diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 00000000..1cd5d08e
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,2 @@
+[alias]
+xtask = "run --quiet --release -p xtask --"
diff --git a/Cargo.lock b/Cargo.lock
index f405a645..c42b45d1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -324,6 +324,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bitflags"
 version = "2.11.0"
@@ -498,6 +504,12 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -648,6 +660,17 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "derive_more"
 version = "2.1.1"
@@ -677,6 +700,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
+ "const-oid",
  "crypto-common",
  "subtle",
 ]
@@ -1283,6 +1307,15 @@ dependencies = [
  "log",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
 [[package]]
 name = "leb128fmt"
 version = "0.1.0"
@@ -1295,6 +1328,12 @@ version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
 [[package]]
 name = "libredox"
 version = "0.1.15"
@@ -1425,6 +1464,22 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -1472,6 +1527,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
+ "libm",
 ]
 
 [[package]]
@@ -1543,6 +1599,15 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -1572,6 +1637,27 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -1595,6 +1681,15 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -1638,6 +1733,36 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
 [[package]]
 name = "ratatui"
 version = "0.29.0"
@@ -1758,8 +1883,11 @@ dependencies = [
  "anyhow",
  "directories",
  "libc",
+ "rand",
+ "rsa",
  "serde",
  "serde_json",
+ "sha2",
  "ureq",
  "windows-sys 0.61.2",
 ]
@@ -1876,6 +2004,26 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rtoolbox"
 version = "0.0.5"
@@ -2191,6 +2339,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
@@ -2219,6 +2377,22 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -2981,6 +3155,15 @@ dependencies = [
  "rustix 1.1.4",
 ]
 
+[[package]]
+name = "xtask"
+version = "0.3.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "rocm-core",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.2"
@@ -3077,6 +3260,26 @@ dependencies = [
  "zvariant",
 ]
 
+[[package]]
+name = "zerocopy"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "zerofrom"
 version = "0.1.8"
diff --git a/Cargo.toml b/Cargo.toml
index ab6425aa..7e316218 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,6 +10,7 @@ members = [
   "engines/lemonade",
   "engines/sglang",
   "engines/vllm",
+  "xtask",
 ]
 resolver = "2"
 
@@ -29,10 +30,13 @@ crossterm = { version = "0.29", features = ["libc", "use-dev-tty"] }
 directories = "6.0"
 keyring-core = "1.0.0"
 libc = "0.2"
+rand = "0.8"
 ratatui = { version = "0.29", features = ["unstable-rendered-line-info"] }
 rpassword = "7.5"
+rsa = "0.9"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+sha2 = { version = "0.10", features = ["oid"] }
 tokio = { version = "1.48", features = ["macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
 
 [workspace.lints.rust]
diff --git a/apps/rocm/src/therock.rs b/apps/rocm/src/therock.rs
index f98ac131..6f067a09 100644
--- a/apps/rocm/src/therock.rs
+++ b/apps/rocm/src/therock.rs
@@ -7,7 +7,10 @@ use rocm_core::{
     normalize_therock_family, platform_binary_name, runtime_is_windows, runtime_os_name,
     runtime_path_for_windows_child, runtime_path_list_split, runtime_python_executable_in_env,
     unix_time_millis, uv_command_env, uv_pip_install_base, uv_venv_args,
+    verify_rsa_pkcs1_sha256_signature,
 };
+#[cfg(test)]
+use rocm_core::{generate_rsa_signing_keypair, sign_rsa_pkcs1_sha256_signature};
 use serde::{Deserialize, Serialize};
 use std::cmp::Ordering;
 use std::fs;
@@ -1775,7 +1778,7 @@ fn fetch_and_verify_metadata_signature(
     download_signature_file(&signature_url, signature_path, max_time_secs)?;
     let public_key_source =
         with_metadata_public_key(policy, temp_key_path, |public_key, source| {
-            verify_signature_with_openssl(payload_path, signature_path, public_key)?;
+            verify_metadata_signature(payload_path, signature_path, public_key)?;
             Ok(source.to_owned())
         })?
         .context("metadata signature policy was active but no public key was resolved")?;
@@ -1802,7 +1805,7 @@ fn verify_cached_metadata_signature(
         );
     }
     with_metadata_public_key(policy, temp_key_path, |public_key, _source| {
-        verify_signature_with_openssl(payload_path, signature_path, public_key)
+        verify_metadata_signature(payload_path, signature_path, public_key)
     })?;
     Ok(())
 }
@@ -1828,36 +1831,30 @@ fn download_signature_file(
     Ok(())
 }
 
