TamaGo is a bare-metal Go framework that enables running Go programs directly on hardware without an operating system or C runtime. It provides a modified Go runtime (GOOS=tamago) and a comprehensive set of drivers for ARM, ARM64, AMD64, RISC-V, and LoongArch architectures, covering SoCs from NXP, Raspberry Pi, SiFive, Microchip, Nuvoton, and others. The framework includes low-level initialization, exception handling, MMU, cache control, timers, interrupt controllers (GIC, LAPIC), and peripheral drivers for UART, I2C, SPI, USB device, Ethernet (ENET, gVNIC), SD/MMC, DMA, and cryptographic accelerators (CAAM, DCP). It also supports confidential computing features like AMD SEV-SNP and ARM TrustZone, as well as KVM paravirtualization with VirtIO and pvclock. The architecture is library-based: the `cmd/tamago` tool manages a custom Go distribution, while the runtime hooks (ramStart, printk, nanotime) are linked into Go via `go:linkname` from board and SoC packages. Each board package provides initialization functions that configure pin muxing, clocks, and peripherals. The code is production-grade, used in real projects like GoKey (smartcard), GoTEE (TEE), and ArmoredWitness. The repo is actively maintained, with a large number of supported platforms and a focus on security and minimal attack surface.
fhevm is a production-grade, full-stack confidential smart contract platform that brings Fully Homomorphic Encryption (FHE) to EVM-compatible blockchains. The system is a distributed microservices architecture: on-chain Solidity contracts (host-contracts for ACL, FHEVMExecutor, KMSVerifier, InputVerifier, ProtocolConfig, and gateway-contracts for decryption/input verification) handle encrypted state and access control, while a suite of Rust services (coprocessor/fhevm-engine with host-listener, gw-listener, tfhe-worker, sns-worker, transaction-sender, zkproof-worker, scheduler) perform off-chain FHE computation, ZK proof verification, and transaction submission. A relayer service exposes HTTP v2/v3 endpoints for public/user/delegated decryption with EIP-712 typed-data attestations, and a KMS connector manages threshold key generation and decryption. The TypeScript SDK (ethers and viem adapters) provides client-side encryption, decryption, and proof generation with WASM-based TFHE/TKMS modules, plus a CLI and load-testing toolkit. Cross-chain bridging via LayerZero V2 is included for confidential token transfers.
PySyft is a privacy-preserving data science platform that enables data owners to share private datasets and approve code execution without exposing raw data. The codebase is a monorepo with multiple interdependent packages: `syft` (sync engine, peer management, encryption), `syft-rds` (high-level remote data science client for datasets and jobs), `syft-job` (job lifecycle, runner, disclosures), `syft-datasets` (dataset storage with versioned protocol codecs), `syft-enclave` (confidential computing with TEE attestation via Confidential Spaces or Tinfoil, signed receipts), `syft-bg` (background services for auto-approval, email notifications, systemd management, TUI), `syft-permissions` (declarative ACL engine), `syft-restrict` (static code verification and obfuscation for private regions), `syft-migration` (generic versioned migration framework for objects), `syft-notebook-ui` (rich HTML representation for Jupyter), and `syft-perms` (file-level permission browser). The core workflow: data scientists submit Python jobs encapsulating analysis code → data owners approve (manually or automatically) → jobs run in sandboxed environments or TEE enclaves → results and logs are staged and released according to multi-party disclosure policies. The system uses Google Drive as the default sync transport with offline-first P2P file exchange, protocol versioning for backward compatibility, and cryptographic key pinning for trust.
Kata Containers is an open-source secure container runtime that runs each container inside a lightweight virtual machine (microVM), providing strong workload isolation while maintaining container-like performance and orchestration. The project provides a containerd shim-v2 implementation, a guest-side agent, and supports multiple hypervisors including QEMU, Cloud Hypervisor, Firecracker, and its own built-in VMM (Dragonball). It integrates deeply with Kubernetes (runtime classes, CSI, mutating webhooks, policy generation via Rego) and supports confidential computing features (TDX, SEV-SNP, IBM Secure Execution, ARM CCA). The codebase is dual-language: the primary runtime is written in Go, with a newer Rust rewrite (runtime-rs) that shares core libraries with the agent and Dragonball VMM. The project is actively maintained with extensive CI, multi-architecture support, and a large ecosystem of tools (agent-ctl, kata-ctl, log-parser, trace-forwarder, genpolicy). While the architecture is modular and many components (e.g., safe-path, dbs-allocator, retry library) are independently reusable, the coexistence of two runtime implementations, generated API clients, and architecture-specific code introduce some technical drift and maintenance overhead.