYLIME_AGENT_ATTESTATION_INTERVAL_SECONDS environment variable.
+-attestation_interval_seconds = 60
+-
+-# Verifier URL (Push Model specific).
+-# Verifier URL containing schema, host and port
+-verifier_url = "https://localhost:8881"
+-
+-# Verifier TLS CA certificate (Push Model specific)
+-# The push model agent uses TLS (server verification only) + mandatory PoP authentication.
+-# Client certificates (mTLS) are NOT used by the push model.
+-# This CA certificate is used to verify the verifier's server certificate.
+-# If set as "default", the path below is used relative to keylime_dir.
+-# If a relative path is set, it will be considered relative from the keylime_dir.
+-# If an absolute path is set, it is used without change.
+-#
+-# To override verifier_tls_ca_cert, set KEYLIME_AGENT_VERIFIER_TLS_CA_CERT environment variable.
+-verifier_tls_ca_cert = "default"      # default: cv_ca/cacert.crt
+-
+-# The API versions to use when communicating with the registrar (Push Model
+-# specific). The agent will negotiate with the registrar to select the best
+-# mutually supported version.
+-# A list of versions can be provided (e.g. "2.1, 2.3").
+-# The following keywords are also supported:
+-# - "default": Enables all supported API versions
+-# - "latest": Enables only the latest supported API version
+-#
+-# To override registrar_api_versions, set
+-# KEYLIME_AGENT_REGISTRAR_API_VERSIONS environment variable.
+-registrar_api_versions = "default"
+-
+-# The server identifier used for certification keys (Push Model specific).
+-# This identifier is used when building AK certification data.
+-#
+-# To override certification_keys_server_identifier, set
+-# KEYLIME_AGENT_CERTIFICATION_KEYS_SERVER_IDENTIFIER environment variable.
+-certification_keys_server_identifier = "ak"
+-
+-# The evidence version to use for UEFI event logs sent during attestation
+-# (Push Model specific).
+-#
+-# To override uefi_logs_evidence_version, set
+-# KEYLIME_AGENT_UEFI_LOGS_EVIDENCE_VERSION environment variable.
+-uefi_logs_evidence_version = "2.1"
+-
+ # Exponential backoff settings for retrying failed operations such as
+ # registrar registration and verifier attestation.
+ # The initial_delay is the delay in milliseconds before the first retry.
+@@ -462,22 +411,3 @@ uefi_logs_evidence_version = "2.1"
+ exponential_backoff_initial_delay = 10000
+ exponential_backoff_max_retries = 5
+ exponential_backoff_max_delay = 300000
+-
+-# TLS security options (INSECURE - for testing/debugging only)
+-# These options disable TLS verification and should NEVER be enabled in
+-# production environments.
+-#
+-# Accept invalid TLS certificates (e.g. self-signed, expired, wrong CA).
+-# WARNING: Enabling this makes the agent vulnerable to man-in-the-middle attacks.
+-#
+-# To override tls_accept_invalid_certs, set
+-# KEYLIME_AGENT_TLS_ACCEPT_INVALID_CERTS environment variable.
+-tls_accept_invalid_certs = false
+-
+-# Accept TLS certificates where the hostname does not match the certificate's
+-# subject or SAN fields.
+-# WARNING: Enabling this makes the agent vulnerable to man-in-the-middle attacks.
+-#
+-# To override tls_accept_invalid_hostnames, set
+-# KEYLIME_AGENT_TLS_ACCEPT_INVALID_HOSTNAMES environment variable.
+-tls_accept_invalid_hostnames = false
+-- 
+2.52.0
+
--- a/SOURCES/0003-rust-keylime-fix-unnecessary-qualifications.patch
+++ b/SOURCES/0003-rust-keylime-fix-unnecessary-qualifications.patch
@ -1,91 +0,0 @@
-diff --git a/keylime-agent/src/crypto.rs b/keylime-agent/src/crypto.rs
-index 8ec3449..aeebe34 100644
--- a/keylime-agent/src/crypto.rs
-+++ b/keylime-agent/src/crypto.rs
-@@ -111,7 +111,7 @@ pub(crate) fn write_key_pair(
-                 _ = file.write(&key.private_key_to_pem_pkcs8()?)?;
-             } else {
-                 _ = file.write(&key.private_key_to_pem_pkcs8_passphrase(
-                    openssl::symm::Cipher::aes_256_cbc(),
-+                    Cipher::aes_256_cbc(),
-                     pw.as_bytes(),
-                 )?)?;
-             }
-diff --git a/keylime-agent/src/errors_handler.rs b/keylime-agent/src/errors_handler.rs
-index b0fa4c2..d3722d0 100644
--- a/keylime-agent/src/errors_handler.rs
-+++ b/keylime-agent/src/errors_handler.rs
-@@ -379,7 +379,7 @@ mod tests {
-         let mut app = test::init_service(
-             App::new()
-                 .wrap(
-                    middleware::ErrorHandlers::new()
-+                    ErrorHandlers::new()
-                         .handler(http::StatusCode::NOT_FOUND, wrap_404),
-                 )
-                 .app_data(
-diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs
-index a17e3cb..beef809 100644
--- a/keylime-agent/src/main.rs
-+++ b/keylime-agent/src/main.rs
-@@ -10,7 +10,6 @@
-     overflowing_literals,
-     path_statements,
-     patterns_in_fns_without_body,
-    private_in_public,
-     unconditional_recursion,
-     unused,
-     while_true,
-diff --git a/keylime-agent/src/payloads.rs b/keylime-agent/src/payloads.rs
-index e190e3a..fc58c43 100644
--- a/keylime-agent/src/payloads.rs
-+++ b/keylime-agent/src/payloads.rs
-@@ -221,7 +221,7 @@ async fn run_encrypted_payload(
-     let action_file = unzipped.join("action_list");
- 
-     if action_file.exists() {
-        let action_data = std::fs::read_to_string(&action_file)
-+        let action_data = fs::read_to_string(&action_file)
-             .expect("unable to read action_list");
- 
-         action_data
-diff --git a/keylime-agent/src/revocation.rs b/keylime-agent/src/revocation.rs
-index 025a929..51edcea 100644
--- a/keylime-agent/src/revocation.rs
-+++ b/keylime-agent/src/revocation.rs
-@@ -203,7 +203,7 @@ fn run_revocation_actions(
-     let action_file = unzipped.join("action_list");
- 
-     if action_file.exists() {
-        action_data = std::fs::read_to_string(&action_file)
-+        action_data = fs::read_to_string(&action_file)
-             .expect("unable to read action_list");
- 
-         let file_actions = parse_list(&action_data)?;
-@@ -529,7 +529,7 @@ mod tests {
-             env!("CARGO_MANIFEST_DIR"),
-             "/tests/unzipped/test_ok.json"
-         );
-        let json_str = std::fs::read_to_string(json_file).unwrap(); //#[allow_ci]
-+        let json_str = fs::read_to_string(json_file).unwrap(); //#[allow_ci]
-         let json = serde_json::from_str(&json_str).unwrap(); //#[allow_ci]
-         let actions_dir =
-             &Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/actions/");
-@@ -568,7 +568,7 @@ mod tests {
-             env!("CARGO_MANIFEST_DIR"),
-             "/tests/unzipped/test_err.json"
-         );
-        let json_str = std::fs::read_to_string(json_file).unwrap(); //#[allow_ci]
-+        let json_str = fs::read_to_string(json_file).unwrap(); //#[allow_ci]
-         let json = serde_json::from_str(&json_str).unwrap(); //#[allow_ci]
-         let actions_dir =
-             &Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/actions/");
-@@ -603,7 +603,7 @@ mod tests {
-                 let revocation_actions = "local_action_stand_alone.py, local_action_rev_script1.py";
-             }
-         }
-        let json_str = std::fs::read_to_string(json_file).unwrap(); //#[allow_ci]
-+        let json_str = fs::read_to_string(json_file).unwrap(); //#[allow_ci]
-         let json = serde_json::from_str(&json_str).unwrap(); //#[allow_ci]
-         let actions_dir =
-             &Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/actions/");
--- a/SOURCES/0004-fix-pcr16-failure-on-upgrade-fall-back-to-mtls-key.patch
+++ b/SOURCES/0004-fix-pcr16-failure-on-upgrade-fall-back-to-mtls-key.patch
@ -0,0 +1,448 @@
+From 5b69275bd97c9c0788e6441cfb387b59b36c8a51 Mon Sep 17 00:00:00 2001
+From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
+Date: Thu, 30 Jul 2026 16:10:43 +0200
+Subject: [PATCH 1/2] Accept any RSA key size for payload encryption
+
+The payload key validation was restricted to RSA-2048, rejecting any
+other RSA key size loaded from disk. Before the key separation (commits
+2091359 and bec5d94), the agent accepted any RSA key from file without
+size validation, so users may have manually configured RSA-4096 keys
+that worked with attestation.
+
+Relax the validation to accept any RSA key of at least 2048 bits for
+backward compatibility, while still rejecting non-RSA and weak keys.
+New key generation continues to use RSA-2048.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
+---
+ keylime-agent/src/main.rs | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs
+index 280a1ac8..cf259737 100644
+--- a/keylime-agent/src/main.rs
+++ b/keylime-agent/src/main.rs
+@@ -66,7 +66,7 @@ use keylime::{
+ };
+ use log::*;
+ use openssl::{
+-    pkey::{PKey, Private, Public},
+    pkey::{Id, PKey, Private, Public},
+     x509::X509,
+ };
+ use std::{
+@@ -504,7 +504,7 @@ async fn main() -> Result<()> {
+         key_path,
+         Some(config.payload_key_password.as_ref()),
+         keylime::algorithms::EncryptionAlgorithm::Rsa2048,
+-        true, // Validate that loaded keys are RSA 2048
+        false, // Don't validate key size (accept any RSA for backward compatibility)
+     )
+     .map_err(|e| {
+         error!(
+@@ -517,6 +517,25 @@ async fn main() -> Result<()> {
+         )))
+     })?;
+ 
+    if payload_priv_key.id() != Id::RSA || payload_priv_key.bits() < 2048 {
+        error!(
+            "Payload key {} must be an RSA key of at least 2048 bits, \
+             found {:?} with {} bits",
+            key_path.display(),
+            payload_priv_key.id(),
+            payload_priv_key.bits()
+        );
+        return Err(Error::Configuration(
+            config::KeylimeConfigError::Generic(format!(
+                "Payload key {} must be an RSA key of at least 2048 \
+                 bits, found {:?} with {} bits",
+                key_path.display(),
+                payload_priv_key.id(),
+                payload_priv_key.bits()
+            )),
+        ));
+    }
+
+     // Load or generate mTLS key pair (separate from payload keys)
+     // The mTLS key is always persistent, stored at the configured path.
