latchset/clevis

Health v2 · maintenance only

Adoption not part of the score

1246 stars · 124 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Clevis is a pluggable framework for automated encryption and decryption, producing JWE ciphertexts that can be decrypted without user interaction. It supports pins such as Tang servers and TPM1/TPM2 chips, and is commonly used for automated unlocking of LUKS disk encryption volumes.

Use cases

• automatically unlock LUKS encrypted disks at boot
• encrypt data so it decrypts without user interaction
• bind encryption keys to a TPM chip
• use a Tang server for network-bound encryption without escrow
• encrypt secrets into JWE objects from the command line
• set up automated decryption for headless servers

When to choose

• you need unattended unlocking of LUKS volumes on Linux
• you want key binding to TPM hardware or a Tang server
• you need a scriptable CLI for automated encryption/decryption

When to avoid

• you need interactive, password-based encryption for end users
• you need a cross-platform GUI encryption tool
• you are not on Linux or lack TPM/Tang infrastructure

Facets

cli-tool · maturity active

cryptography security cli plugin-system security privacy developer-tools cli luks disk-encryption jwe tpm tang automated-decryption network-bound-disk-encryption command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="latchset/clevis")