-fn verify_signature_with_openssl(
+fn verify_metadata_signature(
     payload_path: &Path,
     signature_path: &Path,
     public_key_path: &Path,
 ) -> Result<()> {
-    let output = capture_command_output(
-        Path::new("openssl"),
-        &[
-            "dgst",
-            "-sha256",
-            "-verify",
-            public_key_path.to_string_lossy().as_ref(),
-            "-signature",
-            signature_path.to_string_lossy().as_ref(),
-            payload_path.to_string_lossy().as_ref(),
-        ],
-    )
-    .context("failed to launch openssl for metadata signature verification")?;
-    if !output.status.success() {
-        let detail = String::from_utf8_lossy(&output.stderr).trim().to_owned();
-        bail!(
-            "metadata signature verification failed{}",
-            if detail.is_empty() {
-                String::new()
-            } else {
-                format!(": {detail}")
-            }
-        );
-    }
-    Ok(())
+    let public_key_pem = fs::read_to_string(public_key_path).with_context(|| {
+        format!(
+            "failed to read metadata public key: {}",
+            public_key_path.display()
+        )
+    })?;
+    let signature = fs::read(signature_path).with_context(|| {
+        format!(
+            "failed to read metadata signature: {}",
+            signature_path.display()
+        )
+    })?;
+    let payload = fs::read(payload_path).with_context(|| {
+        format!(
+            "failed to read metadata payload: {}",
+            payload_path.display()
+        )
+    })?;
+    verify_rsa_pkcs1_sha256_signature(&public_key_pem, &payload, &signature, "metadata")
 }
 
 fn metadata_cache_can_revalidate(
@@ -4343,48 +4340,17 @@ echo Python 3.12.10
     }
 
     fn generate_test_signing_key(private_key: &Path, public_key: &Path) -> Result<()> {
-        run_test_openssl(&[
-            "genpkey",
-            "-algorithm",
-            "RSA",
-            "-pkeyopt",
-            "rsa_keygen_bits:2048",
-            "-out",
-            private_key.to_string_lossy().as_ref(),
-        ])?;
-        run_test_openssl(&[
-            "rsa",
-            "-in",
-            private_key.to_string_lossy().as_ref(),
-            "-pubout",
-            "-out",
-            public_key.to_string_lossy().as_ref(),
-        ])
+        let (private_pem, public_pem) = generate_rsa_signing_keypair()?;
+        fs::write(private_key, private_pem.as_bytes())?;
+        fs::write(public_key, public_pem.as_bytes())?;
+        Ok(())
     }
 
     fn sign_test_payload(private_key: &Path, payload: &Path, signature: &Path) -> Result<()> {
-        run_test_openssl(&[
-            "dgst",
-            "-sha256",
-            "-sign",
-            private_key.to_string_lossy().as_ref(),
-            "-out",
-            signature.to_string_lossy().as_ref(),
-            payload.to_string_lossy().as_ref(),
-        ])
-    }
-
-    fn run_test_openssl(args: &[&str]) -> Result<()> {
-        let output = Command::new("openssl")
-            .args(args)
-            .output()
-            .context("failed to launch openssl for signature test")?;
-        if !output.status.success() {
-            bail!(
-                "openssl signature test command failed: {}",
-                String::from_utf8_lossy(&output.stderr).trim()
-            );
-        }
+        let private_pem = fs::read_to_string(private_key)?;
+        let payload_bytes = fs::read(payload)?;
+        let produced = sign_rsa_pkcs1_sha256_signature(&private_pem, &payload_bytes)?;
+        fs::write(signature, produced)?;
         Ok(())
     }
 
diff --git a/crates/rocm-core/Cargo.toml b/crates/rocm-core/Cargo.toml
index cae4794d..63cd6696 100644
--- a/crates/rocm-core/Cargo.toml
+++ b/crates/rocm-core/Cargo.toml
@@ -10,8 +10,11 @@ rust-version.workspace = true
 anyhow.workspace = true
 directories.workspace = true
 libc.workspace = true
+rand.workspace = true
+rsa.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+sha2.workspace = true
 ureq = { version = "2.12", features = ["native-certs"] }
 