+     // Uses ECC P-256 by default for better security and performance
+
+From f63fbdf576a8a34200f8eb3dd2c8cfc9d41863d1 Mon Sep 17 00:00:00 2001
+From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
+Date: Thu, 30 Jul 2026 16:11:30 +0200
+Subject: [PATCH 2/2] Fix payload key upgrade regression by falling back to
+ mTLS key
+
+On upgrade from a pre-key-separation agent, the new agent generates a
+fresh payload key because payload-private.pem does not exist. This
+causes PCR 16 to be extended with the hash of the new key while the
+verifier still has the old key cached, resulting in
+pcr_validation.invalid_pcr_16.
+
+Add ensure_payload_key() that runs before load_or_generate_key(): if
+payload-private.pem is missing but server-private.pem exists and
+contains a supported RSA key (at least 2048 bits), it is copied as the
+payload key. This preserves PCR 16 consistency during rolling upgrades.
+
+If the copy fails, the agent aborts rather than continuing with a
+potentially corrupt or insecure file. If setting file permissions fails
+(IOSetPermissionError), the file is removed so the next startup retries
+the copy rather than loading a key with insecure permissions.
+
+Scenarios handled:
+- Fresh install (no key files): generates separate keys (no change)
+- Upgrade (supported RSA server key): copies to payload key with warning
+- Upgrade (ECC or weak RSA server key): skips fallback, generates new key
+- Both files already exist: no fallback logic triggers
+- Server key unreadable: logs warning, falls through to generate new key
+- Write failure: aborts execution with an actionable error message
+- Permission-set failure: removes the file and aborts; next startup retries
+
+Resolves: keylime/rust-keylime#1262
+
+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
+---
+ keylime-agent/src/main.rs | 316 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 316 insertions(+)
+
+diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs
+index cf259737..67a72e25 100644
+--- a/keylime-agent/src/main.rs
+++ b/keylime-agent/src/main.rs
+@@ -118,6 +118,118 @@ fn get_retry_config(config: &config::AgentConfig) -> RetryConfig {
+     }
+ }
+ 
+/// On upgrade from a pre-key-separation agent, the payload key file does not
+/// exist yet. If the mTLS server key is RSA, copy it as the payload key so
+/// that PCR 16 stays consistent with what the verifier has cached.
+///
+/// Returns `Ok(())` when the copy succeeds or when a copy is not needed
+/// (key already exists, server key missing, or server key is not RSA).
+/// Returns `Err` if the server key is a valid RSA key but writing the
+/// payload key file fails — continuing in that state could leave a
+/// corrupt or insecure file behind.
+fn ensure_payload_key(
+    payload_key_path: &Path,
+    payload_key_password: &str,
+    server_key_path: &Path,
+    server_key_password: &str,
+) -> std::result::Result<(), Error> {
+    if payload_key_path.exists() {
+        return Ok(());
+    }
+    if !server_key_path.exists() {
+        return Ok(());
+    }
+
+    match crypto::load_key_pair(server_key_path, Some(server_key_password)) {
+        Ok((_, priv_key))
+            if priv_key.id() == Id::RSA && priv_key.bits() >= 2048 =>
+        {
+            crypto::write_key_pair(
+                &priv_key,
+                payload_key_path,
+                Some(payload_key_password),
+            )
+            .map_err(|e| {
+                if matches!(e, crypto::CryptoError::IOSetPermissionError(_)) {
+                    // The key was written successfully but chmod failed.
+                    // Remove the file so the next startup retries the copy
+                    // rather than loading a key with insecure permissions.
+                    // The file did not exist before this call (checked above),
+                    // so removal cannot delete pre-existing user data.
+                    match fs::remove_file(payload_key_path) {
+                        Ok(()) => {
+                            error!(
+                                "Wrote mTLS key to {} but failed to set \
+                                 file permissions: {e}. The file has been \
+                                 removed; the copy will be retried on next \
+                                 startup.",
+                                payload_key_path.display()
+                            );
+                        }
+                        Err(rm_err) => {
+                            error!(
+                                "Wrote mTLS key to {} but failed to set \
+                                 file permissions: {e}. Cleanup also failed: \
+                                 {rm_err}. Remove the file manually before \
+                                 restarting the agent to prevent loading a key \
+                                 with insecure permissions.",
+                                payload_key_path.display()
+                            );
+                        }
+                    }
+                } else {
+                    error!(
+                        "Failed to write mTLS key to {}: {e}. \
+                         If a partial file was left behind, remove \
+                         it manually before restarting the agent.",
+                        payload_key_path.display()
+                    );
+                }
+                Error::Crypto(e)
+            })?;
+
+            warn!(
+                "Payload key not found; wrote mTLS key from {} to {} \
+                 for backward compatibility. The same RSA key will \
+                 be used for both mTLS and payload encryption.",
+                server_key_path.display(),
+                payload_key_path.display()
+            );
+            if !server_key_password.is_empty()
+                && payload_key_password.is_empty()
+            {
+                warn!(
+                    "The mTLS key was encrypted at rest but the \
+                     payload key copy at {} is unencrypted. To \
+                     encrypt it, re-encrypt the file manually and \
+                     set 'payload_key_password' in the agent \
+                     configuration.",
+                    payload_key_path.display()
+                );
+            }
+        }
+        Ok(_) => {
+            warn!(
+                "mTLS key {} is not a supported RSA key (at least 2048 \
+                 bits); a new RSA payload key will be generated, which \
+                 will change PCR 16 and may cause attestation failures \
+                 until the agent is re-enrolled.",
+                server_key_path.display()
+            );
+        }
+        Err(e) => {
+            warn!(
+                "Failed to load mTLS key {}: {e}. \
+                 A new payload key will be generated, which will change \
+                 PCR 16 and may cause attestation failures until the \
+                 agent is re-enrolled.",
+                server_key_path.display()
+            );
+        }
+    }
+    Ok(())
+}
+
+ // This data is passed in to the actix httpserver threads that
+ // handle quotes.
+ #[derive(Debug)]
+@@ -500,6 +612,13 @@ async fn main() -> Result<()> {
+     // by the Tenant and Cloud Verifier, respectively.
+     // The payload key is always persistent, stored at the configured path.
+     let key_path = Path::new(&config.payload_key);
+    ensure_payload_key(
+        key_path,
+        config.payload_key_password.as_ref(),
+        Path::new(&config.server_key),
+        config.server_key_password.as_ref(),
+    )?;
+
+     let (payload_pub_key, payload_priv_key) = crypto::load_or_generate_key(
+         key_path,
+         Some(config.payload_key_password.as_ref()),
+@@ -1205,4 +1324,201 @@ mod tests {
+             Some(config::DEFAULT_EXP_BACKOFF_MAX_DELAY as u64)
+         );
+     }
+
+    mod ensure_payload_key_tests {
+        use super::*;
+        use openssl::ec::{EcGroup, EcKey};
+        use openssl::nid::Nid;
+        use openssl::pkey::PKey;
+        use openssl::rsa::Rsa;
+        use tempfile::TempDir;
+
+        type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>;
+
+        fn write_rsa_key(
+            path: &Path,
+            bits: u32,
+            password: &str,
+        ) -> Result<()> {
+            let rsa = Rsa::generate(bits)?;
+            let key = PKey::from_rsa(rsa)?;
+            crypto::write_key_pair(&key, path, Some(password))?;
+            Ok(())
+        }
+
+        fn write_ec_key(path: &Path, password: &str) -> Result<()> {
+            let group = EcGroup::from_curve_name(Nid::X9_62_PRIME256V1)?;
+            let ec = EcKey::generate(&group)?;
+            let key = PKey::from_ec_key(ec)?;
+            crypto::write_key_pair(&key, path, Some(password))?;
+            Ok(())
+        }
+
+        #[test]
+        fn copies_rsa2048_server_key_as_payload_key() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 2048, "")?;
+
+            ensure_payload_key(&payload, "", &server, "")?;
+
+            assert!(payload.exists());
+            let (_, loaded) = crypto::load_key_pair(&payload, Some(""))?;
+            assert_eq!(loaded.id(), Id::RSA);
+            assert_eq!(loaded.bits(), 2048);
+            Ok(())
+        }
+
+        #[test]
+        fn copies_rsa4096_server_key_as_payload_key() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 4096, "")?;
+
+            ensure_payload_key(&payload, "", &server, "")?;
+
+            assert!(payload.exists());
+            let (_, loaded) = crypto::load_key_pair(&payload, Some(""))?;
+            assert_eq!(loaded.id(), Id::RSA);
+            assert_eq!(loaded.bits(), 4096);
+            Ok(())
+        }
+
+        #[test]
+        fn skips_when_payload_key_already_exists() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 2048, "")?;
+            write_rsa_key(&payload, 2048, "")?;
+
+            let before = fs::read(&payload)?;
+            ensure_payload_key(&payload, "", &server, "")?;
+            let after = fs::read(&payload)?;
+
+            assert_eq!(before, after);
+            Ok(())
+        }
+
+        #[test]
+        fn skips_when_no_server_key() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            ensure_payload_key(&payload, "", &server, "")?;
+
+            assert!(!payload.exists());
+            Ok(())
+        }
+
+        #[test]
+        fn skips_non_rsa_server_key() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_ec_key(&server, "")?;
+
+            ensure_payload_key(&payload, "", &server, "")?;
+
+            assert!(!payload.exists());
+            Ok(())
+        }
+
+        #[test]
+        fn skips_rsa_key_below_minimum_size() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 1024, "")?;
+
+            ensure_payload_key(&payload, "", &server, "")?;
+
+            assert!(!payload.exists());
+            Ok(())
+        }
+
+        #[test]
+        fn preserves_key_material_on_copy() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 2048, "")?;
+            let (_, original) = crypto::load_key_pair(&server, Some(""))?;
+
+            ensure_payload_key(&payload, "", &server, "")?;
+
+            let (_, copied) = crypto::load_key_pair(&payload, Some(""))?;
+            assert_eq!(
+                original.private_key_to_pem_pkcs8()?,
+                copied.private_key_to_pem_pkcs8()?,
+            );
+            Ok(())
+        }
+
+        #[test]
+        fn handles_password_mismatch_gracefully() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 2048, "server-pass")?;
+
+            ensure_payload_key(&payload, "payload-pass", &server, "wrong")?;
+
+            assert!(!payload.exists());
+            Ok(())
+        }
+
+        #[test]
+        fn copies_with_different_passwords() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            let payload = dir.path().join("payload-private.pem");
+
+            write_rsa_key(&server, 2048, "server-pass")?;
+            let (_, original) =
+                crypto::load_key_pair(&server, Some("server-pass"))?;
+
+            ensure_payload_key(
+                &payload,
+                "payload-pass",
+                &server,
+                "server-pass",
+            )?;
+
+            let (_, copied) =
+                crypto::load_key_pair(&payload, Some("payload-pass"))?;
+            assert_eq!(
+                original.private_key_to_pem_pkcs8()?,
+                copied.private_key_to_pem_pkcs8()?,
+            );
+            Ok(())
+        }
+
+        #[test]
+        fn returns_err_when_write_fails() -> Result<()> {
+            let dir = TempDir::new()?;
+            let server = dir.path().join("server-private.pem");
+            // Nonexistent parent directory forces FSCreateError in write_key_pair.
