tdxutils

tdxutils parses TDX event logs and quotes and invokes TDX guest quote and RTMR-extend operations.

Build

The CLI supports two native-linking modes, selected automatically by the target's C environment. Both compile the vendored DCAP sources in native/; they differ only in how the resulting attestation library is linked.

GNU (dynamic)

On a GNU target the device-enabled CLI compiles the vendored Intel DCAP sources in native/ into libtdx_attest.so.1, stages it beside the binary, and links against it dynamically:

cargo build --release -p tdxutils

The build embeds a relative runpath ($ORIGIN) so the staged libtdx_attest.so.1 is found at runtime without setting LD_LIBRARY_PATH.

musl (fully static)

On a musl target the build compiles the vendored Intel DCAP sources in native/ into a static libtdx_attest.a and links it in, producing a single standalone binary with no shared-library dependencies:

rustup target add x86_64-unknown-linux-musl
cargo build --release -p tdxutils --target x86_64-unknown-linux-musl

This needs a musl C compiler (x86_64-linux-musl-gcc or musl-gcc, overridable with TARGET_CC). Static linking only changes packaging: quote and extend still require a TDX guest with /dev/tdx_guest and a reachable Quote Generation Service, while eventlog and parse run anywhere.

Offline only

For event-log and quote parsing without any TDX attestation library, build without device commands:

cargo build --release -p tdxutils --no-default-features

Commands

Print every event-log entry, its raw data, and the replayed RTMR values. The input defaults to /sys/firmware/acpi/tables/data/CCEL; pass a file or - for stdin to override it. Input files may contain raw CCEL bytes or Base64-encoded CCEL data.

tdxutils eventlog
tdxutils eventlog eventlog.bin

Extend RTMR 2 with an existing 48-byte SHA-384 digest:

tdxutils extend 2 <96-hex-characters>

Generate a quote, encoded as Base64 text. Report data defaults to 64 zero bytes and may contain at most 64 bytes when provided. Without --output the Base64 quote is printed to stdout:

tdxutils quote --output quote.b64
tdxutils quote --report-data <hex> > quote.b64

Parse a quote from a file or stdin. The input may be raw quote bytes or the Base64 text produced by quote. The JSON contains only the quote header, body, and typed certification data:

tdxutils parse quote.b64
tdxutils parse - < quote.b64