Build and Features

TKeeper has two build-time selectors:

• features: product surface such as authorities, ECIES, UI, and seal providers
• platforms: cryptographic algorithms and protocols

A usable production artifact must include at least one platform.

Build all production modules

./gradlew build -Pkeeper.features=all -Pkeeper.platforms=all

build runs the root and SDK tests plus the unit tests of every selected feature and platform module before producing the artifact.

The root build task runs the normal verification lifecycle and produces the deployable fat jar through shadowJar.

Equivalent:

./gradlew :build -Pkeeper.features.all=true -Pkeeper.platforms.all=true

The jar lands under:

build/libs/tkeeper-2.3.1.jar

TKeeper requires Java 25.

Build a smaller artifact

Example: EVM signing, ECIES, and the UI:

./gradlew :build -Pkeeper.features=authority-evm,ecies,ui -Pkeeper.platforms=ecc

Example: ML-DSA only:

./gradlew :build -Pkeeper.platforms=pqc

Feature names match child project names. The module :features:authority-evm is selected with authority-evm.

Feature and platform matrix

Features with platform dependencies require the matching platform. The build should fail early instead of producing an artifact with a missing runtime provider.

auth-dev is deliberately excluded from all, but it may be included in any deployable artifact by requesting it explicitly:

./gradlew :build -Pkeeper.features=auth-dev -Pkeeper.platforms=ecc

Selection properties

Comma-separated selectors accept short names such as ecies, ecc, and pqc. all selects every production module in that category.

Docker

Build the production Docker image:

./gradlew dockerBuild -Pkeeper.features=all -Pkeeper.platforms=all

Production image tags:

exploit/tkeeper:2.3.1
exploit/tkeeper:latest

The Dockerfile adds the JVM flag required by the FFI Java API:

--enable-native-access=ALL-UNNAMED

Run the image:

docker run --rm \
  -p 8080:8080 \
  -p 9090:9090 \
  -v "$PWD/config:/etc/tkeeper:ro" \
  -v "$PWD/data:/var/lib/tkeeper" \
  -e KEEPER_CONFIG_LOCATION=/etc/tkeeper \
  exploit/tkeeper:2.3.1

Integration image

Run the complete release verification with:

./gradlew releaseGate

This includes every module's unit tests, artifact isolation, both test-container builds, and the functional integration suite. Performance benchmarks are separate.

Build both images used by functional integration tests with:

./gradlew buildTestContainers

The test task reuses these images. Re-run the build after changing application code, dependencies, or Dockerfiles.

Do not pass keeper.features or keeper.platforms to this task. The development integration image uses a dedicated classpath containing every production feature, auth-dev, every platform, and the test-only failure-injection module.

Never deploy either test image as production runtime.

Common failures

Feature endpoint returns 404

The feature was not included in the artifact.

Rebuild with the required feature and platform.

No provider for algorithm

The platform was not included in the artifact.

Rebuild with the required platform, for example:

./gradlew :build -Pkeeper.features=authority-evm -Pkeeper.platforms=ecc

Native access warning

Add:

--enable-native-access=ALL-UNNAMED

The Docker image already does this.