+            let payload = dir
+                .path()
+                .join("nonexistent-subdir")
+                .join("payload-private.pem");
+
+            write_rsa_key(&server, 2048, "")?;
+
+            assert!(ensure_payload_key(&payload, "", &server, "").is_err());
+            assert!(!payload.exists());
+            Ok(())
+        }
+    }
+ }
--- a/SOURCES/0004-rust-keylime-bump-tss-esapi-from-7.2.0-to-7.6.0.patch
+++ b/SOURCES/0004-rust-keylime-bump-tss-esapi-from-7.2.0-to-7.6.0.patch
@ -1,62 +0,0 @@
-From 203caa94c6d899dc71845a3cdccebd20b226d3af Mon Sep 17 00:00:00 2001
-From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
-Date: Fri, 6 Feb 2026 17:58:24 +0100
-Subject: [PATCH 4/7] Bump tss-esapi from 7.2.0 to 7.6.0
-
-The tss-esapi 7.6.0 provides the create_ek_object_2 and create_ak_2
-APIs (from rust-tss-esapi PR #546) that accept
-AsymmetricAlgorithmSelection with key size/curve info, which is
-required for ECC key support.
-
-Also bump picky-asn1-der from 0.3.1 to 0.4 and picky-asn1-x509 from
-0.6.1 to 0.12 to match the versions required by tss-esapi 7.6.0.
-
-Backported from upstream commits:
- https://github.com/keylime/rust-keylime/commit/b5c863e
- https://github.com/keylime/rust-keylime/commit/17202c6
-
---
- keylime-agent/Cargo.toml | 6 +++---
- keylime/Cargo.toml       | 2 +-
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/keylime-agent/Cargo.toml b/keylime-agent/Cargo.toml
-index db6cec7..522be45 100644
--- a/keylime-agent/Cargo.toml
-+++ b/keylime-agent/Cargo.toml
-@@ -21,8 +21,8 @@ keylime = { path = "../keylime" }
- libc = "0.2.43"
- log = "0.4"
- openssl = "0.10.15"
-picky-asn1-der = "0.3.1"
-picky-asn1-x509 = "0.6.1"
-+picky-asn1-der = "0.4"
-+picky-asn1-x509 = "0.12"
- pretty_env_logger = "0.4"
- reqwest = {version = "0.11", default-features = false, features = ["json"]}
- serde = "1.0.80"
-@@ -31,7 +31,7 @@ serde_json = { version = "1.0", features = ["raw_value"] }
- static_assertions = "1"
- tempfile = "3.4.0"
- tokio = {version = "1.24", features = ["rt", "sync", "macros"]}
-tss-esapi = {version = "7.2.0", features = ["generate-bindings"]}
-+tss-esapi = {version = "7.6.0", features = ["generate-bindings"]}
- thiserror = "1.0"
- uuid = {version = "1.3", features = ["v4"]}
- 
-diff --git a/keylime/Cargo.toml b/keylime/Cargo.toml
-index 61ad8b7..ddba447 100644
--- a/keylime/Cargo.toml
-+++ b/keylime/Cargo.toml
-@@ -16,7 +16,7 @@ serde = "1.0.80"
- serde_derive = "1.0.80"
- static_assertions = "1"
- thiserror = "1.0"
-tss-esapi = {version = "7.2.0", features = ["generate-bindings"]}
-+tss-esapi = {version = "7.6.0", features = ["generate-bindings"]}
- 
- [dev-dependencies]
- tempfile = "3.0.4"
-- 
-2.52.0
-
--- a/SOURCES/0005-rust-keylime-enable-non-standard-key-sizes-and-curve.patch
+++ b/SOURCES/0005-rust-keylime-enable-non-standard-key-sizes-and-curve.patch
@ -1,179 +0,0 @@
-From 9ba0459fab8852e073351614133cffdd7343fe94 Mon Sep 17 00:00:00 2001
-From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
-Date: Fri, 6 Feb 2026 17:58:35 +0100
-Subject: [PATCH 5/7] Enable non-standard key sizes and curves for
- EncryptionAlgorithm
-
-Replace the simple Rsa/Ecc variants with specific key sizes and curves:
- RSA: Rsa1024, Rsa2048, Rsa3072, Rsa4096
- ECC: Ecc192, Ecc224, Ecc256, Ecc384, Ecc521, EccSm2
-
-Add From<EncryptionAlgorithm> for AsymmetricAlgorithmSelection to
-support the tss-esapi 7.6.0 create_ek_object_2 and create_ak_2 APIs.
-
-For backwards compatibility, "rsa" maps to Rsa2048 and "ecc" maps to
-Ecc256 in both parsing and display.
-
-Backported from upstream commit:
- https://github.com/keylime/rust-keylime/commit/2c73a2a
-
---
- keylime/src/algorithms.rs | 109 ++++++++++++++++++++++++++++++++++----
- 1 file changed, 99 insertions(+), 10 deletions(-)
-
-diff --git a/keylime/src/algorithms.rs b/keylime/src/algorithms.rs
-index c077466..fc35006 100644
--- a/keylime/src/algorithms.rs
-+++ b/keylime/src/algorithms.rs
-@@ -6,8 +6,13 @@ use std::convert::TryFrom;
- use std::fmt;
- use thiserror::Error;
- use tss_esapi::{
-    interface_types::algorithm::{
-        AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
-+    abstraction::AsymmetricAlgorithmSelection,
-+    interface_types::{
-+        algorithm::{
-+            AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
-+        },
-+        ecc::EccCurve,
-+        key_bits::RsaKeyBits,
-     },
-     structures::{HashScheme, SignatureScheme},
- };
-@@ -87,15 +92,68 @@ impl From<HashAlgorithm> for MessageDigest {
- 
- #[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
- pub enum EncryptionAlgorithm {
-    Rsa,
-    Ecc,
-+    Rsa1024,
-+    Rsa2048,
-+    Rsa3072,
-+    Rsa4096,
-+    Ecc192,
-+    Ecc224,
-+    Ecc256,
-+    Ecc384,
-+    Ecc521,
-+    EccSm2,
- }
- 
- impl From<EncryptionAlgorithm> for AsymmetricAlgorithm {
-     fn from(enc_alg: EncryptionAlgorithm) -> Self {
-         match enc_alg {
-            EncryptionAlgorithm::Rsa => AsymmetricAlgorithm::Rsa,
-            EncryptionAlgorithm::Ecc => AsymmetricAlgorithm::Ecc,
-+            EncryptionAlgorithm::Rsa1024
-+            | EncryptionAlgorithm::Rsa2048
-+            | EncryptionAlgorithm::Rsa3072
-+            | EncryptionAlgorithm::Rsa4096 => AsymmetricAlgorithm::Rsa,
-+            EncryptionAlgorithm::Ecc192
-+            | EncryptionAlgorithm::Ecc224
-+            | EncryptionAlgorithm::Ecc256
-+            | EncryptionAlgorithm::Ecc384
-+            | EncryptionAlgorithm::Ecc521
-+            | EncryptionAlgorithm::EccSm2 => AsymmetricAlgorithm::Ecc,
-+        }
-+    }
-+}
-+
-+impl From<EncryptionAlgorithm> for AsymmetricAlgorithmSelection {
-+    fn from(enc_alg: EncryptionAlgorithm) -> Self {
-+        match enc_alg {
-+            EncryptionAlgorithm::Rsa1024 => {
-+                AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa1024)
-+            }
-+            EncryptionAlgorithm::Rsa2048 => {
-+                AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa2048)
-+            }
-+            EncryptionAlgorithm::Rsa3072 => {
-+                AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa3072)
-+            }
-+            EncryptionAlgorithm::Rsa4096 => {
-+                AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa4096)
-+            }
-+            EncryptionAlgorithm::Ecc192 => {
-+                AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP192)
-+            }
-+            EncryptionAlgorithm::Ecc224 => {
-+                AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP224)
-+            }
-+            EncryptionAlgorithm::Ecc256 => {
-+                AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP256)
-+            }
-+            EncryptionAlgorithm::Ecc384 => {
