[ANN] Pyrite: Hardware-bound binary execution and anti-tamper sealing for Crystal

Community
1

Hello! 0/

Check out Pyrite (v0.1.0), a new shard designed to ensure your compiled Crystal binaries only execute on authorized infrastructure.

If a binary is stolen, leaked, extracted from a container, or tampered with by even 1 byte, execution halts immediately before any secrets or application logic are exposed in memory.

Why Pyrite?

In many production deployments, secrets sit in plaintext .env files, environment variables, or config files on disk. Furthermore, once an ELF binary is built and distributed, nothing prevents someone from running it offline on an unauthorized machine or altering its machine code.

Pyrite solves this with envelope encryption bound to hardware or cloud trust anchors:

  1. Build Time (pyrite seal / pyrite build): The binary is compiled and stripped (strip --strip-all), its canonical SHA-256 hash is computed, and your runtime configuration is sealed into an encrypted envelope (bootstrap.enc) locked to a Cloud KMS key or physical TPM 2.0 PCR state.
  2. Runtime (Pyrite.bootstrap!): At boot, the application computes the live SHA-256 digest of its /proc/self/exe in 16KB streaming buffers, verifies it in constant time against the decrypted envelope, and deserializes the configuration into a strongly typed struct. If tampering or an unauthorized host is detected, it raises Pyrite::TamperError / Pyrite::HardwareAuthError and aborts instantly.

Quick Example

require "pyrite"

struct AppConfig
  include JSON::Serializable
  getter database_url : String
  getter api_secret_key : String
end

# Single-call bootstrap with hardware/cloud verification:
config = Pyrite.bootstrap!(AppConfig, envelope_path: "bootstrap.enc")

puts "Running verified binary with DB: #{config.database_url}"

To see it in action, run make demo in the repository (or check out examples/demo).

Key Highlights

  • :high_voltage: Zero Runtime Dependencies: Built strictly on the Crystal Standard Library (http/client, json, digest/sha256, openssl, crypto/subtle, base64, process).
  • :locked: Supported Trust Anchors:
    • Google Cloud Run / GCE: Instance metadata OIDC token + Cloud KMS Decrypt API.
    • Bare-Metal Linux / Fedora: systemd-creds + TPM 2.0 PCR sealing in $CREDENTIALS_DIRECTORY.
    • Direct TPM 2.0: Native /dev/tpmrm0 hardware unseal via tpm2-tools.
    • AWS KMS: Task IAM role decryption for ECS / Lambda.
  • :shield: Zero-Trust Fail-Closed: No runtime backdoors, ambient file bypasses, or dev overrides in the binary. Test suites use clean dependency injection (Pyrite::Provider).
  • :toolbox: Companion CLI: bin/pyrite for automated LLVM compilation, symbol stripping, and envelope sealing.

Links & Resources

Feedback, questions, and critique are very welcome!

1 Like