diff --git a/.github/workflows/presubmit-c.yml b/.github/workflows/presubmit-c.yml
index 81cb6af1..e9fef673 100644
--- a/.github/workflows/presubmit-c.yml
+++ b/.github/workflows/presubmit-c.yml
@@ -54,7 +54,6 @@ jobs:
       run: |
         DESTDIR=out meson install -C build
         find build/out/
-        test -x build/out/usr/local/bin/glome
         test -x build/out/usr/local/sbin/glome-login
         test -f build/out/usr/local/etc/glome/config
         test -f build/out/usr/local/include/glome.h
@@ -63,6 +62,14 @@ jobs:
         test -f build/out/usr/local/lib/x86_64-linux-gnu/libglome.so
         test -f build/out/usr/local/lib/security/pam_glome.so || \
         test -f build/out/usr/local/lib/x86_64-linux-gnu/security/pam_glome.so
+    - name: install CLI
+      if: ${{ startsWith(matrix.container, 'debian:') }}
+      run: |
+        ./kokoro/rodete/debian_cargo.sh prepare-debian ./debian/cargo_registry --link-from-system
+        ./kokoro/rodete/debian_cargo.sh build
+        ./kokoro/rodete/debian_cargo.sh test
+        DEB_CARGO_INSTALL_PREFIX=$PWD/build/out/usr/local ./kokoro/rodete/debian_cargo.sh install --features=cli
+        test -x build/out/usr/local/bin/glome
   test-macos:
     runs-on: macos-latest
     steps:
diff --git a/README.md b/README.md
index 816edbea..10ba4826 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,9 @@ login prompt. He is then provided with a challenge that he forwards to Alice.
 The challenge contains information about the identity of accessed host and the
 requested action (i.e., root shell access). Alice verifies that the request is
 legitimate (e.g., the accessed host is indeed the one she's trying to
-diagnose), and uses the [`glome` CLI](cli) to generate an authorization code.
-She forwards that authorization code to Bob who provides it as a challenge
-response.
+diagnose), and uses the [`glome` CLI](rust/src/cli) to generate an
+authorization code.  She forwards that authorization code to Bob who provides
+it as a challenge response.
 
 The authorization succeeds and Bob is able to run diagnostic commands and share
 the results with Alice.
@@ -123,7 +123,7 @@ Core libraries:
 
 Binaries:
 
- - [glome](cli) *Command-line interface for GLOME*
+ - [glome](rust/src/cli) *Command-line interface for GLOME*
  - [glome-login](login) *Replacement of login(1) implementing GLOME Login
    protocol*
 
diff --git a/cli/commands.c b/cli/commands.c
deleted file mode 100644
index 120a6fcc..00000000
--- a/cli/commands.c
+++ /dev/null
@@ -1,412 +0,0 @@
-// Copyright 2020 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "commands.h"
-
-#include <errno.h>
-#include <fcntl.h>
-#include <getopt.h>
-#include <limits.h>
-#include <openssl/crypto.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include "glome.h"
-#include "login/base64.h"
-#include "login/config.h"
-#include "login/crypto.h"
-
-#define GLOME_CLI_MAX_MESSAGE_LENGTH 4095
-
-#define UNUSED(var) (void)(var)
-
-// Arguments
-static const char *key_file = NULL;
-static const char *peer_file = NULL;
-static const char *tag_b64 = NULL;
-static unsigned long counter = 0;  // NOLINT(runtime/int)
-
-static bool parse_args(int argc, char **argv) {
-  int c;
-  struct option long_options[] = {{"key", required_argument, 0, 'k'},
-                                  {"peer", required_argument, 0, 'p'},
-                                  {"counter", required_argument, 0, 'c'},
-                                  {"tag", required_argument, 0, 't'},
-                                  {0, 0, 0, 0}};
-
-  // First argument is the command name so skip it.
