AMMOS DCS provides cryptographic capabilities, which include encryption/decryption of files and creation/verification of integrity check values (ICVs) for files. DCS also includes command and telemetry encryption/authentication capabilities via application of the Consultative Committee for Space Data Systems (CCSDS) “Blue Book” Space Data Link Security (SDLS) specification.

NOTE AMMOS DCS was formerly known as AMMOS Key Management & Cryptography (KMC), and the name change is ongoing. The references to KMC in the code and documentation will be updated to DCS in future releases.

1. Clone Git repository (already done if you're reading this README locally!) git clone https://github.com/NASA-AMMOS/DCS
2. Change directory into the KMC repository clone: cd KMC
3. Initialize/Update Git submodules (NASA Cryptolib): git submodule init; git submodule update
4. (Optional) Edit kmc-resources/scripts/setenv.sh as needed to tailor configuration. See the Product Guide and/or the comments in kmc-resources/scripts/setenv.sh for details.
5. Run Build Script. This step performs the full build and unit test suite. kmc-resources/scripts/build.sh

DCS requires several software dependenices in order to build and execute unit tests. Required software can be installed with OS Vendor packages, pulled directly from public repositories, or any other method. Make sure the required tool is available in the build environment appropriately for that particular tool (PATH for executables, LD_LIBRARY_PATH for shared libraries, PYTHONPATH for python modules, etc.). Tool versions listed are minimum versions, square brackets are used to denote the tool/version used for the official KMC build and testing.

Required Build Dependencies:

• C Compiler [gcc 11.5.0]
• Java Development Kit 17.x [OpenJDK 17.0.18]
• cmake [3.26.5]
• swig [4.1.1]
• MariaDB Connector/C [3.2.6]
• Python 3.9 - 3.14 with the pip and cffi modules [cffi 1.14.5]. The AMMOS CryptoLib Python bindings are built for every python3.X in this range found on PATH; interpreters missing those modules are skipped with a warning, so install them for each interpreter you need. The build tools are downloaded by pip from PyPI (or a configured mirror) during the build (see ammos-cryptolib/README.md)
• maven [3.6.3]

DCS can be deployed in several different ways, all of which are documented in section 4 of the DCS Product Guide.:

1. Direct local deployment: local users/directories/files on the current system. This will deploy into the directories set in kmc-resources/scripts/setenv.sh.

Deploying the KMC Client: kmc-resources/scripts/deploy.sh

Deploying the KMC Client & all KMC Services: kmc-resources/script/deploy.sh --all-services

See the product guide for additional details about the deploy.sh script.

1. System Packages: the deploy.sh script can be used to build system-specific package types. Currently, the script supports a generic package directory, suitable for tarball or follow-on packaging, and Red Hat-stype RPM packages using the rpmspec in kmc-resources/packaging/rpm/SPECS/kmc.spec.

Generic packaging deployment: kmc-resources/scripts/deploy.sh --pkg /var/tmp/kmc-pkg

RPM Packaging (builds RPMs in kmc-resources/packaging/rpm/RPMS): kmc-resources/scripts/deploy.sh --rpm

1. OCI Container Images: The deploy.sh script can also build OCI-compliant container images based on the RHEL 9 Universal Basic Image with the KMC Client and individual KMC Services (KMC Crypto Service, KMC SDLS Service, KMC SA Management Service). Verify that the local container hosting software is configured in kmc-resources/scripts/setenv.sh (CONTAINER_EXEC).

Building KMC Service Containers: kmc-resources/scripts/deploy.sh --img

See the individual KMC Service Container READMEs in kmc-resources/packaging/container/{crypto-service,sdls-service/sa-mgmt} for details on how to configure & launch the KMC Service Containers.

Copyright (c) 2023-2026 California Institute of Technology (“Caltech”). U.S. Government sponsorship acknowledged. See LICENSE for additional information.