Editions¶

Etminan ships in two editions built from one codebase, selected at compile time by the Cargo feature enterprise. The free build and the feature-off path are byte-for-byte the legacy behaviour — Enterprise strictly adds capability, it never changes what Standard does.

Standard is free of charge — not open source

The Standard edition is free of charge and self-hosted. It is not open source and not "open core": the source repository is private. Free of charge, yes; open, no.

What each edition is¶

Standard — free of charge, self-hosted. The complete core attestation engine: TPM 2.0 + IMA quotes, the verifier's replay-and-compare trust decision, enrollment with AK/EK/TLS pinning, baseline review and drift, the hash-chained audit log with external anchor, notifications, plugins, and change-source correlation. Standard also includes the default access-control model: the etminan-verifierd trust daemon, the peer-UID authenticated op operator interface, the admin / operator / viewer roles with host-group scope, and optional per-role TOTP — RBAC is a Standard feature, not an Enterprise one.
Enterprise — a build with --features enterprise. Adds SIEM output (CEF/LEEF over syslog) and dual control (four-eyes approval). The Enterprise-only subcommand dual-control is absent from a Standard binary entirely.

A separate optional console feature builds the Ratatui TUI operator console; it is default-off in shipped binaries (to keep them musl/macOS-clean) and is orthogonal to the edition split.

Capability matrix¶

Capability	Standard	Enterprise
TPM 2.0 + IMA attestation (agent quote + verifier replay/compare)	✅	✅
Enrollment, AK/EK/TLS pinning, `rotate-tls` / `rotate-ak`	✅	✅
Baseline review, approve/reject/exclude/annotate, drift	✅	✅
Hash-chained signed audit log + external anchor	✅	✅
`etminan-verifierd` trust daemon + peer-UID `op` interface	✅	✅
RBAC: `admin` / `operator` / `viewer` roles + host-group scope	✅	✅
Optional per-role TOTP second factor	✅	✅
Notifications (email, Slack, PagerDuty, webhook plugins)	✅	✅
Certified plugin catalog + change-source correlation	✅	✅
Mandatory mutual TLS transport	✅	✅
SIEM output (CEF / LEEF over syslog)	—	✅
Dual control / four-eyes (`dual-control`, baseline-approve, M-of-N)	—	✅

Legend: ✅ available · — not in this edition.

How the split is enforced in code¶

The enterprise feature gates the relevant modules (siem / dual_control). The trust daemon and its role-based access control (etminan-verifierd, the op interface, roles, scope, and TOTP) are not gated by that feature — they are compiled into the Standard binary and are its default access-control model. Where an Enterprise capability would surface in shared output — for example the top-level --help — the Enterprise note is compiled in only under the feature, so a Standard binary's help never advertises a subcommand it does not have. This is why dual-control is not merely disabled but genuinely not present in a Standard build.

RBAC and scoping (Standard)¶

RBAC is part of the Standard, free edition — it is the default access-control model, not an Enterprise add-on. The etminan-verifierd daemon owns the trust-changing actions and the one signing key; operators drive it through etminan-verifier op <cmd>, and the daemon authenticates each call by kernel peer-UID (SO_PEERCRED) rather than a key file. It maps the UID to a registered identity with one of three roles — admin, operator, viewer — where an operator carries a host-group scope that limits which hosts it may act on and see. The model is default-deny / fail-closed, and both allows and denies are audited. An optional per-role TOTP second factor (off by default) is available. See RBAC.