-  while ((c = getopt_long(argc - 1, argv + 1, "c:k:p:t:", long_options,
-                          NULL)) != -1) {
-    switch (c) {
-      case 'c': {
-        char *endptr;
-        errno = 0;
-        counter = strtoul(optarg, &endptr, 0);
-        if (errno || counter > 255 || optarg == endptr || *endptr != '\0') {
-          fprintf(stderr, "'%s' is not a valid counter (0..255)\n", optarg);
-          return false;
-        }
-        break;
-      }
-      case 'k':
-        key_file = optarg;
-        break;
-      case 'p':
-        peer_file = optarg;
-        break;
-      case 't':
-        tag_b64 = optarg;
-        break;
-      case '?':
-        return false;
-      default:
-        // option not implemented
-        abort();
-    }
-  }
-  return true;
-}
-
-static bool read_file(const char *fname, uint8_t *buf, const size_t num_bytes) {
-  FILE *f = fopen(fname, "r");
-  if (!f) {
-    fprintf(stderr, "could not open file %s: %s\n", fname, strerror(errno));
-    return false;
-  }
-  if (fread(buf, 1, num_bytes, f) != num_bytes) {
-    fprintf(stderr, "could not read %zu bytes from file %s", num_bytes, fname);
-    if (ferror(f)) {
-      fprintf(stderr, ": %s\n", strerror(errno));
-    } else {
-      fputs("\n", stderr);
-    }
-    fclose(f);
-    return false;
-  }
-  fclose(f);
-  return true;
-}
-
-static bool read_public_key_file(const char *fname, uint8_t *buf,
-                                 size_t buf_len) {
-  FILE *f = fopen(fname, "r");
-  if (!f) {
-    fprintf(stderr, "could not open file %s: %s\n", fname, strerror(errno));
-    return false;
-  }
-  // Allocate enough buffer space to fit the public key and a reasonable amount
-  // of whitespace.
-  char encoded_public_key[128] = {0};
-  if (!fgets(encoded_public_key, sizeof(encoded_public_key), f)) {
-    perror("could not read from public key file");
-    fclose(f);
-    return false;
-  }
-  fclose(f);
-
-  if (!glome_login_parse_public_key(encoded_public_key, buf, buf_len)) {
-    fprintf(stderr, "failed to parse public key %s\n", encoded_public_key);
-    return false;
-  }
-  return true;
-}
-
-int genkey(int argc, char **argv) {
-  UNUSED(argc);
-  UNUSED(argv);
-
-  uint8_t private_key[GLOME_MAX_PRIVATE_KEY_LENGTH] = {0};
-
-  if (glome_generate_key(private_key, NULL)) {
-    fprintf(stderr, "unable to generate a new key\n");
-    return EXIT_FAILURE;
-  }
-  if (fwrite(private_key, 1, sizeof private_key, stdout) !=
-      sizeof private_key) {
-    perror("unable to write the private key to stdout");
-    return EXIT_FAILURE;
-  }
-  return EXIT_SUCCESS;
-}
-
-int pubkey(int argc, char **argv) {
-  UNUSED(argc);
-  UNUSED(argv);
-
-  uint8_t private_key[GLOME_MAX_PRIVATE_KEY_LENGTH] = {0};
-  uint8_t public_key[GLOME_MAX_PUBLIC_KEY_LENGTH] = {0};
-  char encoded_public_key[ENCODED_BUFSIZE(GLOME_MAX_PUBLIC_KEY_LENGTH)] = {0};
-
-  if (fread(private_key, 1, sizeof private_key, stdin) != sizeof private_key) {
-    perror("unable to read the private key from stdin");
-    return EXIT_FAILURE;
-  }
-  if (glome_derive_key(private_key, public_key)) {
-    fprintf(stderr, "unable to generate a new key\n");
-    return EXIT_FAILURE;
-  }
-  if (!base64url_encode(public_key, sizeof public_key,
-                        (uint8_t *)encoded_public_key,
-                        sizeof encoded_public_key)) {
-    fputs("unable to encode public key\n", stderr);
-    return EXIT_FAILURE;
-  }
-  if (printf("%s %s\n", GLOME_LOGIN_PUBLIC_KEY_ID, encoded_public_key) < 0) {
-    perror("unable to write the public key to stdout");
-    return EXIT_FAILURE;
-  }
-  return EXIT_SUCCESS;
-}
-
-// tag_impl reads a private key and a peer key from the given files and computes
-// a tag corresponding to a message read from stdin for the communication
-// direction determined by verify.
