March 2026 monthly summary for google/go-tpm-tools focused on delivering business value through robust cross-language features, security hardening, and reliable go-rust integration. Highlights include cross-component key claims retrieval via FFI bridges, automated Rust dependency builds for Go integration tests, HKDF security improvements, and standardized cross-language error handling across Go, Rust, and C.

February 2026: KeyManager work in google/go-tpm-tools delivered foundational cryptography core, secure in-RAM storage, HPKE/DHKEM primitives, robust FFI interfaces, lifecycle management, and launcher integration. This set of changes establishes a secure cryptographic foundation and enables confidential compute workflows, with careful attention to memory safety, zeroization, and RFC-compliant crypto flows. Highlights include a common crate with shared data structures and proto bindings, a memfd-backed Vault for key material, HPKE/DHKEM primitives backed by BoringSSL, comprehensive FFI surfaces for key generation and management, and end-to-end integration into the Confidential Space launcher via a feature toggle.