 [target.'cfg(target_os = "windows")'.dependencies]
diff --git a/crates/rocm-core/src/lib.rs b/crates/rocm-core/src/lib.rs
index 304849ab..a4037095 100644
--- a/crates/rocm-core/src/lib.rs
+++ b/crates/rocm-core/src/lib.rs
@@ -4603,6 +4603,96 @@ pub fn model_recipe_index_signature_path(index_path: &Path) -> PathBuf {
     PathBuf::from(signature)
 }
 
+/// Normalize a PEM document the way the OpenSSL CLI tolerated input, so keys
+/// produced or copied through other tooling still parse with the strict RFC 7468
+/// reader. Strips a leading UTF-8 BOM, accepts any line-ending style (CRLF, lone
+/// CR, or LF), and drops trailing whitespace from each line — Windows tooling
+/// (e.g. PowerShell `Set-Content`) can introduce CRLF or a stray trailing space
+/// on the `-----BEGIN ...-----` boundary that the parser would otherwise reject.
+fn normalize_pem(pem: &str) -> String {
+    let without_bom = pem.strip_prefix('\u{feff}').unwrap_or(pem);
+    let unified = without_bom.replace("\r\n", "\n").replace('\r', "\n");
+    let mut normalized: String = unified
+        .split('\n')
+        .map(|line| line.trim_end_matches([' ', '\t']))
+        .filter(|line| !line.is_empty())
+        .collect::<Vec<_>>()
+        .join("\n");
+    normalized.push('\n');
+    normalized
+}
+
+/// Verify an RSASSA-PKCS#1 v1.5 signature over SHA-256 using a pure-Rust
+/// implementation, with no external `openssl` process.
+///
+/// `public_key_pem` is a SubjectPublicKeyInfo PEM (`-----BEGIN PUBLIC KEY-----`),
+/// exactly what `openssl rsa -pubout` emits and what `openssl dgst -sha256 -verify`
+/// consumes, so verification is byte-compatible with that command. `label` names the
+/// artifact being checked (e.g. `"metadata"`); on a bad signature the error reads
+/// `"<label> signature verification failed"` to preserve existing diagnostics.
+pub fn verify_rsa_pkcs1_sha256_signature(
+    public_key_pem: &str,
+    payload: &[u8],
+    signature: &[u8],
+    label: &str,
+) -> Result<()> {
+    use rsa::RsaPublicKey;
+    use rsa::pkcs1v15::{Signature, VerifyingKey};
+    use rsa::pkcs8::DecodePublicKey;
+    use rsa::signature::Verifier;
+    use sha2::Sha256;
+
+    let public_key = RsaPublicKey::from_public_key_pem(&normalize_pem(public_key_pem))
+        .with_context(|| format!("{label} public key is not a valid RSA public key"))?;
+    let signature = Signature::try_from(signature)
+        .with_context(|| format!("{label} signature is malformed"))?;
+    VerifyingKey::<Sha256>::new(public_key)
+        .verify(payload, &signature)
+        .map_err(|error| anyhow::anyhow!("{label} signature verification failed: {error}"))
+}
+
+/// Produce an RSASSA-PKCS#1 v1.5 signature over SHA-256 with a pure-Rust
+/// implementation, with no external `openssl` process.
+///
+/// `private_key_pem` is a PKCS#8 private-key PEM (`-----BEGIN PRIVATE KEY-----`),
+/// as emitted by `openssl genpkey`. The signature is deterministic and
+/// byte-identical to `openssl dgst -sha256 -sign`, so artifacts signed here verify
+/// with either implementation.
+pub fn sign_rsa_pkcs1_sha256_signature(private_key_pem: &str, payload: &[u8]) -> Result<Vec<u8>> {
+    use rsa::RsaPrivateKey;
+    use rsa::pkcs1v15::SigningKey;
+    use rsa::pkcs8::DecodePrivateKey;
+    use rsa::signature::{SignatureEncoding, Signer};
+    use sha2::Sha256;
+
+    let private_key = RsaPrivateKey::from_pkcs8_pem(&normalize_pem(private_key_pem))
+        .context("signing private key is not a valid PKCS#8 RSA private key")?;
+    let signature = SigningKey::<Sha256>::new(private_key)
+        .try_sign(payload)
+        .context("failed to produce RSA signature")?;
+    Ok(signature.to_bytes().into_vec())
+}
+
+/// Generate a fresh 2048-bit RSA signing keypair, returned as
+/// `(PKCS#8 private-key PEM, SubjectPublicKeyInfo public-key PEM)` — the same
+/// formats `openssl genpkey` / `openssl rsa -pubout` produce.
+pub fn generate_rsa_signing_keypair() -> Result<(String, String)> {
+    use rsa::RsaPrivateKey;
+    use rsa::pkcs8::{EncodePrivateKey, EncodePublicKey, LineEnding};
+
+    let mut rng = rand::thread_rng();
+    let private_key =
+        RsaPrivateKey::new(&mut rng, 2048).context("failed to generate RSA signing key")?;
+    let private_pem = private_key
+        .to_pkcs8_pem(LineEnding::LF)
+        .context("failed to encode private key")?
+        .to_string();
+    let public_pem = rsa::RsaPublicKey::from(&private_key)
+        .to_public_key_pem(LineEnding::LF)
+        .context("failed to encode public key")?;
+    Ok((private_pem, public_pem))
+}
+
 pub fn verify_model_recipe_index_signature(
     index_path: &Path,
     signature_path: &Path,
@@ -4620,31 +4710,25 @@ pub fn verify_model_recipe_index_signature(
             public_key_path.display()
         );
     }
-    let output = Command::new("openssl")
-        .args([
-            "dgst",
-            "-sha256",
-            "-verify",
-            public_key_path.to_string_lossy().as_ref(),
-            "-signature",
-            signature_path.to_string_lossy().as_ref(),
-            index_path.to_string_lossy().as_ref(),
-        ])
-        .stderr(Stdio::piped())
-        .output()
-        .context("failed to launch openssl for model recipe index signature verification")?;
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        bail!(
-            "model recipe index signature verification failed{}",
-            if stderr.trim().is_empty() {
-                String::new()
-            } else {
-                format!(": {}", stderr.trim())
-            }
-        );
-    }
-    Ok(())
+    let public_key_pem = fs::read_to_string(public_key_path).with_context(|| {
+        format!(
+            "failed to read model recipe index public key: {}",
+            public_key_path.display()
+        )
+    })?;
+    let signature = fs::read(signature_path).with_context(|| {
+        format!(
+            "failed to read model recipe index signature: {}",
+            signature_path.display()
+        )
+    })?;
+    let payload = fs::read(index_path).with_context(|| {
+        format!(
+            "failed to read model recipe index: {}",
+            index_path.display()
+        )
+    })?;
+    verify_rsa_pkcs1_sha256_signature(&public_key_pem, &payload, &signature, "model recipe index")
 }
 