-+                AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP384)
-+            }
-+            EncryptionAlgorithm::Ecc521 => {
-+                AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP521)
-+            }
-+            EncryptionAlgorithm::EccSm2 => {
-+                AsymmetricAlgorithmSelection::Ecc(EccCurve::Sm2P256)
-+            }
-         }
-     }
- }
-@@ -105,8 +163,18 @@ impl TryFrom<&str> for EncryptionAlgorithm {
- 
-     fn try_from(value: &str) -> Result<Self, Self::Error> {
-         match value {
-            "rsa" => Ok(EncryptionAlgorithm::Rsa),
-            "ecc" => Ok(EncryptionAlgorithm::Ecc),
-+            "rsa" | "rsa2048" => Ok(EncryptionAlgorithm::Rsa2048),
-+            "rsa1024" => Ok(EncryptionAlgorithm::Rsa1024),
-+            "rsa3072" => Ok(EncryptionAlgorithm::Rsa3072),
-+            "rsa4096" => Ok(EncryptionAlgorithm::Rsa4096),
-+            "ecc" | "ecc256" | "ecc_nist_p256" => {
-+                Ok(EncryptionAlgorithm::Ecc256)
-+            }
-+            "ecc192" | "ecc_nist_p192" => Ok(EncryptionAlgorithm::Ecc192),
-+            "ecc224" | "ecc_nist_p224" => Ok(EncryptionAlgorithm::Ecc224),
-+            "ecc384" | "ecc_nist_p384" => Ok(EncryptionAlgorithm::Ecc384),
-+            "ecc521" | "ecc_nist_p521" => Ok(EncryptionAlgorithm::Ecc521),
-+            "ecc_sm2" | "ecc_sm2_p256" => Ok(EncryptionAlgorithm::EccSm2),
-             _ => Err(AlgorithmError::Encrypt(format!(
-                 "Encryption algorithm {value} not supported by Keylime"
-             ))),
-@@ -117,8 +185,16 @@ impl TryFrom<&str> for EncryptionAlgorithm {
- impl fmt::Display for EncryptionAlgorithm {
-     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-         let value = match self {
-            EncryptionAlgorithm::Rsa => "rsa",
-            EncryptionAlgorithm::Ecc => "ecc",
-+            EncryptionAlgorithm::Rsa2048 => "rsa",
-+            EncryptionAlgorithm::Rsa1024 => "rsa1024",
-+            EncryptionAlgorithm::Rsa3072 => "rsa3072",
-+            EncryptionAlgorithm::Rsa4096 => "rsa4096",
-+            EncryptionAlgorithm::Ecc256 => "ecc",
-+            EncryptionAlgorithm::Ecc192 => "ecc192",
-+            EncryptionAlgorithm::Ecc224 => "ecc224",
-+            EncryptionAlgorithm::Ecc384 => "ecc384",
-+            EncryptionAlgorithm::Ecc521 => "ecc521",
-+            EncryptionAlgorithm::EccSm2 => "ecc_sm2",
-         };
-         write!(f, "{value}")
-     }
-@@ -205,6 +281,19 @@ mod tests {
-     fn test_encrypt_try_from() {
-         let result = EncryptionAlgorithm::try_from("rsa");
-         assert!(result.is_ok());
-+        assert_eq!(result.unwrap(), EncryptionAlgorithm::Rsa2048); //#[allow_ci]
-+
-+        let result = EncryptionAlgorithm::try_from("ecc");
-+        assert!(result.is_ok());
-+        assert_eq!(result.unwrap(), EncryptionAlgorithm::Ecc256); //#[allow_ci]
-+
-+        let result = EncryptionAlgorithm::try_from("rsa4096");
-+        assert!(result.is_ok());
-+        assert_eq!(result.unwrap(), EncryptionAlgorithm::Rsa4096); //#[allow_ci]
-+
-+        let result = EncryptionAlgorithm::try_from("ecc384");
-+        assert!(result.is_ok());
-+        assert_eq!(result.unwrap(), EncryptionAlgorithm::Ecc384); //#[allow_ci]
-     }
-     #[test]
-     fn test_sign_tryfrom() {
-- 
-2.52.0
-
--- a/SOURCES/0006-rust-keylime-update-TPM-functions-for-ECC-support.patch
+++ b/SOURCES/0006-rust-keylime-update-TPM-functions-for-ECC-support.patch
@ -1,269 +0,0 @@
-From d051c8e617f50c7200722ffb4e8d32b5a638f240 Mon Sep 17 00:00:00 2001
-From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
-Date: Fri, 6 Feb 2026 01:00:00 +0100
-Subject: [PATCH 6/7] tpm: add policy auth for EK to activate crendential
-
-Backported from upstream commit:
- https://github.com/keylime/rust-keylime/commit/af32aa2
-
---
- keylime/src/tpm.rs | 168 +++++++++++++++++++++++++++++++++++++--------
- 1 file changed, 140 insertions(+), 28 deletions(-)
-
-diff --git a/keylime/src/tpm.rs b/keylime/src/tpm.rs
-index 4b83e1f..9244b03 100644
--- a/keylime/src/tpm.rs
-+++ b/keylime/src/tpm.rs
-@@ -16,11 +16,9 @@ use openssl::{
-
- use tss_esapi::{
-     abstraction::{
-        ak,
-        cipher::Cipher,
-        ek,
-+        ak, ek,
-         pcr::{read_all, PcrData},
-        DefaultKey,
-+        AsymmetricAlgorithmSelection, DefaultKey,
-     },
-     attributes::session::SessionAttributesBuilder,
-     constants::{
-@@ -30,12 +28,13 @@ use tss_esapi::{
-         AuthHandle, KeyHandle, PcrHandle, PersistentTpmHandle, TpmHandle,
-     },
-     interface_types::{
-        algorithm::HashingAlgorithm, session_handles::AuthSession,
-+        algorithm::HashingAlgorithm,
-+        session_handles::{AuthSession, PolicySession},
-     },
-     structures::{
-        Attest, AttestInfo, Digest, DigestValues, EncryptedSecret, IdObject,
-        PcrSelectionList, PcrSelectionListBuilder, PcrSlot, Signature,
-        SignatureScheme,
-+        Attest, AttestInfo, Digest, DigestList, DigestValues,
-+        EncryptedSecret, IdObject, PcrSelectionList, PcrSelectionListBuilder,
-+        PcrSlot, Signature, SignatureScheme, SymmetricDefinition,
-     },
-     tcti_ldr::TctiNameConf,
-     traits::Marshall,
-@@ -49,6 +48,59 @@ const TPML_DIGEST_SIZE: usize = std::mem::size_of::<TPML_DIGEST>();
- const TPML_PCR_SELECTION_SIZE: usize =
-     std::mem::size_of::<TPML_PCR_SELECTION>();
-
-+// Policy digest constants from TCG EK Credential Profile for TPM Family 2.0
-+// Level 0 Version 2.5 Revision 2, Section B.6
-+
-+// Policy A (PolicySecret(ENDORSEMENT)) for SHA-384
-+const POLICY_A_SHA384: [u8; 48] = [
-+    0x8b, 0xbf, 0x22, 0x66, 0x53, 0x7c, 0x17, 0x1c, 0xb5, 0x6e, 0x40, 0x3c,
-+    0x4d, 0xc1, 0xd4, 0xb6, 0x4f, 0x43, 0x26, 0x11, 0xdc, 0x38, 0x6e, 0x6f,
-+    0x53, 0x20, 0x50, 0xc3, 0x27, 0x8c, 0x93, 0x0e, 0x14, 0x3e, 0x8b, 0xb1,
-+    0x13, 0x38, 0x24, 0xcc, 0xb4, 0x31, 0x05, 0x38, 0x71, 0xc6, 0xdb, 0x53,
-+];
-+
-+// Policy A (PolicySecret(ENDORSEMENT)) for SHA-512
-+const POLICY_A_SHA512: [u8; 64] = [
-+    0x1e, 0x3b, 0x76, 0x50, 0x2c, 0x8a, 0x14, 0x25, 0xaa, 0x0b, 0x7b, 0x3f,
-+    0xc6, 0x46, 0xa1, 0xb0, 0xfa, 0xe0, 0x63, 0xb0, 0x3b, 0x53, 0x68, 0xf9,
-+    0xc4, 0xcd, 0xde, 0xca, 0xff, 0x08, 0x91, 0xdd, 0x68, 0x2b, 0xac, 0x1a,
-+    0x85, 0xd4, 0xd8, 0x32, 0xb7, 0x81, 0xea, 0x45, 0x19, 0x15, 0xde, 0x5f,
-+    0xc5, 0xbf, 0x0d, 0xc4, 0xa1, 0x91, 0x7c, 0xd4, 0x2f, 0xa0, 0x41, 0xe3,
-+    0xf9, 0x98, 0xe0, 0xee,
-+];
-+
-+// Policy A (PolicySecret(ENDORSEMENT)) for SM3-256
-+const POLICY_A_SM3_256: [u8; 32] = [
-+    0xc6, 0x7f, 0x7d, 0x35, 0xf6, 0x6f, 0x3b, 0xec, 0x13, 0xc8, 0x9f, 0xe8,
-+    0x98, 0x92, 0x1c, 0x65, 0x1b, 0x0c, 0xb5, 0xa3, 0x8a, 0x92, 0x69, 0x0a,