-int tag_impl(uint8_t tag[GLOME_MAX_TAG_LENGTH], bool verify,
-             const char *key_file, const char *peer_file) {
-  uint8_t private_key[GLOME_MAX_PRIVATE_KEY_LENGTH] = {0};
-  uint8_t peer_key[GLOME_MAX_PUBLIC_KEY_LENGTH] = {0};
-  char message[GLOME_CLI_MAX_MESSAGE_LENGTH] = {0};
-
-  if (!read_file(key_file, private_key, sizeof private_key) ||
-      !read_public_key_file(peer_file, peer_key, sizeof(peer_key))) {
-    return EXIT_FAILURE;
-  }
-  size_t msg_len = fread(message, 1, GLOME_CLI_MAX_MESSAGE_LENGTH, stdin);
-  if (!feof(stdin)) {
-    fprintf(stderr, "message exceeds maximum supported size of %u\n",
-            GLOME_CLI_MAX_MESSAGE_LENGTH);
-    return EXIT_FAILURE;
-  }
-  if (glome_tag(verify, counter, private_key, peer_key, (uint8_t *)message,
-                msg_len, tag)) {
-    fputs("MAC tag generation failed\n", stderr);
-    return EXIT_FAILURE;
-  }
-  return EXIT_SUCCESS;
-}
-
-int tag(int argc, char **argv) {
-  uint8_t tag[GLOME_MAX_TAG_LENGTH] = {0};
-  if (!parse_args(argc, argv)) {
-    return EXIT_FAILURE;
-  }
-  if (!key_file || !peer_file) {
-    fprintf(stderr, "not enough arguments for subcommand %s\n", argv[1]);
-    return EXIT_FAILURE;
-  }
-  int res = tag_impl(tag, /*verify=*/false, key_file, peer_file);
-  if (res) {
-    return res;
-  }
-  char tag_encoded[ENCODED_BUFSIZE(sizeof tag)] = {0};
-  if (base64url_encode(tag, sizeof tag, (uint8_t *)tag_encoded,
-                       sizeof tag_encoded) == 0) {
-    fprintf(stderr, "GLOME tag encode failed\n");
-    return EXIT_FAILURE;
-  }
-  puts(tag_encoded);
-  return EXIT_SUCCESS;
-}
-
-int verify(int argc, char **argv) {
-  uint8_t tag[GLOME_MAX_TAG_LENGTH] = {0};
-  uint8_t *expected_tag = NULL;
-  int ret = EXIT_FAILURE;
-  if (!parse_args(argc, argv)) {
-    goto out;
-  }
-  if (!key_file || !peer_file || !tag_b64) {
-    fprintf(stderr, "not enough arguments for subcommand %s\n", argv[1]);
-    goto out;
-  }
-  int res = tag_impl(tag, /*verify=*/true, key_file, peer_file);
-  if (res) {
-    goto out;
-  }
-
-  // decode the tag
-  size_t tag_b64_len = strlen(tag_b64);
-  size_t tag_b64_decoded_len = DECODED_BUFSIZE(tag_b64_len);
-  expected_tag = malloc(tag_b64_decoded_len);
-  if (expected_tag == NULL) {
-    fprintf(stderr, "GLOME tag malloc %ld bytes failed\n", tag_b64_decoded_len);
-    goto out;
-  }
-  size_t expected_tag_len =
-      base64url_decode((uint8_t *)tag_b64, tag_b64_len, (uint8_t *)expected_tag,
-                       tag_b64_decoded_len);
-  if (expected_tag_len == 0) {
-    fprintf(stderr, "GLOME tag decode failed\n");
-    goto out;
-  }
-  if (expected_tag_len > sizeof tag) {
-    expected_tag_len = sizeof tag;
-  }
-
-  // compare the tag
-  if (CRYPTO_memcmp(expected_tag, tag, expected_tag_len) != 0) {
-    fputs("MAC tag verification failed\n", stderr);
-    goto out;
-  }
-  ret = EXIT_SUCCESS;
-
-out:
-  free(expected_tag);
-  return ret;
-}
-
-static bool parse_login_path(const char *path, char **handshake,
-                             char **message) {
-  size_t path_len = strlen(path);
-  if (path_len < 3 || path[0] != 'v' || path[1] != '2' || path[2] != '/') {
-    fprintf(stderr, "unexpected challenge prefix: %s\n", path);
-    return false;
-  }
-  if (path[path_len - 1] != '/') {
-    fprintf(stderr, "unexpected challenge suffix: %s\n", path);
-    return false;
-  }
-
-  const char *start = path + 3;
-  char *slash = strchr(start, '/');
-  if (slash == NULL || slash - start == 0) {
-    fprintf(stderr, "could not parse handshake from %s\n", start);
-    return false;
-  }
-  *handshake = strndup(start, slash - start);
-  if (*handshake == NULL) {
-    fprintf(stderr, "failed to duplicate handshake\n");
-    return false;
-  }
-
-  // Everything left (not including the trailing slash) is the message.
