{"id":51920615,"url":"https://github.com/moss-piglet/mosskeys-cli","last_synced_at":"2026-07-27T17:30:44.809Z","repository":{"id":371594431,"uuid":"1301867033","full_name":"moss-piglet/mosskeys-cli","owner":"moss-piglet","description":"The mosskeys CLI and daemon: publish public keys and sign transparency-log checkpoints locally (BYOK). Zero-knowledge, post-quantum. Rust.","archived":false,"fork":false,"pushed_at":"2026-07-25T23:06:17.000Z","size":265,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-25T23:20:21.993Z","etag":null,"topics":["byok","cli","cryptography","key-transparency","open-source","post-quantum","privacy","rust","transparency-log","zero-knowledge"],"latest_commit_sha":null,"homepage":"https://mosskeys.com","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moss-piglet.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":["moss-piglet"]}},"created_at":"2026-07-15T17:13:39.000Z","updated_at":"2026-07-25T23:05:27.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/moss-piglet/mosskeys-cli","commit_stats":null,"previous_names":["moss-piglet/mosskeys-cli"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/moss-piglet/mosskeys-cli","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moss-piglet%2Fmosskeys-cli","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moss-piglet%2Fmosskeys-cli/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moss-piglet%2Fmosskeys-cli/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moss-piglet%2Fmosskeys-cli/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moss-piglet","download_url":"https://codeload.github.com/moss-piglet/mosskeys-cli/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moss-piglet%2Fmosskeys-cli/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35960005,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-27T02:00:06.776Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["byok","cli","cryptography","key-transparency","open-source","post-quantum","privacy","rust","transparency-log","zero-knowledge"],"created_at":"2026-07-27T17:30:44.288Z","updated_at":"2026-07-27T17:30:44.798Z","avatar_url":"https://github.com/moss-piglet.png","language":"Rust","funding_links":["https://github.com/sponsors/moss-piglet"],"categories":[],"sub_categories":[],"readme":"# mosskeys-cli\n\nThe [mosskeys](https://mosskeys.com) command-line interface and daemon.\n\nPublish public key material to a namespace's transparency log, sign checkpoints\n**locally** (BYOK), and **verify** key-history proofs read-only and offline\nagainst the public API. Written in Rust, it links the `metamorphic-log` and\n`metamorphic-crypto` core natively, so it ships as a single static binary and\nshares one audited crypto stack with the web (WASM) and Elixir (NIF) surfaces.\n\n\u003e **Zero-knowledge security profile.** The CLI transmits only already-public\n\u003e material and client-signed checkpoint notes. The checkpoint signing key is\n\u003e read locally, used locally, and never logged or sent to the server. The server\n\u003e only ever verifies (Option C).\n\nThe package name is `mosskeys-cli`; the command it installs is `mosskeys`.\n\n## Install\n\n```sh\ncargo install mosskeys-cli --locked   # installs the `mosskeys` binary\n```\n\nUse `--locked` so the build uses the versions pinned in the published\n`Cargo.lock`. The crypto core depends on pre-release RustCrypto curve crates,\nand a fresh resolve without `--locked` can pick an incompatible newer\ntransitive release. Prebuilt binaries (below) are already built and are\nunaffected.\n\nOn macOS, Homebrew installs the same prebuilt, signed binary from a tap:\n\n```sh\nbrew install moss-piglet/mosskeys-cli/mosskeys-cli\n```\n\nThe fully-qualified name trusts and installs just that formula (Homebrew 6+\nrequires explicit trust for third-party taps).\n\nPrebuilt, signed binaries for macOS (arm64/x64), Linux (x64/arm64, including\nmusl), and Windows (x64) are attached to every\n[GitHub Release](https://github.com/moss-piglet/mosskeys-cli/releases), each with\na CycloneDX SBOM, `SHA512SUMS`, a cosign signature, and SLSA build provenance.\nSee [RELEASING.md](RELEASING.md) to verify a download.