-+    0x62, 0xa4, 0x3c, 0x00, 0x12, 0xe4, 0xfb, 0x8b,
-+];
-+
-+// Policy C (PolicyOr(PolicyA, PolicyB)) for SHA-384
-+const POLICY_C_SHA384: [u8; 48] = [
-+    0xd6, 0x03, 0x2c, 0xe6, 0x1f, 0x2f, 0xb3, 0xc2, 0x40, 0xeb, 0x3c, 0xf6,
-+    0xa3, 0x32, 0x37, 0xef, 0x2b, 0x6a, 0x16, 0xf4, 0x29, 0x3c, 0x22, 0xb4,
-+    0x55, 0xe2, 0x61, 0xcf, 0xfd, 0x21, 0x7a, 0xd5, 0xb4, 0x94, 0x7c, 0x2d,
-+    0x73, 0xe6, 0x30, 0x05, 0xee, 0xd2, 0xdc, 0x2b, 0x35, 0x93, 0xd1, 0x65,
-+];
-+
-+// Policy C (PolicyOr(PolicyA, PolicyB)) for SHA-512
-+const POLICY_C_SHA512: [u8; 64] = [
-+    0x58, 0x9e, 0xe1, 0xe1, 0x46, 0x54, 0x47, 0x16, 0xe8, 0xde, 0xaf, 0xe6,
-+    0xdb, 0x24, 0x7b, 0x01, 0xb8, 0x1e, 0x9f, 0x9c, 0x7d, 0xd1, 0x6b, 0x81,
-+    0x4a, 0xa1, 0x59, 0x13, 0x87, 0x49, 0x10, 0x5f, 0xba, 0x53, 0x88, 0xdd,
-+    0x1d, 0xea, 0x70, 0x2f, 0x35, 0x24, 0x0c, 0x18, 0x49, 0x33, 0x12, 0x1e,
-+    0x2c, 0x61, 0xb8, 0xf5, 0x0d, 0x3e, 0xf9, 0x13, 0x93, 0xa4, 0x9a, 0x38,
-+    0xc3, 0xf7, 0x3f, 0xc8,
-+];
-+
-+// Policy C (PolicyOr(PolicyA, PolicyB)) for SM3-256
-+const POLICY_C_SM3_256: [u8; 32] = [
-+    0x2d, 0x4e, 0x81, 0x57, 0x8c, 0x35, 0x31, 0xd9, 0xbd, 0x1c, 0xdd, 0x7d,
-+    0x02, 0xba, 0x29, 0x8d, 0x56, 0x99, 0xa3, 0xe3, 0x9f, 0xc3, 0x55, 0x1b,
-+    0xfe, 0xff, 0xcf, 0x13, 0x2b, 0x49, 0xe1, 0x1d,
-+];
-+
- #[derive(Error, Debug)]
- pub enum TpmError {
-     #[error("TSS2 Error: {err:?}, kind: {kind:?}, {message}")]
-@@ -153,9 +205,9 @@ impl Context {
-         let key_handle = match handle {
-             Some(v) => {
-                 if v.is_empty() {
-                    ek::create_ek_object(
-+                    ek::create_ek_object_2(
-                         &mut self.inner,
-                        alg.into(),
-+                        Into::<AsymmetricAlgorithmSelection>::into(alg),
-                         DefaultKey,
-                     )?
-                 } else {
-@@ -168,12 +220,16 @@ impl Context {
-                         .into()
-                 }
-             }
-            None => {
-                ek::create_ek_object(&mut self.inner, alg.into(), DefaultKey)?
-            }
-+            None => ek::create_ek_object_2(
-+                &mut self.inner,
-+                Into::<AsymmetricAlgorithmSelection>::into(alg),
-+                DefaultKey,
-+            )?,
-         };
-        let cert = match ek::retrieve_ek_pubcert(&mut self.inner, alg.into())
-        {
-+        let cert = match ek::retrieve_ek_pubcert(
-+            &mut self.inner,
-+            Into::<AsymmetricAlgorithmSelection>::into(alg),
-+        ) {
-             Ok(v) => Some(v),
-             Err(_) => {
-                 warn!("No EK certificate found in TPM NVRAM");
-@@ -194,11 +250,13 @@ impl Context {
-         handle: KeyHandle,
-         hash_alg: HashAlgorithm,
-         sign_alg: SignAlgorithm,
-+        key_alg: EncryptionAlgorithm,
-     ) -> Result<AKResult> {
-        let ak = ak::create_ak(
-+        let ak = ak::create_ak_2(
-             &mut self.inner,
-             handle,
-             hash_alg.into(),
-+            Into::<AsymmetricAlgorithmSelection>::into(key_alg),
-             sign_alg.into(),
-             None,
-             DefaultKey,
-@@ -228,14 +286,16 @@ impl Context {
-     fn create_empty_session(
-         &mut self,
-         ses_type: SessionType,
-+        symmetric: SymmetricDefinition,
-+        hash_alg: HashingAlgorithm,
-     ) -> Result<AuthSession> {
-         let session = self.inner.start_auth_session(
-             None,
-             None,
-             None,
-             ses_type,
-            Cipher::aes_128_cfb().try_into()?,
-            HashingAlgorithm::Sha256,
-+            symmetric,
-+            hash_alg,
-         )?;
-         let (ses_attrs, ses_attrs_mask) = SessionAttributesBuilder::new()
-             .with_encrypt(true)
-@@ -258,12 +318,49 @@ impl Context {
-     ) -> Result<Digest> {
-         let (credential, secret) = parse_cred_and_secret(keyblob)?;
-
-        let ek_auth = self.create_empty_session(SessionType::Policy)?;
-+        // Read EK public info to determine hash and symmetric algorithms
-+        let (ek_public, _, _) = self.inner.read_public(ek)?;
-+        let ek_hash_alg = ek_public.name_hashing_algorithm();
-+        let ek_symmetric: SymmetricDefinition = ek_public
-+            .symmetric_algorithm()
-+            .map(Into::into)
-+            .unwrap_or(SymmetricDefinition::AES_128_CFB); //#[allow_ci]
-+
-+        // Build policy digests for PolicyOr (needed for ECC EKs and
-+        // non-default hash algorithms)
-+        let mut policy_digests = DigestList::new();
-+        match ek_hash_alg {
-+            HashingAlgorithm::Sha384 => {
-+                policy_digests
-+                    .add(Digest::try_from(POLICY_A_SHA384.as_slice())?)?;
-+                policy_digests
-+                    .add(Digest::try_from(POLICY_C_SHA384.as_slice())?)?;
-+            }
-+            HashingAlgorithm::Sha512 => {
-+                policy_digests
-+                    .add(Digest::try_from(POLICY_A_SHA512.as_slice())?)?;
-+                policy_digests
-+                    .add(Digest::try_from(POLICY_C_SHA512.as_slice())?)?;
-+            }
-+            HashingAlgorithm::Sm3_256 => {
-+                policy_digests
-+                    .add(Digest::try_from(POLICY_A_SM3_256.as_slice())?)?;
-+                policy_digests
-+                    .add(Digest::try_from(POLICY_C_SM3_256.as_slice())?)?;
-+            }
-+            _ => {}
-+        }
-+
-+        let ek_auth = self.create_empty_session(
-+            SessionType::Policy,
-+            ek_symmetric,
-+            ek_hash_alg,
-+        )?;
-
-         // We authorize ses2 with PolicySecret(ENDORSEMENT) as per PolicyA
-         let _ = self.inner.execute_with_nullauth_session(|context| {
-             context.policy_secret(
-                ek_auth.try_into()?,
-+                PolicySession::try_from(ek_auth)?,
-                 AuthHandle::Endorsement,
-                 Default::default(),
-                 Default::default(),
-@@ -272,14 +369,29 @@ impl Context {
-             )
-         })?;
-
-        self.inner
-            .execute_with_sessions(
-                (Some(AuthSession::Password), Some(ek_auth), None),
-                |context| {
-                    context.activate_credential(ak, ek, credential, secret)
-                },
-            )
-            .map_err(TpmError::from)
-+        // Apply PolicyOr if needed (for ECC EKs and non-default hash algs)
-+        // PolicyOR does not require authorization; use
-+        // execute_without_session to ensure no extra sessions with
-+        // encrypt/decrypt attributes are passed to Esys_PolicyOR.