 fn validate_model_device_policy(policy: &str) -> Result<()> {
@@ -6678,8 +6762,25 @@ Class Name:                Display
         Ok(())
     }
 
-    fn generate_test_signing_key(private_key: &Path, public_key: &Path) -> Result<()> {
-        run_test_openssl(&[
+    /// Produce a `(private-key PEM, SPKI public-key PEM, payload, signature)`
+    /// tuple with the OpenSSL CLI, the same tool the installers and release
+    /// signing use (`install.sh`, `scripts/package-linux-release.sh`). Returns
+    /// `None` when openssl is unavailable or its spawn fails, so this interop
+    /// guard never reintroduces the build-failing flake we removed: the pure-Rust
+    /// sign/verify path is fully covered by the round-trip test, and this only
+    /// adds cross-checking against real openssl output where openssl exists.
+    fn openssl_signed_vector(dir: &Path) -> Option<(String, String, Vec<u8>, Vec<u8>)> {
+        let private_key = dir.join("interop-private.pem");
+        let public_key = dir.join("interop-public.pem");
+        let payload_path = dir.join("interop-payload.bin");
+        let signature_path = dir.join("interop.sig");
+        fs::write(&payload_path, b"version = 1\n").ok()?;
+
+        let run = |args: &[&str]| -> Option<()> {
+            let output = Command::new("openssl").args(args).output().ok()?;
+            output.status.success().then_some(())
+        };
+        run(&[
             "genpkey",
             "-algorithm",
             "RSA",
@@ -6688,39 +6789,133 @@ Class Name:                Display
             "-out",
             private_key.to_string_lossy().as_ref(),
         ])?;
-        run_test_openssl(&[
+        run(&[
             "rsa",
             "-in",
             private_key.to_string_lossy().as_ref(),
             "-pubout",
             "-out",
             public_key.to_string_lossy().as_ref(),
-        ])
-    }
-
-    fn sign_test_payload(private_key: &Path, payload: &Path, signature: &Path) -> Result<()> {
-        run_test_openssl(&[
+        ])?;
+        run(&[
             "dgst",
             "-sha256",
             "-sign",
             private_key.to_string_lossy().as_ref(),
             "-out",
-            signature.to_string_lossy().as_ref(),
-            payload.to_string_lossy().as_ref(),
-        ])
+            signature_path.to_string_lossy().as_ref(),
+            payload_path.to_string_lossy().as_ref(),
+        ])?;
+
+        Some((
+            fs::read_to_string(&private_key).ok()?,
+            fs::read_to_string(&public_key).ok()?,
+            fs::read(&payload_path).ok()?,
+            fs::read(&signature_path).ok()?,
+        ))
     }
 
-    fn run_test_openssl(args: &[&str]) -> Result<()> {
-        let output = Command::new("openssl")
-            .args(args)
-            .output()
-            .context("failed to launch openssl for model recipe signature test")?;
-        if !output.status.success() {
-            bail!(
-                "openssl model recipe signature test command failed: {}",
-                String::from_utf8_lossy(&output.stderr).trim()
-            );
+    #[test]
+    fn signing_tolerates_crlf_and_trailing_whitespace_pems() -> Result<()> {
+        // Windows tooling (PowerShell Set-Content, editors) can rewrite a PEM with
+        // CRLF endings, a stray trailing space on the boundary line, or a UTF-8 BOM.
+        // The OpenSSL CLI accepted these, so the Rust path must too.
+        let (private_pem, public_pem) = generate_rsa_signing_keypair()?;
+        let payload = b"version = 1\n";
+
+        let crlf_private = private_pem.replace('\n', "\r\n");
+        let trailing_ws_private = private_pem
+            .lines()
+            .map(|line| format!("{line} "))
+            .collect::<Vec<_>>()