-  start = slash + 1;
-  *message = strndup(start, path + path_len - 1 - start);
-  if (*message == NULL) {
-    free(*handshake);
-    *handshake = NULL;
-    fprintf(stderr, "failed to duplicate message\n");
-    return false;
-  }
-
-  return true;
-}
-
-int login(int argc, char **argv) {
-  char *handshake = NULL;
-  char *handshake_b64 = NULL;
-  char *message = NULL;
-  int ret = EXIT_FAILURE;
-
-  if (!parse_args(argc, argv)) {
-    return EXIT_FAILURE;
-  }
-  char *cmd = argv[optind++];
-  if (optind >= argc) {
-    fprintf(stderr, "missing challenge for subcommand %s\n", cmd);
-    return EXIT_FAILURE;
-  }
-
-  if (!key_file) {
-    fprintf(stderr, "not enough arguments for subcommand %s\n", cmd);
-    return EXIT_FAILURE;
-  }
-  uint8_t private_key[GLOME_MAX_PRIVATE_KEY_LENGTH] = {0};
-  if (!read_file(key_file, private_key, sizeof private_key)) {
-    return EXIT_FAILURE;
-  }
-
-  char *path = strstr(argv[optind], "v2/");
-  if (path == NULL) {
-    fprintf(stderr, "unsupported challenge format\n");
-    goto out;
-  }
-  if (!parse_login_path(path, &handshake_b64, &message)) {
-    return EXIT_FAILURE;
-  }
-
-  size_t handshake_b64_len = strlen(handshake_b64);
-  handshake = malloc(DECODED_BUFSIZE(handshake_b64_len));
-  if (handshake == NULL) {
-    fprintf(stderr, "failed to malloc %ld bytes for base64 decode\n",
-            DECODED_BUFSIZE(handshake_b64_len));
-    goto out;
-  }
-  int handshake_len = base64url_decode((uint8_t *)handshake_b64,
-                                       handshake_b64_len, (uint8_t *)handshake,
-                                       DECODED_BUFSIZE(handshake_b64_len));
-  if (handshake_len == 0) {
-    fprintf(stderr, "failed to decode handshake in path %s\n", path);
-    goto out;
-  }
-  if (handshake_len < 1 + GLOME_MAX_PUBLIC_KEY_LENGTH ||
-      handshake_len > 1 + GLOME_MAX_PUBLIC_KEY_LENGTH + GLOME_MAX_TAG_LENGTH) {
-    fprintf(stderr, "handshake size is invalid in path %s\n", path);
-    goto out;
-  }
-  if ((handshake[0] & 0x80) == 0) {
-    uint8_t public_key[GLOME_MAX_PUBLIC_KEY_LENGTH] = {0};
-    if (glome_derive_key(private_key, public_key)) {
-      fprintf(stderr, "unable to generate a public key\n");
-      goto out;
-    }
-    // Most significant bit is not set for X25519 key (see RFC 7748).
