cohere-ai/trustee

cohere-ai/trustee

Description: Attestation and Secret Delivery Components

License: Apache-2.0

Stars: 0

Forks: 0

Open issues: 1

Created: 2026-09-09T20:49:24Z

Pushed: 2026-09-09T21:32:35Z

Default branch: cohere

Fork: yes

Parent repository: confidential-containers/trustee

Archived: no

README:

Trusted Components for Attestation and Secret Management

  

This repository contains tools and components for attesting confidential guests and providing secrets to them. Collectively, these components are known as Trustee. Trustee typically operates on behalf of the guest owner and interact remotely with guest components.

Trustee was developed for the Confidential Containers project, but can be used with a wide variety of applications and hardware platforms.

Components

• [Key Broker Service](kbs)

The KBS is a server that facilitates remote attestation and secret delivery. Its role is similar to that of the Relying Party in the RATS model.

• [Attestation Service](attestation-service)

The AS verifies TEE evidence. In the RATS model this is a Verifier

• [Reference Value Provider Service](rvps)

The RVPS manages reference values used to verify TEE evidence. This is related to the discussion in section 7.5 of the RATS document.

• [KBS Client Tool](tools/kbs-client/)

This is a simple tool which can be used to test or configure the KBS and AS.

For further information, see documentation of individual components.

Architecture

Trustee is flexible and can be deployed in several different configurations. This figure shows one common way to deploy these components in conjunction with certain guest components.

flowchart LR
AA -- attests guest ----> KBS
CDH -- requests resource --> KBS
subgraph Guest
CDH AA
end
subgraph Trustee
AS -- verifies evidence --> KBS
RVPS -- provides reference values--> AS
end
client-tool -- configures --> KBS

Development

Please go [here](DEVELOPMENT.md).

Deployment

Helm Chart

The recommended way to deploy Trustee is the [Helm chart](deployment/helm-chart/README.md), which installs the KBS, AS, and RVPS on Kubernetes.

Docker Compose

One simple way to get started with Trustee is with Docker compose, which can be used to quickly setup a cluster matching the diagram above.

Please refer to the [cluster setup guide](kbs/docs/cluster.md).

This cluster could be run inside a VM or as part of a managed service.

Other Kubernetes Options

Trustee can also be deployed via the KBS Operator, or with the KBS' provided Kubernetes tooling [here](kbs/config/kubernetes).

License