-+        if !policy_digests.is_empty() {
-+            self.inner.execute_without_session(|ctx| {
-+                ctx.policy_or(
-+                    PolicySession::try_from(ek_auth)?,
-+                    policy_digests.clone(),
-+                )
-+            })?;
-+        }
-+
-+        let result = self.inner.execute_with_sessions(
-+            (Some(AuthSession::Password), Some(ek_auth), None),
-+            |context| {
-+                context.activate_credential(ak, ek, credential, secret)
-+            },
-+        )?;
-+
-+        self.inner.clear_sessions();
-+
-+        Ok(result)
-     }
-
-     // This function extends Pcr16 with the digest, then creates a PcrList
--
-2.52.0
-
--- a/SOURCES/0007-rust-keylime-pass-encryption-algorithm-to-create_ak.patch
+++ b/SOURCES/0007-rust-keylime-pass-encryption-algorithm-to-create_ak.patch
@ -1,54 +0,0 @@
-From 05a0c158a3d9ec1179a0b4539c28f048d1be5724 Mon Sep 17 00:00:00 2001
-From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
-Date: Fri, 6 Feb 2026 01:00:00 +0100
-Subject: [PATCH 7/7] Pass encryption_alg to create AK
-
---
- keylime-agent/src/common.rs | 1 +
- keylime-agent/src/main.rs   | 4 +++-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/keylime-agent/src/common.rs b/keylime-agent/src/common.rs
-index 226bed3..a5f9975 100644
--- a/keylime-agent/src/common.rs
-+++ b/keylime-agent/src/common.rs
-@@ -333,6 +333,7 @@ mod tests {
-             ek_result.key_handle,
-             tpm_hash_alg,
-             tpm_signing_alg,
-+            tpm_encryption_alg,
-         )?;
-
-         let agent_data_test = AgentData::create(
-diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs
-index beef809..35c0c52 100644
--- a/keylime-agent/src/main.rs
-+++ b/keylime-agent/src/main.rs
-@@ -363,6 +363,7 @@ async fn main() -> Result<()> {
-                 ek_result.key_handle,
-                 tpm_hash_alg,
-                 tpm_signing_alg,
-+                tpm_encryption_alg,
-             )?;
-             let ak_handle = ctx.load_ak(ek_result.key_handle, &new_ak)?;
-             (ak_handle, new_ak)
-@@ -848,6 +849,7 @@ mod testing {
-                 ek_result.key_handle,
-                 tpm_hash_alg,
-                 tpm_signing_alg,
-+                tpm_encryption_alg,
-             )?;
-             let ak_handle = ctx.load_ak(ek_result.key_handle, &ak_result)?;
-             let ak_tpm2b_pub =
-@@ -914,7 +916,7 @@ mod testing {
-                 payload_tx,
-                 revocation_tx,
-                 hash_alg: keylime::algorithms::HashAlgorithm::Sha256,
-                enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa,
-+                enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa2048,
-                 sign_alg: keylime::algorithms::SignAlgorithm::RsaSsa,
-                 agent_uuid: test_config.agent.uuid,
-                 allow_payload_revocation_actions: test_config
--
-2.52.0
-
--- a/SOURCES/0008-rust-keylime-bump-pretty-env-logger.patch
+++ b/SOURCES/0008-rust-keylime-bump-pretty-env-logger.patch
@ -1,13 +0,0 @@
-diff --git a/keylime-agent/Cargo.toml b/keylime-agent/Cargo.toml
-index 522be45..f77cf6c 100644
--- a/keylime-agent/Cargo.toml
-+++ b/keylime-agent/Cargo.toml
-@@ -23,7 +23,7 @@ log = "0.4"
- openssl = "0.10.15"
- picky-asn1-der = "0.4"
- picky-asn1-x509 = "0.12"
-pretty_env_logger = "0.4"
-+pretty_env_logger = "0.5"
- reqwest = {version = "0.11", default-features = false, features = ["json"]}
- serde = "1.0.80"
- serde_derive = "1.0.80"
--- a/SPECS/keylime-agent-rust.spec
+++ b/SPECS/keylime-agent-rust.spec
@ -9,8 +9,8 @@
 %global bundled_rust_deps 1

 Name:           keylime-agent-rust
-Version:        0.2.2
-Release:        5%{?dist}
+Version:        0.2.10
+Release:        2%{?dist}
 Summary:        Rust agent for Keylime

 # Upstream license specification: Apache-2.0
@ -44,34 +44,23 @@ Source0:        %{url}/archive/refs/tags/v%{version}.tar.gz
 #       --platform aarch64-unknown-linux-gnu \
 #       --platform i686-unknown-linux-gnu \
 #       --platform s390x-unknown-linux-gnu \
-#       --exclude-crate-path "libloading#tests"
-#   tar jcf rust-keylime-%%{version}-vendor.tar.xz vendor
-Source1:        rust-keylime-%{version}-vendor.tar.xz
-# Drop dependencies and adjust the features
-Patch0:         0001-rust-keylime-adjust-features.patch
-# Update openssl to version 0.10.70 to fix CVE-2025-24898
-Patch1:         0002-rust-keylime-openssl-0.10.70.patch
-# Fix unnecessary qualification warnings
-Patch2:         0003-rust-keylime-fix-unnecessary-qualifications.patch
-# Bump tss-esapi from 7.2.0 to 7.6.0 for ECC key support
-# Backported from upstream commits
-# https://github.com/keylime/rust-keylime/commit/b5c863e
-# https://github.com/keylime/rust-keylime/commit/17202c6
-Patch3:         0004-rust-keylime-bump-tss-esapi-from-7.2.0-to-7.6.0.patch
-# Enable non-standard key sizes and curves for EncryptionAlgorithm
-# Backported from upstream commits
-# https://github.com/keylime/rust-keylime/commit/2c73a2a
-Patch4:         0005-rust-keylime-enable-non-standard-key-sizes-and-curve.patch
-# Update TPM functions for ECC support (EK/AK creation, credential activation)
-# Backported from upstream commits
-# https://github.com/keylime/rust-keylime/commit/af32aa2
-Patch5:         0006-rust-keylime-update-TPM-functions-for-ECC-support.patch
-# Pass encryption algorithm to create_ak
-Patch6:         0007-rust-keylime-pass-encryption-algorithm-to-create_ak.patch
-# Bump pretty-env-logger to version 0.5
-# Backported from upstream commit:
-# https://github.com/keylime/rust-keylime/commit/fbe6a03
-Patch7:         0008-rust-keylime-bump-pretty-env-logger.patch
+#       --exclude-crate-path "libloading#tests" \
+#       --prefix=vendor --format=tar.zstd
+#   cp vendor.tar.zstd ../rust-keylime-%%{version}-vendor.tar.zstd
+Source1:        rust-keylime-%{version}-vendor.tar.zstd
+
+# Drop completely the legacy-python-actions feature
+# Downstream-only: Drop completely the legacy-python-actions feature
+Patch:         0001-rust-keylime-metadata.patch
+# Do not require /usr/libexec/keylime to be present
+# Downstream-only: Do not require /usr/libexec/keylime to be present
+Patch:         0002-rust-keylime-do-not-require-usr-libexec.patch
+# Push model is not supported in RHEL 9.
+# Downstream-only: disable push model in RHEL 9.
+Patch: 0003-Disable-push-model-agent-driven-attestation-for-RHEL.patch
+# RHEL-213679 - Fix PCR 16 attestation failure when upgrading from pre-key-separation agent
+# Backport: https://github.com/keylime/rust-keylime/pull/1263
+Patch: 0004-fix-pcr16-failure-on-upgrade-fall-back-to-mtls-key.patch

 ExclusiveArch:  %{rust_arches}

@ -96,46 +85,52 @@ Provides:       keylime-agent
 Conflicts:      keylime-agent

 Provides: bundled(crate(actix-codec)) = 0.5.2
-Provides: bundled(crate(actix-http)) = 3.11.2
+Provides: bundled(crate(actix-http)) = 3.12.1
 Provides: bundled(crate(actix-macros)) = 0.2.4
-Provides: bundled(crate(actix-router)) = 0.5.3
+Provides: bundled(crate(actix-router)) = 0.5.4
 Provides: bundled(crate(actix-rt)) = 2.11.0
 Provides: bundled(crate(actix-server)) = 2.6.0
 Provides: bundled(crate(actix-service)) = 2.0.3
 Provides: bundled(crate(actix-tls)) = 3.5.0
 Provides: bundled(crate(actix-utils)) = 3.0.1
-Provides: bundled(crate(actix-web)) = 4.12.1
+Provides: bundled(crate(actix-web)) = 4.13.0
 Provides: bundled(crate(actix-web-codegen)) = 4.3.0
+Provides: bundled(crate(adler2)) = 2.0.1
 Provides: bundled(crate(aho-corasick)) = 1.1.4
-Provides: bundled(crate(anstream)) = 0.6.21
-Provides: bundled(crate(anstyle)) = 1.0.13
-Provides: bundled(crate(anstyle-parse)) = 0.2.7
+Provides: bundled(crate(anstream)) = 1.0.0
+Provides: bundled(crate(anstyle)) = 1.0.14
+Provides: bundled(crate(anstyle-parse)) = 1.0.0
 Provides: bundled(crate(anstyle-query)) = 1.1.5
+Provides: bundled(crate(anyhow)) = 1.0.102
 Provides: bundled(crate(async-trait)) = 0.1.89