-    uint8_t public_key_msb = public_key[GLOME_MAX_PUBLIC_KEY_LENGTH - 1];
-    if (handshake[0] != public_key_msb) {
-      fprintf(stderr, "unexpected public key prefix\n");
-      goto out;
-    }
-  }
-  uint8_t peer_key[GLOME_MAX_PRIVATE_KEY_LENGTH] = {0};
-  memcpy(peer_key, handshake + 1, GLOME_MAX_PUBLIC_KEY_LENGTH);
-
-  uint8_t tag[GLOME_MAX_TAG_LENGTH] = {0};
-  if (glome_tag(true, 0, private_key, peer_key, (uint8_t *)message,
-                strlen(message), tag)) {
-    fprintf(stderr, "MAC authcode generation failed\n");
-    goto out;
-  }
-  if (CRYPTO_memcmp(handshake + 1 + GLOME_MAX_PUBLIC_KEY_LENGTH, tag,
-                    handshake_len - 1 - GLOME_MAX_PUBLIC_KEY_LENGTH) != 0) {
-    fprintf(
-        stderr,
-        "The challenge includes a message tag prefix which does not match the "
-        "message\n");
-    goto out;
-  }
-
-  if (glome_tag(false, 0, private_key, peer_key, (uint8_t *)message,
-                strlen(message), tag)) {
-    fprintf(stderr, "GLOME tag generation failed\n");
-    goto out;
-  }
-  char tag_encoded[ENCODED_BUFSIZE(sizeof tag)] = {0};
-  if (base64url_encode(tag, sizeof tag, (uint8_t *)tag_encoded,
-                       sizeof tag_encoded) == 0) {
-    fprintf(stderr, "GLOME tag encode failed\n");
-    goto out;
-  }
-  puts(tag_encoded);
-  ret = EXIT_SUCCESS;
-
-out:
-  free(handshake);
-  free(handshake_b64);
-  free(message);
-  return ret;
-}
diff --git a/cli/commands.h b/cli/commands.h
deleted file mode 100644
index b2070cb3..00000000
--- a/cli/commands.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2020 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef CLI_COMMANDS_H_
-#define CLI_COMMANDS_H_
-
-// Generates a new key and writes it to stdout.
-int genkey(int argc, char **argv);
-
-// Reads a private key from stdin and writes the corresponding public key to
-// stdout.
-int pubkey(int argc, char **argv);
-
-// Tags a message and writes it to stdout.
-int tag(int argc, char **argv);
-
-// Returns 0 iff the tag could be verified.
-int verify(int argc, char **argv);
-
-// Generates a tag for a glome-login challenge and writes it to stdout.
-int login(int argc, char **argv);
-
-#endif  // CLI_COMMANDS_H_
diff --git a/cli/main.c b/cli/main.c
deleted file mode 100644
index 28d3fb02..00000000
--- a/cli/main.c
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright 2020 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <errno.h>
-#include <fcntl.h>
-#include <getopt.h>
-#include <limits.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include "commands.h"
-#include "glome.h"
-
-#define GLOME_CLI_MAX_MESSAGE_LENGTH 4095
-
-#define UNUSED(var) (void)(var)
-
-static const char *kUsage =
-    "Usage: \n"
-    "  To generate a new keypair\n"
-    "    umask 077\n"
-    "    %s genkey | tee PRIVATE-KEY-FILE | %s pubkey >PUBLIC-KEY-FILE\n\n"
-    "  To generate a tag:\n"
-    "    %s tag --key PRIVATE-KEY-FILE --peer PEER-KEY-FILE "
-    "[--counter COUNTER] <MESSAGE-FILE\n\n"
-    "  To verify a tag:\n"
-    "    %s verify --key PRIVATE-KEY-FILE --peer PEER-KEY-FILE --tag TAG "
-    "[--counter COUNTER] <MESSAGE-FILE\n\n"
-    "  To generate a tag for a glome-login challenge:\n"
-    "    %s login --key PRIVATE-KEY-FILE v1/AYUg8AmJMKdUdIt93LQ-91oNvzoN"
-    "Jjga9OukqY6qm05q0PU=/my-server.local/shell/root/\n";
-
-static int print_help(int argc, char **argv) {
-  UNUSED(argc);
-  UNUSED(argv);
-  fprintf(stderr, kUsage, argv[0], argv[0], argv[0], argv[0], argv[0]);
-  return EXIT_SUCCESS;
-}
-
-typedef int (*mainfunc)(int argc, char **argv);
-
-struct cmd {
-  const char *name;
-  mainfunc run;
-};
-
-// cmds maps subcommand names to their implementation. The last entry with a
-// NULL name is executed when the subcommand given by the user is not found.
