Implement Host Integrity at Runtime and Startup Provisioner




1,005 latest version

5.0 quality score

Version information

  • 0.1.4 (latest)
  • 0.1.3
  • 0.1.2
released Jul 28th 2020
This version is compatible with:
  • Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x, 2017.3.x
  • Puppet >= 5.0.0 < 7.0.0
  • CentOS

Start using this module

Tags: simp


simp/hirs_provisioner — version 0.1.4 Jul 28th 2020

License CII Best Practices Puppet Forge Puppet Forge Downloads Build Status

Table of Contents

| WARNING: This is currently an **EXPERIMENTAL** module things  |
| may change drastically, and in breaking ways, without notice! |


This module manages Host Integrity at Runtime and Start-up (HIRS) provisioning. It installs and configures the necessary packages and components to register the system with an Attestation Certificate Authority, which can ensure Trusted Computing Group based Supply Chain Validation of systems.

See REFERENCE.md for more details.

This is a SIMP module

This module is a component of the System Integrity Management Platform, a compliance-management framework built on Puppet.

If you find any issues, they may be submitted to our bug tracker.

This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:

  • When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
  • If used independently, all SIMP-managed security subsystems are disabled by default and must be explicitly opted into by administrators. Please review the parameters in simp/simp_options for details.


Setup Requirements

In order to utilize the HIRS Provisioner module, the target system must have an enabled TPM device and an ACA must be configured and accessible for the the system to receive a certificate and register. If the ACA is hosted on a remote system, the fully qualified domain name of the ACA system should be specified in Hiera. The SIMP TPM or TPM2 modules can be used to setup and enable the TPM devices.

Beginning with hirs_provisioner

Simply include hirs_provisioner.


If the ACA is hosted on a remote system, it is necessary to specify the fully qualified domain name of that system in Hiera, by adding the following:

hirs_provisioner::config::aca_fqdn: fqdn.of.the.aca


Please refer to the inline documentation within each source file, or to the module's generated YARD documentation for reference material.


SIMP Puppet modules are generally intended for use on Red Hat Enterprise Linux and compatible distributions, such as CentOS. Please see the metadata.json file for the most up-to-date list of supported operating systems, Puppet versions, and module dependencies.


Please read our Contribution Guide.

Acceptance tests

This module includes Beaker acceptance tests using the SIMP Beaker Helpers. By default the tests use Vagrant with VirtualBox as a back-end; Vagrant and VirtualBox must both be installed to run these tests without modification. To execute the tests run the following:

bundle install
bundle exec rake beaker:suites