+Provides: bundled(crate(atomic-waker)) = 1.1.2
 Provides: bundled(crate(autocfg)) = 1.5.0
-Provides: bundled(crate(base64)) = 0.21.7
-Provides: bundled(crate(bindgen)) = 0.66.1
-Provides: bundled(crate(bitfield)) = 0.14.0
-Provides: bundled(crate(bitflags)) = 2.10.0
+Provides: bundled(crate(base64)) = 0.22.1
+Provides: bundled(crate(bindgen)) = 0.72.1
+Provides: bundled(crate(bitfield)) = 0.19.4
+Provides: bundled(crate(bitfield-macros)) = 0.19.4
+Provides: bundled(crate(bitflags)) = 2.11.1
 Provides: bundled(crate(block-buffer)) = 0.10.4
+Provides: bundled(crate(byteorder)) = 1.5.0
 Provides: bundled(crate(bytes)) = 1.11.1
-Provides: bundled(crate(bytestring)) = 1.5.0
-Provides: bundled(crate(cc)) = 1.2.55
+Provides: bundled(crate(bytestring)) = 1.5.1
+Provides: bundled(crate(cc)) = 1.2.61
 Provides: bundled(crate(cexpr)) = 0.6.0
 Provides: bundled(crate(cfg-if)) = 1.0.4
+Provides: bundled(crate(chacha20)) = 0.10.0
+Provides: bundled(crate(chrono)) = 0.4.44
 Provides: bundled(crate(clang-sys)) = 1.8.1
-Provides: bundled(crate(clap)) = 4.5.57
-Provides: bundled(crate(clap_builder)) = 4.5.57
-Provides: bundled(crate(clap_derive)) = 4.5.55
-Provides: bundled(crate(clap_lex)) = 0.7.7
-Provides: bundled(crate(colorchoice)) = 1.0.4
-Provides: bundled(crate(compress-tools)) = 0.12.4
+Provides: bundled(crate(clap)) = 4.6.1
+Provides: bundled(crate(clap_builder)) = 4.6.0
+Provides: bundled(crate(clap_derive)) = 4.6.1
+Provides: bundled(crate(clap_lex)) = 1.1.0
+Provides: bundled(crate(colorchoice)) = 1.0.5
 Provides: bundled(crate(config)) = 0.13.4
 Provides: bundled(crate(convert_case)) = 0.10.0
 Provides: bundled(crate(cpufeatures)) = 0.2.17
+Provides: bundled(crate(crc32fast)) = 1.5.0
 Provides: bundled(crate(crypto-common)) = 0.1.7
-Provides: bundled(crate(deranged)) = 0.5.6
-Provides: bundled(crate(derive_more)) = 0.99.20
+Provides: bundled(crate(deranged)) = 0.5.8
 Provides: bundled(crate(derive_more)) = 2.1.1
 Provides: bundled(crate(derive_more-impl)) = 2.1.1
 Provides: bundled(crate(digest)) = 0.10.7
@ -147,185 +142,202 @@ Provides: bundled(crate(enumflags2_derive)) = 0.7.12
 Provides: bundled(crate(env_logger)) = 0.10.2
 Provides: bundled(crate(equivalent)) = 1.0.2
 Provides: bundled(crate(errno)) = 0.3.14
-Provides: bundled(crate(fastrand)) = 2.3.0
+Provides: bundled(crate(fastrand)) = 2.4.1
 Provides: bundled(crate(find-msvc-tools)) = 0.1.9
+Provides: bundled(crate(flate2)) = 1.1.9
 Provides: bundled(crate(fnv)) = 1.0.7
 Provides: bundled(crate(foldhash)) = 0.1.5
 Provides: bundled(crate(foreign-types)) = 0.3.2
 Provides: bundled(crate(foreign-types-shared)) = 0.1.1
 Provides: bundled(crate(form_urlencoded)) = 1.2.2
-Provides: bundled(crate(futures)) = 0.3.31
-Provides: bundled(crate(futures-channel)) = 0.3.31
-Provides: bundled(crate(futures-core)) = 0.3.31
-Provides: bundled(crate(futures-executor)) = 0.3.31
-Provides: bundled(crate(futures-io)) = 0.3.31
-Provides: bundled(crate(futures-macro)) = 0.3.31
-Provides: bundled(crate(futures-sink)) = 0.3.31
-Provides: bundled(crate(futures-task)) = 0.3.31
-Provides: bundled(crate(futures-util)) = 0.3.31
+Provides: bundled(crate(futures)) = 0.3.32
+Provides: bundled(crate(futures-channel)) = 0.3.32
+Provides: bundled(crate(futures-core)) = 0.3.32
+Provides: bundled(crate(futures-executor)) = 0.3.32
+Provides: bundled(crate(futures-io)) = 0.3.32
+Provides: bundled(crate(futures-macro)) = 0.3.32
+Provides: bundled(crate(futures-sink)) = 0.3.32
+Provides: bundled(crate(futures-task)) = 0.3.32
+Provides: bundled(crate(futures-util)) = 0.3.32
 Provides: bundled(crate(generic-array)) = 0.14.7
-Provides: bundled(crate(getrandom)) = 0.2.17
 Provides: bundled(crate(getrandom)) = 0.3.4
-Provides: bundled(crate(getrandom)) = 0.4.1
+Provides: bundled(crate(getrandom)) = 0.4.2
 Provides: bundled(crate(glob)) = 0.3.3
 Provides: bundled(crate(h2)) = 0.3.27
-Provides: bundled(crate(hashbrown)) = 0.16.1
+Provides: bundled(crate(hashbrown)) = 0.17.0
 Provides: bundled(crate(heck)) = 0.5.0
 Provides: bundled(crate(hex)) = 0.4.3
-Provides: bundled(crate(home)) = 0.5.12
 Provides: bundled(crate(hostname-validator)) = 1.1.1
 Provides: bundled(crate(http)) = 0.2.12
-Provides: bundled(crate(http-body)) = 0.4.6
+Provides: bundled(crate(http)) = 1.4.2
+Provides: bundled(crate(http-body)) = 1.0.1
+Provides: bundled(crate(http-body-util)) = 0.1.3
 Provides: bundled(crate(httparse)) = 1.10.1
 Provides: bundled(crate(httpdate)) = 1.0.3
 Provides: bundled(crate(humantime)) = 2.3.0
-Provides: bundled(crate(hyper)) = 0.14.32
-Provides: bundled(crate(icu_collections)) = 2.1.1
-Provides: bundled(crate(icu_locale_core)) = 2.1.1
-Provides: bundled(crate(icu_normalizer)) = 2.1.1
-Provides: bundled(crate(icu_normalizer_data)) = 2.1.1
-Provides: bundled(crate(icu_properties)) = 2.1.2
-Provides: bundled(crate(icu_properties_data)) = 2.1.2
-Provides: bundled(crate(icu_provider)) = 2.1.1
+Provides: bundled(crate(hyper)) = 1.9.0
+Provides: bundled(crate(hyper-tls)) = 0.6.0
+Provides: bundled(crate(hyper-util)) = 0.1.20
+Provides: bundled(crate(iana-time-zone)) = 0.1.65
+Provides: bundled(crate(icu_collections)) = 2.2.0
+Provides: bundled(crate(icu_locale_core)) = 2.2.0
+Provides: bundled(crate(icu_normalizer)) = 2.2.0
+Provides: bundled(crate(icu_normalizer_data)) = 2.2.0
+Provides: bundled(crate(icu_properties)) = 2.2.0
+Provides: bundled(crate(icu_properties_data)) = 2.2.0
+Provides: bundled(crate(icu_provider)) = 2.2.0
 Provides: bundled(crate(idna)) = 1.1.0
-Provides: bundled(crate(idna_adapter)) = 1.2.1
+Provides: bundled(crate(idna_adapter)) = 1.2.2
 Provides: bundled(crate(impl-more)) = 0.1.9
-Provides: bundled(crate(indexmap)) = 2.13.0
-Provides: bundled(crate(ipnet)) = 2.11.0
+Provides: bundled(crate(indexmap)) = 2.14.0
+Provides: bundled(crate(ipnet)) = 2.12.0
 Provides: bundled(crate(is-terminal)) = 0.4.17
 Provides: bundled(crate(is_terminal_polyfill)) = 1.70.2
-Provides: bundled(crate(itoa)) = 1.0.17
+Provides: bundled(crate(itertools)) = 0.13.0
+Provides: bundled(crate(itoa)) = 1.0.18
 Provides: bundled(crate(language-tags)) = 0.3.2
 Provides: bundled(crate(lazy_static)) = 1.5.0
-Provides: bundled(crate(lazycell)) = 1.3.0
-Provides: bundled(crate(libc)) = 0.2.181
+Provides: bundled(crate(libc)) = 0.2.186
 Provides: bundled(crate(libloading)) = 0.8.9
-Provides: bundled(crate(linux-raw-sys)) = 0.4.15
-Provides: bundled(crate(linux-raw-sys)) = 0.11.0
-Provides: bundled(crate(litemap)) = 0.8.1
+Provides: bundled(crate(linux-raw-sys)) = 0.12.1
+Provides: bundled(crate(litemap)) = 0.8.2
 Provides: bundled(crate(local-waker)) = 0.1.4
 Provides: bundled(crate(lock_api)) = 0.4.14
-Provides: bundled(crate(log)) = 0.4.29
+Provides: bundled(crate(log)) = 0.4.32
 Provides: bundled(crate(mbox)) = 0.7.1
 Provides: bundled(crate(memchr)) = 2.8.0
 Provides: bundled(crate(mime)) = 0.3.17
 Provides: bundled(crate(minimal-lexical)) = 0.2.1
-Provides: bundled(crate(mio)) = 1.1.1
+Provides: bundled(crate(miniz_oxide)) = 0.8.9
+Provides: bundled(crate(mio)) = 1.2.0
+Provides: bundled(crate(native-tls)) = 0.2.18
 Provides: bundled(crate(nom)) = 7.1.3
-Provides: bundled(crate(num-conv)) = 0.2.0
+Provides: bundled(crate(num-conv)) = 0.2.1
 Provides: bundled(crate(num-derive)) = 0.4.2
 Provides: bundled(crate(num-traits)) = 0.2.19
 Provides: bundled(crate(oid)) = 0.2.1
-Provides: bundled(crate(once_cell)) = 1.21.3
-Provides: bundled(crate(openssl)) = 0.10.75
+Provides: bundled(crate(once_cell)) = 1.21.4
+Provides: bundled(crate(openssl)) = 0.10.81
 Provides: bundled(crate(openssl-macros)) = 0.1.1
-Provides: bundled(crate(openssl-sys)) = 0.9.111
+Provides: bundled(crate(openssl-probe)) = 0.2.1
+Provides: bundled(crate(openssl-sys)) = 0.9.117
 Provides: bundled(crate(parking_lot)) = 0.12.5
 Provides: bundled(crate(parking_lot_core)) = 0.9.12
 Provides: bundled(crate(pathdiff)) = 0.2.3
-Provides: bundled(crate(peeking_take_while)) = 0.1.2