-static const struct cmd cmds[] = {
-    {"genkey", &genkey}, {"pubkey", &pubkey}, {"tag", &tag},
-    {"verify", &verify}, {"login", &login},   {NULL, &print_help},
-};
-
-int main(int argc, char **argv) {
-  if (argc == 0) {
-    fputs("called with empty argv\n", stderr);
-    return EXIT_FAILURE;
-  }
-  if (argc < 2) {
-    return print_help(argc, argv);
-  }
-  // Traverse the known subcommands until the requested subcommand is found, or
-  // until we hit the catch-all without a name.
-  const struct cmd *c = cmds;
-  while (c->name && strcmp(c->name, argv[1])) {
-    c++;
-  }
-  return c->run(argc, argv);
-}
diff --git a/cli/meson.build b/cli/meson.build
deleted file mode 100644
index 4f0b7b19..00000000
--- a/cli/meson.build
+++ /dev/null
@@ -1,34 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https:#www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-openssl_dep = dependency('openssl', version : '>=1.1')
-
-glome_cli = executable(
-  'glome',
-  [
-    'main.c',
-    'commands.h',
-    'commands.c',
-  ],
-  dependencies: openssl_dep,
-  link_with : [glome_lib, login_lib],
-  include_directories : glome_incdir,
-  install : true)
-
-if get_option('tests')
-    cli_test = find_program('test.sh')
-    test('cli', cli_test,
-      args : glome_cli,
-      timeout : 120)
-endif
diff --git a/cli/test.sh b/cli/test.sh
deleted file mode 100755
index fa5b5343..00000000
--- a/cli/test.sh
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/bin/sh
-# Copyright 2021 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -eu
-
-binary="$(dirname "$1")/$(basename "$1")"
-
-if ! test -x "$binary"; then
-  echo "ERROR: $binary is not an executable" >&2
-  exit 1
-fi
-
-t=$(mktemp -d)
-cleanup() {
-  # shellcheck disable=SC2317
-  rm -rf -- "${t?}"
-}
-trap cleanup EXIT
-
-# Populate directory with keys according to specification.
-mkdir -p "$t/vector-1"
-printf '\167\007\155\012\163\030\245\175\074\026\301\162\121\262\146\105\337'\
-'\114\057\207\353\300\231\052\261\167\373\245\035\271\054\052' >"$t/vector-1/a"
-printf '\135\253\010\176\142\112\212\113\171\341\177\213\203\200\016\346\157'\
-'\073\261\051\046\030\266\375\034\057\213\047\377\210\340\353' >"$t/vector-1/b"
-printf "The quick brown fox" >"$t/vector-1/msg"
-printf "0" >"$t/vector-1/n"
-printf "nEQ4n0YtNdBnL69zpeEY-Ln1w0C76NNA4rlHwgXqT6M=" >"$t/vector-1/tag"
-
-mkdir -p "$t/vector-2"
-printf '\261\005\360\015\261\005\360\015\261\005\360\015\261\005\360\015\261'\
-'\005\360\015\261\005\360\015\261\005\360\015\261\005\360\015' >"$t/vector-2/a"
-printf '\376\341\336\255\376\341\336\255\376\341\336\255\376\341\336\255\376'\
-'\341\336\255\376\341\336\255\376\341\336\255\376\341\336\255' >"$t/vector-2/b"
-printf "The quick brown fox" >"$t/vector-2/msg"
-printf "100" >"$t/vector-2/n"
-printf "BkdvHzFLBsf5bl3GKyMIJoy9thQK7-61WUBzGGMDInc=" >"$t/vector-2/tag"
-
-errors=0
-for n in 1 2; do
-  testdir="$t/vector-$n"
-  counter=$(cat "$testdir/n")
-  expected_tag="$(cat "$testdir/tag")"
-  for x in a b; do
-    "$binary" pubkey <"$testdir/$x" >"$testdir/$x.pub"
-  done
-  tag=$("$binary" tag --key "$testdir/a" --peer "$testdir/b.pub" --counter "$counter" <"$testdir/msg")
-  if [ "$tag" != "${expected_tag}" ]; then
-    echo "Generated wrong tag for test vector $n" >&2
-    echo "${expected_tag} <- expected" >&2
-    echo "$tag <- actual" >&2
-    errors=$((errors + 1))
-  fi
-  if ! "$binary" verify -k "$testdir/b" -p "$testdir/a.pub" -c "$counter" -t "$tag" <"$testdir/msg"; then
