Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
This library provides a polyfill/shim for the IndexedDB API, implementing IndexedDB functionality using WebSQL as a backend storage mechanism. It works in both browser environments (leveraging native WebSQL where available) and Node.js (via websql-configurable/SQLite3). The library offers both invasive (automatically setting global indexedDB) and non-invasive (requiring explicit setup) versions. It implements the full IndexedDB specification including databases, object stores, indexes, transactions, and cursors, with proper handling of JavaScript value serialization through a structured cloning algorithm. The project features comprehensive test suites validating W3C compliance and active maintenance with regular updates to address compatibility issues and specification changes.
Trussed is a no_std Rust library and framework for building cryptographic firmware on microcontrollers. It implements a client-service syscall architecture: applications use strongly-typed client traits such as CryptoClient, FilesystemClient, and CertificateClient to send Request enums through an interchange channel; Service::process dispatches requests to pluggable mechanism implementations or custom backends, persists keys and files across three littlefs2 filesystems (internal, external, volatile), and returns Reply enums. It is not a standalone application or CLI but an embedded component used by firmware runners such as Solo 2 and Nitrokey 3.
Themis is a cross-platform cryptographic library developed by Cossack Labs, providing high-level security primitives such as Secure Cell (symmetric encryption with three modes: Seal, Token Protect, Context Imprint), Secure Message (asymmetric encryption and digital signing), Secure Session (mutual authentication and key exchange), Secure Comparator (zero-knowledge password comparison), and key generation (EC, RSA, symmetric). The core is implemented in C with a cryptographic engine abstraction layer (Soter) that supports OpenSSL, BoringSSL, and a custom Ed25519 implementation. The library exposes consistent APIs across 13+ language wrappers including Python, Go, Rust, Java, Swift, Objective-C, JavaScript (Node.js and WebAssembly), PHP, Ruby, C++, and React Native. The codebase is well-structured with extensive unit, integration, and fuzz testing, CI/CD pipelines for each wrapper, and cross-language compatibility tests. While the repository has deprecated older APIs and maintains multiple backends, it remains actively maintained with regular releases, security patches, and community engagement.
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.
Fireproof is a local-first, real-time document database with CRDT-based conflict resolution, end-to-end encryption, and multi-platform support (browser, Node.js, Deno, Cloudflare Workers). The monorepo contains the core database engine (`@fireproof/core`), a cloud sync backend (Hono + Durable Objects), a dashboard web application for tenant/ledger management, a CLI tool for build and DevOps tasks, and a React hooks library (`use-fireproof`). The architecture is modular with clear separation between storage gateways (IndexedDB, filesystem, memory, cloud), key management (KeyBag with fingerprinting), device identity (X.509-like PKI), and protocol layers (WebSocket/HTTP message dispatch). The codebase exhibits strong engineering practices including extensive TypeScript usage, comprehensive testing (though some tests are skipped or known to fail), and reusable patterns like the Gateway interceptor, Result type, and Evento command pipeline. However, complexity is high due to multiple runtime targets and active refactoring between versions, and there are known critical bugs (e.g., remote sync not triggering subscriptions in React hooks).
This repository provides a fully automated, one-command deployment of a self-hosted Supabase stack. The setup script (`setup.sh`) orchestrates the entire process: it installs dependencies, clones the repository, generates cryptographic secrets and JWT tokens, configures environment variables, and layers optional docker-compose overrides for Authelia 2FA, Nginx or Caddy reverse proxy, and SSL via Let's Encrypt. The architecture is a Docker Compose multi-service deployment including Supabase Studio, Kong API gateway, GoTrue auth, PostgREST, Realtime, Storage, Edge Functions, and a custom Postgres image. The code is production-grade with robust error handling, CI/CD pipelines (GitHub Actions) that test every configuration matrix (caddy/nginx, basic auth/authelia/redis), and comprehensive integration tests covering CRUD operations, storage, realtime subscriptions, and edge functions. The repository also includes advanced utilities for key management (asymmetric JWTs, opaque API keys) and a sophisticated Postgres 15-to-17 upgrade script (`upgrade-pg17.sh`) that handles binary extraction, pg_upgrade, and post-migration patches. While primarily a deployment tool, the scripts demonstrate high craftsmanship and are safely reusable as templates for similar self-hosting scenarios.
pyUmbral is a Python implementation of the Umbral threshold proxy re-encryption scheme. It enables delegating decryption rights for encrypted data through a process where a data owner (Alice) generates re-encryption key fragments that semi-trusted proxies (Ursulas) use to transform ciphertexts, allowing a delegatee (Bob) to decrypt using his private key when a threshold of proxies participate. The library provides core cryptographic primitives including key generation, encryption, decryption, key fragment generation, re-encryption, and verification mechanisms built on elliptic curve cryptography.
APIMyLlama is a Node.js application that serves as a proxy and management layer for the Ollama API. It provides an endpoint (/generate) to interact with LLMs using API keys, which are managed via a command-line interface. The application includes features such as API key generation, validation, rate limiting, webhook notifications, and dynamic configuration of server port and Ollama URL. The architecture is monolithic, leveraging Express for HTTP handling, SQLite for persistence, and a custom CLI for administrative tasks. Key components include rate limiting middleware and a webhook notification system, which demonstrate common patterns in API management. However, the project suffers from dependency issues where the version constraints for axios and express are set to versions (>=1.13.5 and >=5.2.1) that are not currently available, preventing installation with the latest stable packages. This indicates a lack of maintenance in terms of dependency updates, despite recent commits.