 Provides: bundled(crate(percent-encoding)) = 2.3.2
 Provides: bundled(crate(pest)) = 2.8.6
 Provides: bundled(crate(pest_derive)) = 2.8.6
 Provides: bundled(crate(pest_generator)) = 2.8.6
 Provides: bundled(crate(pest_meta)) = 2.8.6
-Provides: bundled(crate(picky-asn1)) = 0.8.0
-Provides: bundled(crate(picky-asn1-der)) = 0.4.1
-Provides: bundled(crate(picky-asn1-x509)) = 0.12.0
-Provides: bundled(crate(pin-project-lite)) = 0.2.16
-Provides: bundled(crate(pin-utils)) = 0.1.0
-Provides: bundled(crate(pkg-config)) = 0.3.32
-Provides: bundled(crate(potential_utf)) = 0.1.4
+Provides: bundled(crate(picky-asn1)) = 0.10.1
+Provides: bundled(crate(picky-asn1-der)) = 0.5.6
+Provides: bundled(crate(picky-asn1-x509)) = 0.15.4
+Provides: bundled(crate(pin-project-lite)) = 0.2.17
+Provides: bundled(crate(pkg-config)) = 0.3.33
+Provides: bundled(crate(potential_utf)) = 0.1.5
 Provides: bundled(crate(powerfmt)) = 0.2.0
+Provides: bundled(crate(ppv-lite86)) = 0.2.21
 Provides: bundled(crate(pretty_env_logger)) = 0.5.0
 Provides: bundled(crate(prettyplease)) = 0.2.37
 Provides: bundled(crate(proc-macro2)) = 1.0.106
-Provides: bundled(crate(quote)) = 1.0.44
+Provides: bundled(crate(quote)) = 1.0.45
+Provides: bundled(crate(rand)) = 0.10.1
+Provides: bundled(crate(rand)) = 0.9.4
+Provides: bundled(crate(rand_chacha)) = 0.9.0
+Provides: bundled(crate(rand_core)) = 0.10.1
+Provides: bundled(crate(rand_core)) = 0.9.5
 Provides: bundled(crate(regex)) = 1.12.3
 Provides: bundled(crate(regex-automata)) = 0.4.14
 Provides: bundled(crate(regex-lite)) = 0.1.9
-Provides: bundled(crate(regex-syntax)) = 0.8.9
-Provides: bundled(crate(reqwest)) = 0.11.27
-Provides: bundled(crate(rustc-hash)) = 1.1.0
+Provides: bundled(crate(regex-syntax)) = 0.8.10
+Provides: bundled(crate(reqwest)) = 0.13.3
+Provides: bundled(crate(reqwest-middleware)) = 0.5.2
+Provides: bundled(crate(reqwest-retry)) = 0.9.1
+Provides: bundled(crate(retry-policies)) = 0.5.2
+Provides: bundled(crate(rustc-hash)) = 2.1.2
 Provides: bundled(crate(rustc_version)) = 0.4.1
-Provides: bundled(crate(rustix)) = 0.38.44
-Provides: bundled(crate(rustix)) = 1.1.3
+Provides: bundled(crate(rustix)) = 1.1.4
+Provides: bundled(crate(rustls-pki-types)) = 1.14.1
 Provides: bundled(crate(ryu)) = 1.0.23
 Provides: bundled(crate(scopeguard)) = 1.2.0
-Provides: bundled(crate(semver)) = 1.0.27
+Provides: bundled(crate(semver)) = 1.0.28
 Provides: bundled(crate(serde)) = 1.0.228
 Provides: bundled(crate(serde_bytes)) = 0.11.19
 Provides: bundled(crate(serde_core)) = 1.0.228
 Provides: bundled(crate(serde_derive)) = 1.0.228
-Provides: bundled(crate(serde_json)) = 1.0.149
+Provides: bundled(crate(serde_json)) = 1.0.150
 Provides: bundled(crate(serde_urlencoded)) = 0.7.1
 Provides: bundled(crate(sha2)) = 0.10.9
 Provides: bundled(crate(shlex)) = 1.3.0
 Provides: bundled(crate(signal-hook)) = 0.3.18
 Provides: bundled(crate(signal-hook-registry)) = 1.4.8
+Provides: bundled(crate(simd-adler32)) = 0.3.9
 Provides: bundled(crate(slab)) = 0.4.12
 Provides: bundled(crate(smallvec)) = 1.15.1
 Provides: bundled(crate(socket2)) = 0.5.10
-Provides: bundled(crate(socket2)) = 0.6.2
+Provides: bundled(crate(socket2)) = 0.6.3
 Provides: bundled(crate(stable_deref_trait)) = 1.2.1
 Provides: bundled(crate(static_assertions)) = 1.1.0
 Provides: bundled(crate(strsim)) = 0.11.1
-Provides: bundled(crate(syn)) = 2.0.114
-Provides: bundled(crate(sync_wrapper)) = 0.1.2
+Provides: bundled(crate(syn)) = 2.0.118
+Provides: bundled(crate(sync_wrapper)) = 1.0.2
 Provides: bundled(crate(synstructure)) = 0.13.2
 Provides: bundled(crate(target-lexicon)) = 0.12.16
-Provides: bundled(crate(tempfile)) = 3.25.0
+Provides: bundled(crate(tempfile)) = 3.27.0
 Provides: bundled(crate(termcolor)) = 1.4.1
-Provides: bundled(crate(thiserror)) = 1.0.69
-Provides: bundled(crate(thiserror-impl)) = 1.0.69
+Provides: bundled(crate(thiserror)) = 2.0.18
+Provides: bundled(crate(thiserror-impl)) = 2.0.18
 Provides: bundled(crate(time)) = 0.3.47
 Provides: bundled(crate(time-core)) = 0.1.8
-Provides: bundled(crate(time-macros)) = 0.2.27
-Provides: bundled(crate(tinystr)) = 0.8.2
-Provides: bundled(crate(tokio)) = 1.49.0
-Provides: bundled(crate(tokio-macros)) = 2.6.0
+Provides: bundled(crate(tinystr)) = 0.8.3
+Provides: bundled(crate(tokio)) = 1.52.2
+Provides: bundled(crate(tokio-macros)) = 2.7.0
+Provides: bundled(crate(tokio-native-tls)) = 0.3.1
 Provides: bundled(crate(tokio-openssl)) = 0.6.5
 Provides: bundled(crate(tokio-util)) = 0.7.18
 Provides: bundled(crate(toml)) = 0.5.11
+Provides: bundled(crate(tower)) = 0.5.3
+Provides: bundled(crate(tower-http)) = 0.6.9
+Provides: bundled(crate(tower-layer)) = 0.3.3
 Provides: bundled(crate(tower-service)) = 0.3.3
 Provides: bundled(crate(tracing)) = 0.1.44
 Provides: bundled(crate(tracing-attributes)) = 0.1.31
 Provides: bundled(crate(tracing-core)) = 0.1.36
 Provides: bundled(crate(try-lock)) = 0.2.5
-Provides: bundled(crate(tss-esapi)) = 7.6.0
-Provides: bundled(crate(tss-esapi-sys)) = 0.5.0
-Provides: bundled(crate(typenum)) = 1.19.0
+Provides: bundled(crate(tss-esapi)) = 7.7.0
+Provides: bundled(crate(tss-esapi-sys)) = 0.6.0
+Provides: bundled(crate(typenum)) = 1.20.0
 Provides: bundled(crate(ucd-trie)) = 0.1.7
-Provides: bundled(crate(unicode-ident)) = 1.0.23
-Provides: bundled(crate(unicode-segmentation)) = 1.12.0
+Provides: bundled(crate(unicode-ident)) = 1.0.24
+Provides: bundled(crate(unicode-segmentation)) = 1.13.2
 Provides: bundled(crate(unicode-xid)) = 0.2.6
 Provides: bundled(crate(url)) = 2.5.8
 Provides: bundled(crate(utf8_iter)) = 1.0.4
 Provides: bundled(crate(utf8parse)) = 0.2.2
-Provides: bundled(crate(uuid)) = 1.20.0
+Provides: bundled(crate(uuid)) = 1.23.4
 Provides: bundled(crate(vcpkg)) = 0.2.15
 Provides: bundled(crate(version_check)) = 0.9.5
 Provides: bundled(crate(want)) = 0.3.1
-Provides: bundled(crate(which)) = 4.4.2
-Provides: bundled(crate(writeable)) = 0.6.2
-Provides: bundled(crate(yoke)) = 0.8.1
-Provides: bundled(crate(yoke-derive)) = 0.8.1
-Provides: bundled(crate(zerofrom)) = 0.1.6
-Provides: bundled(crate(zerofrom-derive)) = 0.1.6
+Provides: bundled(crate(writeable)) = 0.6.3
+Provides: bundled(crate(yoke)) = 0.8.2
+Provides: bundled(crate(yoke-derive)) = 0.8.2
+Provides: bundled(crate(zerocopy)) = 0.8.48
+Provides: bundled(crate(zerofrom)) = 0.1.7
+Provides: bundled(crate(zerofrom-derive)) = 0.1.7
 Provides: bundled(crate(zeroize)) = 1.8.2
 Provides: bundled(crate(zeroize_derive)) = 1.4.3
-Provides: bundled(crate(zerotrie)) = 0.2.3
-Provides: bundled(crate(zerovec)) = 0.11.5
-Provides: bundled(crate(zerovec-derive)) = 0.11.2
-Provides: bundled(crate(zmij)) = 1.0.20
+Provides: bundled(crate(zerotrie)) = 0.2.4
+Provides: bundled(crate(zerovec)) = 0.11.6
+Provides: bundled(crate(zerovec-derive)) = 0.11.3
+Provides: bundled(crate(zip)) = 0.6.6
+Provides: bundled(crate(zmij)) = 1.0.21

 %description
 Rust agent for Keylime

 %prep
-%autosetup -S git -N -n rust-keylime-%{version} -a1
+%autosetup -S git -n rust-keylime-%{version} -a1
 %cargo_prep -V 1
-%autopatch -p1

 # Sometimes Rust sources start with #![...] attributes, and "smart" editors think
 # it's a shebang and make them executable. Then brp-mangle-shebangs gets upset...
@ -396,6 +408,18 @@ chown -R keylime:keylime %{_sysconfdir}/keylime
 %endif

 %changelog
+* Fri Jul 31 2026 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 0.2.10-2
+- Fix PCR 16 attestation failure when upgrading from pre-key-separation agent
+- Resolves: RHEL-213679
+
+* Thu Jul 09 2026 Sergio Correia <scorreia@redhat.com> - 0.2.10-1
+- Update to upstream release 0.2.10
+- Resolves: RHEL-180619
+
+* Wed May 13 2026 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 0.2.2-6
+- Bump tss-esapi to version 7.7.0 to fix build with clang 22
+  Resolves: RHEL-170940
+
 * Wed Feb 11 2026 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 0.2.2-5
 - Enable attestation with TPM ECC keys
  Resolves: RHEL-118148