-    echo "Failed to verify test vector $n" >&2
-    errors=$((errors + 1))
-  fi
-done
-
-key="$t/vector-2/a"
-expected_tag="ZmxczN4x3g4goXu-A2AuuEEVftgS6xM-6gYj-dRrlis="
-for path in \
-  "v2/R4cvQ1u4uJ0OOtYqouURB07hleHDnvaogAFBi-ZW48N2/myhost/exec=%2Fbin%2Fsh/" \
-  "v2/x4cvQ1u4uJ0OOtYqouURB07hleHDnvaogAFBi-ZW48N2/myhost/exec=%2Fbin%2Fsh/"
-do
-  tag=$("$binary" login --key "$key" "$path")
-  if [ "$tag" != "$expected_tag" ]; then
-    echo "Generated wrong tag for test path $path" >&2
-    echo "$expected_tag <- expected" >&2
-    echo "$tag <- actual" >&2
-    errors=$((errors + 1))
-  fi
-done
-
-exit "$errors"
diff --git a/kokoro/docker/Dockerfile b/kokoro/docker/Dockerfile
index ab53b906..f879eb84 100644
--- a/kokoro/docker/Dockerfile
+++ b/kokoro/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/library/debian:bullseye AS build
+FROM docker.io/library/debian:trixie AS build
 WORKDIR /app
 COPY . .
 RUN kokoro/rodete/fetch_dependencies.sh
@@ -7,8 +7,12 @@ RUN rm -rf build \
     && meson compile -C build \
     && meson test --print-errorlogs -C build \
     && meson install -C build
+RUN kokoro/rodete/debian_cargo.sh prepare-debian /app/debian/cargo_registry --link-from-system \
+    && kokoro/rodete/debian_cargo.sh build \
+    && kokoro/rodete/debian_cargo.sh test \
+    && kokoro/rodete/debian_cargo.sh install --features=cli
 
-FROM docker.io/library/debian:bullseye
+FROM docker.io/library/debian:trixie
 COPY --from=build /usr/local /usr/local
 COPY kokoro/docker/glome-start /usr/local/sbin
 RUN apt-get update \
diff --git a/kokoro/rodete/debian_cargo.sh b/kokoro/rodete/debian_cargo.sh
new file mode 100755
index 00000000..5f93c852
--- /dev/null
+++ b/kokoro/rodete/debian_cargo.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -x
+
+export CARGO="${CARGO:-/usr/share/cargo/bin/cargo}"
+export CARGO_HOME="${CARGO_HOME:-$PWD/debian/cargo_home}"
+export CARGO_REGISTRY="${CARGO_REGISTRY:-$PWD/debian/cargo_registry}"
+export CFLAGS="${CFLAGS:-}"
+export CXXFLAGS="${CXXFLAGS:-}"
+export CPPFLAGS="${CPPFLAGS:-}"
+export LDFLAGS="${LDFLAGS:-}"
+export DEB_CARGO_CRATE="${DEB_CARGO_CRATE:-glome_0}"
+export DEB_CARGO_INSTALL_PREFIX="${DEB_CARGO_INSTALL_PREFIX:-/usr/local}"
+
+eval "$(dpkg-architecture -s)"
+export DEB_HOST_GNU_TYPE
+
+# shellcheck disable=SC2016
+DEB_HOST_RUST_TYPE="$(printf 'include /usr/share/rustc/architecture.mk\nall:\n\techo $(DEB_HOST_RUST_TYPE)\n' | make --no-print-directory -sf -)"
+export DEB_HOST_RUST_TYPE
+
+rm -f rust/Cargo.lock
+cd rust && $CARGO "$@"
diff --git a/kokoro/rodete/fetch_dependencies.sh b/kokoro/rodete/fetch_dependencies.sh
index 15833a98..ea2a25f2 100755
--- a/kokoro/rodete/fetch_dependencies.sh
+++ b/kokoro/rodete/fetch_dependencies.sh
@@ -5,4 +5,7 @@ export DEBIAN_FRONTEND=noninteractive
 apt-get update
 apt-get install -y --no-install-recommends \
   build-essential meson pkg-config \
-  libssl-dev libglib2.0-dev libpam0g-dev libpam-wrapper libpamtest0-dev
+  libssl-dev libglib2.0-dev libpam0g-dev libpam-wrapper libpamtest0-dev \
+  cargo rustc librust-base64-dev librust-clap-derive-dev librust-clap-dev \
+  librust-hmac-dev librust-sha2-dev librust-x25519-dalek-dev libstd-rust-dev \
+  librust-hex-dev librust-hex-literal-dev librust-tempfile-dev librust-yaml-rust2-dev
diff --git a/login/README.md b/login/README.md
index ac6eb9f2..648bdb99 100644
--- a/login/README.md
+++ b/login/README.md
@@ -103,7 +103,7 @@ to test `glome-login` and the PAM module.