+            .join("\n");
+        let bom_public = format!("\u{feff}{public_pem}");
+
+        for variant in [crlf_private, trailing_ws_private] {
+            let signature = sign_rsa_pkcs1_sha256_signature(&variant, payload)?;
+            verify_rsa_pkcs1_sha256_signature(&public_pem, payload, &signature, "metadata")?;
         }
+        let signature = sign_rsa_pkcs1_sha256_signature(&private_pem, payload)?;
+        verify_rsa_pkcs1_sha256_signature(&bom_public, payload, &signature, "metadata")?;
+        Ok(())
+    }
+
+    #[test]
+    fn rsa_sign_verify_round_trips_in_pure_rust() -> Result<()> {
+        let (private_pem, public_pem) = generate_rsa_signing_keypair()?;
+        let payload = b"version = 1\n";
+
+        let signature = sign_rsa_pkcs1_sha256_signature(&private_pem, payload)?;
+        verify_rsa_pkcs1_sha256_signature(&public_pem, payload, &signature, "metadata")?;
+
+        let mut tampered = payload.to_vec();
+        tampered[0] ^= 0x01;
+        let error =
+            verify_rsa_pkcs1_sha256_signature(&public_pem, &tampered, &signature, "metadata")
+                .expect_err("a tampered payload must be rejected")
+                .to_string();
+        assert!(error.contains("metadata signature verification failed"));
+        Ok(())
+    }
+
+    #[test]
+    fn rsa_verifier_is_byte_compatible_with_openssl_output() -> Result<()> {
+        let (root, _paths) = temp_app_paths("openssl-interop-vector");
+        fs::create_dir_all(&root)?;
+        let Some((private_key_pem, public_key_pem, payload, openssl_signature)) =
+            openssl_signed_vector(&root)
+        else {
+            eprintln!(
+                "skipping openssl interop check: openssl CLI unavailable or failed to produce a signature"
+            );
+            fs::remove_dir_all(&root).ok();
+            return Ok(());
+        };
+
+        // Our verifier accepts a signature produced by the openssl CLI.
+        verify_rsa_pkcs1_sha256_signature(
+            &public_key_pem,
+            &payload,
+            &openssl_signature,
+            "metadata",
+        )
+        .expect("pure-Rust verifier must accept an openssl-produced signature");
+
+        // Our signer is byte-identical to `openssl dgst -sha256 -sign`, so artifacts
+        // signed by the Rust xtask verify with the openssl-based installers and vice-versa.
+        let rust_signature = sign_rsa_pkcs1_sha256_signature(&private_key_pem, &payload)?;
+        assert_eq!(
+            rust_signature, openssl_signature,
+            "Rust signature must match openssl byte-for-byte"
+        );
+
+        let mut tampered = payload.clone();
+        tampered[0] ^= 0x01;
+        let error = verify_rsa_pkcs1_sha256_signature(
+            &public_key_pem,
+            &tampered,
+            &openssl_signature,
+            "metadata",
+        )
+        .expect_err("a tampered payload must be rejected")
+        .to_string();
+        assert!(error.contains("metadata signature verification failed"));
+        fs::remove_dir_all(&root).ok();
+        Ok(())
+    }
+
+    fn generate_test_signing_key(private_key: &Path, public_key: &Path) -> Result<()> {
+        let (private_pem, public_pem) = generate_rsa_signing_keypair()?;
+        fs::write(private_key, private_pem.as_bytes())?;
+        fs::write(public_key, public_pem.as_bytes())?;
+        Ok(())
+    }
+
+    fn sign_test_payload(private_key: &Path, payload: &Path, signature: &Path) -> Result<()> {
+        let private_pem = fs::read_to_string(private_key)?;
+        let payload_bytes = fs::read(payload)?;
+        let produced = sign_rsa_pkcs1_sha256_signature(&private_pem, &payload_bytes)?;
+        fs::write(signature, produced)?;
         Ok(())
     }
 
