https://github.com/maxlambrecht/rust-spiffe
A collection of crates for SPIFFE workload identity, Workload API clients, SPIRE-specific APIs, and TLS integration.
https://github.com/maxlambrecht/rust-spiffe
authentication mtls rust security spiffe spire tls workload-identity
Last synced: about 1 month ago
JSON representation
A collection of crates for SPIFFE workload identity, Workload API clients, SPIRE-specific APIs, and TLS integration.
- Host: GitHub
- URL: https://github.com/maxlambrecht/rust-spiffe
- Owner: maxlambrecht
- License: apache-2.0
- Created: 2021-01-10T13:48:37.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2026-05-08T20:07:44.000Z (about 1 month ago)
- Last Synced: 2026-05-08T22:42:01.468Z (about 1 month ago)
- Topics: authentication, mtls, rust, security, spiffe, spire, tls, workload-identity
- Language: Rust
- Homepage: https://github.com/maxlambrecht/rust-spiffe/blob/main/README.md
- Size: 1020 KB
- Stars: 35
- Watchers: 2
- Forks: 19
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Security: SECURITY.md
- Maintainers: MAINTAINERS.md
Awesome Lists containing this project
- awesome-spiffe-spire - rust-spiffe
README
# SPIFFE Libraries
[](https://github.com/maxlambrecht/rust-spiffe/actions/workflows/ci.yml?query=branch%3Amain)
[](https://coveralls.io/github/maxlambrecht/rust-spiffe?branch=main)
[](https://crates.io/crates/spiffe)
[](https://crates.io/crates/spiffe-rustls)
[](https://crates.io/crates/spiffe-rustls-tokio)
[](https://crates.io/crates/spire-api)
[](https://www.bestpractices.dev/projects/11801)
[](LICENSE)
[](https://github.com/rust-secure-code/safety-dance)
A collection of crates for SPIFFE workload identity, Workload API clients, SPIRE-specific APIs, and TLS integration.
---
## Project Scope and Goals
These crates provide standards-compliant building blocks for integrating
SPIFFE and SPIRE into Rust applications.
The project focuses on:
- Correctness and clarity of APIs
- Alignment with SPIFFE specifications
- Conservative security-oriented design
- Explicit dependency and feature management
This repository does **not** claim formal security audits or guaranteed production fitness. Users
should evaluate suitability based on their own requirements and threat models.
---
## Available Crates
These crates can be used independently or layered together, depending on the level of
abstraction required.
### [`spiffe`](./spiffe)
Standards-aligned SPIFFE identity primitives and clients for the **SPIFFE Workload API**.
**Use this crate if you need:**
- X.509 and JWT SVID handling
- Trust bundle management
- Streaming identity updates
- Strongly typed SPIFFE identifiers and trust domains
See the [spiffe README](./spiffe/README.md) for usage and API documentation.
---
### [`spire-api`](./spire-api)
Rust bindings for **SPIRE-specific gRPC APIs** that are not part of the SPIFFE standards.
**Use this crate if you need:**
- The SPIRE Delegated Identity API
- Direct interaction with SPIRE agent or server extensions
See the [spire-api README](./spire-api/README.md) for details.
---
### [`spiffe-rustls`](./spiffe-rustls)
Integration between SPIFFE identities and [`rustls`](https://crates.io/crates/rustls).
**Use this crate if you need:**
- Mutual TLS (mTLS) using SPIFFE identities
- Automatic handling of SVID and trust bundle rotation
- TLS-level peer authorization based on SPIFFE IDs
See the [spiffe-rustls README](./spiffe-rustls/README.md) for configuration and examples.
---
### [`spiffe-rustls-tokio`](./spiffe-rustls-tokio)
Tokio-native async accept/connect helpers for `spiffe-rustls` configurations.
**Use this crate if you need:**
- Async TLS connections with Tokio
- Automatic peer SPIFFE ID extraction from TLS connections
- `TlsAcceptor` and `TlsConnector` APIs
See the [spiffe-rustls-tokio README](./spiffe-rustls-tokio/README.md) for usage and examples.
---
## Choosing a Crate
Most users will interact with one or more of the following:
- **SPIFFE identities or Workload API access** → `spiffe`
- **SPIRE gRPC APIs** → `spire-api`
- **mTLS with SPIFFE over rustls** → `spiffe-rustls`
- **Tokio async TLS with SPIFFE** → `spiffe-rustls-tokio`
---
## Contributing
Contributions are welcome. Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
### Development Setup
```bash
# Clone the repository
git clone https://github.com/maxlambrecht/rust-spiffe.git
cd rust-spiffe
# Quick check (formatting + linting + build, no tests)
make check
# Full test suite (formatting + linting + build + tests)
make all
# Run full CI checks locally (includes MSRV verification)
make ci
# Run integration tests (requires SPIRE setup)
make integration-tests
```
See `make help` for all available targets.
### Reporting Issues
Please file bugs and feature requests via
[GitHub Issues](https://github.com/maxlambrecht/rust-spiffe/issues).
### Security
For security-related issues, please follow the disclosure process described in
[SECURITY.md](SECURITY.md).
---
## License
Licensed under the Apache License, Version 2.0.
See [LICENSE](./LICENSE) for details.