Build and Features

TKeeper has two build-time selectors:

• features: product surface such as authorities, ECIES, UI, and seal providers
• platforms: cryptographic algorithms and protocols

A usable production artifact must include at least one platform.

Build all production modules

./gradlew :build -Pkeeper.features=all -Pkeeper.platforms=all

The root build task runs the normal verification lifecycle and produces the deployable fat jar through shadowJar.

Equivalent:

./gradlew :build -Pkeeper.features.all=true -Pkeeper.platforms.all=true

The jar lands under:

build/libs/tkeeper-2.2.0.jar

TKeeper requires Java 25.

Build a smaller artifact

Example: EVM signing, ECIES, and the UI:

./gradlew :build -Pkeeper.features=authority-evm,ecies,ui -Pkeeper.platforms=ecc

Example: ML-DSA only:

./gradlew :build -Pkeeper.platforms=pqc

Feature names match child project names. The module :features:authority-evm is selected with authority-evm.

Feature and platform matrix

Features with platform dependencies require the matching platform. The build should fail early instead of producing an artifact with a missing runtime provider.

Selection properties

Comma-separated selectors accept short names such as ecies, ecc, and pqc. all selects every production module in that category.

Docker

Build the production Docker image:

./gradlew dockerBuild -Pkeeper.features=all -Pkeeper.platforms=all

Production image tags:

exploit/tkeeper:2.2.0
exploit/tkeeper:latest

The Dockerfile adds the JVM flag required by the FFI Java API:

--enable-native-access=ALL-UNNAMED

Run the image:

docker run --rm \
  -p 8080:8080 \
  -p 9090:9090 \
  -v "$PWD/config:/etc/tkeeper:ro" \
  -v "$PWD/data:/var/lib/tkeeper" \
  -e KEEPER_CONFIG_LOCATION=/etc/tkeeper \
  exploit/tkeeper:2.2.0

Integration image

Build the integration image with:

./gradlew dockerBuildIntegration

Do not pass keeper.features or keeper.platforms to this task. dockerBuildIntegration uses a dedicated classpath containing every production feature, every platform, and the test-only failure-injection module.

Never deploy the integration image as production runtime.

Common failures

Feature endpoint returns 404

The feature was not included in the artifact.

Rebuild with the required feature and platform.

No provider for algorithm

The platform was not included in the artifact.

Rebuild with the required platform, for example:

./gradlew :build -Pkeeper.features=authority-evm -Pkeeper.platforms=ecc

Native access warning

Add:

--enable-native-access=ALL-UNNAMED

The Docker image already does this.