\n\n## Layout\n\n```\ncrates/\n  mosskeys-core/   # write + read/verify API client, config, typed errors, local BYOK signing (reusable SDK crate)\n  mosskeys-cli/    # the `mosskeys` binary: clap commands, brand theme, output\n```\n\n## Commands\n\n| Command | Purpose |\n|---|---|\n| `mosskeys keygen` | Generate a `mosskeys/key-history/v1` key set **locally** (BYOK). Writes the private halves to a `0600` file (refuses to overwrite) and prints only the public halves. Byte-for-byte interoperable with the browser and Mix reference implementations. |\n| `mosskeys publish` | Append one or many public-key entries (flags, `--file`, or stdin JSON). Idempotent. |\n| `mosskeys sync` | Daemon: watch a JSON source and continuously publish. At-least-once via server dedup, with backoff and retry. |\n| `mosskeys checkpoint` | Two-phase local BYOK signing: fetch head, sign offline (dual-line note: hybrid PQ + classical Ed25519 `0x01`, so stock C2SP witnesses can verify and cosign), publish (server verifies and head-matches). `--watch` runs it on a cadence. |\n| `mosskeys verify` | Read-only, offline-capable proof checking (no token). Verifies inclusion, append-only consistency, and witness co-signatures for a `--label` (online), a pinned `--checkpoint` note (offline), or a `--digest` at `--index` (supply-chain). Zero new crypto: every check runs through the same `metamorphic-log` verifier. |\n| `mosskeys config …` | Manage credentials and defaults (`~/.config/mosskeys/config.toml`, `MOSSKEYS_TOKEN` and `MOSSKEYS_BASE_URL` env). |\n\nGlobal flags: `--json` (machine output for agents and scripts), `--namespace/-n`,\n`--base-url`, `--config`, plus per-command `--dry-run`. Stable exit codes map the\nAPI error taxonomy (`unauthorized`, `forbidden`, `not_found`, `head_mismatch`,\n`invalid_request`, `rate_limited`) plus the `verify` outcomes (a failed\nconsistency proof shares `head_mismatch`; other verification failures use a\ndedicated code). Colour honours `NO_COLOR`, non-TTY, and `--json`.\n\n## Quickstart\n\n```sh\n# 1. Generate your identity's key set locally (keys never leave this machine).\n#    The private halves land in mosskeys-\u003cslug\u003e-\u003clabel\u003e-private-keys.json (0600).\nmosskeys keygen --namespace acme --security-level cat5 --label alice@acme.com\n\n# 2. Publish the PUBLIC halves printed above to your namespace's log.\nmosskeys publish --namespace acme --label alice@acme.com \\\n  --enc-x25519 \u003cbase64\u003e --enc-pq \u003cbase64\u003e --signing-pub \u003cbase64\u003e\n\n# 3. Anyone can verify that label's key history — no token, no account.\nmosskeys verify --namespace acme --label alice@acme.com\n```\n\n`keygen` is fully offline and never contacts the server, so `--security-level`\nis operator-supplied. Match it to your namespace's declared policy.\n\n`verify` proves that, in an append-only log, the history you are shown has not\nbeen rewritten (inclusion + consistency + witness co-signatures). Pin trusted\nkeys with `--verifier-key` to check co-signatures, and a prior `--checkpoint`\nnote with `--pin` to prove append-only continuity. It does **not**, on its own,\ndetect a split view (the log serving a different head to someone else); that\nneeds independent witnesses observing the same head.\n\n## Build and test\n\n```sh\ncargo build --release        # target/release/mosskeys (single static binary)\ncargo test                   # hermetic signing e2e + contract unit tests\ncargo clippy --all-targets\n```\n\nThe signing e2e tests generate a real hybrid keypair via `metamorphic-crypto`\nand verify a CLI-signed note through the same `metamorphic-log` verifier the\nserver uses, proving verify-success and head-mismatch semantics without a live\nserver. The verify e2e tests exercise the read-path checks end to end against\nreal Merkle trees and keys (inclusion, append-only consistency, witness\nco-signatures, an independent-witness count, offline pinned-checkpoint\ncontinuity, and the tamper/wrong-key failure paths). The keygen tests feed\nCLI-generated public keys through the same `metamorphic-log` `key_history_v1`\nleaf and canonical-bytes path the server runs, cross-check the per-level byte\nlengths, and assert that private halves never appear in the transmitted\nenvelope.\n\n## Local development\n\nThe `metamorphic-log` and `metamorphic-crypto` deps resolve to sibling working\ntrees (`../metamorphic-log`, `../metamorphic-crypto`) via a `[patch.crates-io]`\noverride in the workspace `Cargo.toml`, so both members share one crypto core.\nCI and release builds resolve from crates.io instead. See\n[RELEASING.md](RELEASING.md#sibling-crates-and-patchcrates-io-dev-vs-release).\n\n## License\n\nDual-licensed under [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE) at your\noption.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoss-piglet%2Fmosskeys-cli","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoss-piglet%2Fmosskeys-cli","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoss-piglet%2Fmosskeys-cli/lists"}