 Docker image for GLOME needs to be built first using the following command:
 
 ```
-$ docker build -t glome -f kokoro/docker/Dockerfile .
+$ docker buildx build -t glome -f kokoro/docker/Dockerfile .
 ```
 
 ## Usage
diff --git a/meson.build b/meson.build
index a23b0b0c..92a9051c 100644
--- a/meson.build
+++ b/meson.build
@@ -39,7 +39,3 @@ if get_option('tests')
 endif
 
 subdir('login')
-
-if get_option('glome-cli')
-    subdir('cli')
-endif
diff --git a/meson_options.txt b/meson_options.txt
index a43551c6..6a22a648 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -14,4 +14,3 @@
 
 option('tests', type: 'boolean', description: 'Build tests')
 option('pam-glome', type: 'boolean', description: 'Build glome PAM module')
-option('glome-cli', type: 'boolean', description: 'Build glome CLI tool')
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 3427f71b..8548e0a1 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -23,15 +23,15 @@ x25519-dalek = { version = "2.0", features = ["getrandom", "static_secrets"], op
 openssl = { version = "0.10", optional = true }
 
 # cli
-base64 = { version = "0.21", optional = true }
+base64 = { version = ">=0.21", optional = true }
 clap = { version = "4", features = ["derive"], optional = true}
 
 [dev-dependencies]
 # test
 hex = "0.4"
-hex-literal = "0.3"
+hex-literal = ">=0.3"
 tempfile = "3.14.0"
-yaml-rust2 = "0.9"
+yaml-rust2 = ">=0.9"
 
 [lib]
 name = "glome"
diff --git a/cli/README.md b/rust/src/cli/README.md
similarity index 86%
rename from cli/README.md
rename to rust/src/cli/README.md
index 61ff49cb..778630ae 100644
--- a/cli/README.md
+++ b/rust/src/cli/README.md
@@ -23,7 +23,7 @@ _QuyLz_nkj5exUJscocS8LDnCMszvSmp9wpQuRshi30=
 Bob can verify that the tag matches:
 
 ```shell
-$ echo "Hello world!" | glome verify --key Bob --peer Alice.pub --tag "${tag?}"
+$ echo "Hello world!" | glome verify --key Bob --peer Alice.pub "${tag?}"
 
 $ echo $?
 0
@@ -32,7 +32,7 @@ $ echo $?
 Both parties can agree to shorten the tag to reduce the protocol overhead:
 
 ```shell
-$ echo "Hello world!" | glome verify --key Bob --peer Alice.pub --tag "${tag:0:12}"
+$ echo "Hello world!" | glome verify --key Bob --peer Alice.pub "${tag:0:12}"
 
 $ echo $?
 0
@@ -41,6 +41,6 @@ $ echo $?
 CLI also supports ganerating tags for the GLOME Login requests:
 
 ```shell
-$ glome login --key Bob v1/AYUg8AmJMKdUdIt93LQ-91oNvzoNJjga9OukqY6qm05q0PU=/my-server.local/shell/root/
+$ glome login --key Bob v2/gZ1iVXtwP0yuWtTBYPmAUB2oAnzhsPl7FDbzgAyby_MX/my-server.local/shell=root/
 MT_Zc-hucXRjTXTBEo53ehoeUsFn1oFyVadViXf-I4k=
 ```