diff --git a/scripts/acceptance-install-upgrade-tui-uninstall.ps1 b/scripts/acceptance-install-upgrade-tui-uninstall.ps1
index 3116911d..76da9850 100644
--- a/scripts/acceptance-install-upgrade-tui-uninstall.ps1
+++ b/scripts/acceptance-install-upgrade-tui-uninstall.ps1
@@ -157,23 +157,24 @@ try {
     $psExe = $psCommand.Source
 
     $cargoExe = Resolve-CommandPath "cargo" (Join-Path $env:USERPROFILE ".cargo\bin\cargo.exe")
-    $opensslExe = Resolve-CommandPath "openssl"
 
     $signingPrivateKey = Join-Path $AcceptanceRoot "signing-private.pem"
     $signingPublicKey = Join-Path $AcceptanceRoot "signing-public.pem"
-    & $opensslExe genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out $signingPrivateKey | Out-Null
-    if ($LASTEXITCODE -ne 0) {
-        Fail "failed to generate acceptance signing private key"
+    Push-Location $RepoRoot
+    try {
+        & $cargoExe xtask keygen --private-out $signingPrivateKey --public-out $signingPublicKey | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            Fail "failed to generate acceptance signing keypair"
+        }
     }
-    & $opensslExe rsa -in $signingPrivateKey -pubout -out $signingPublicKey | Out-Null
-    if ($LASTEXITCODE -ne 0) {
-        Fail "failed to generate acceptance signing public key"
+    finally {
+        Pop-Location
     }
 
     Write-Host "acceptance: build release binaries"
     Push-Location $RepoRoot
     try {
-        & $cargoExe build --release -p rocm -p rocmd -p rocm-engine-pytorch -p rocm-engine-llama-cpp -p rocm-engine-lemonade -p rocm-engine-atom -p rocm-engine-vllm -p rocm-engine-sglang
+        & $cargoExe build --release -p rocm -p rocmd -p rocm-engine-pytorch -p rocm-engine-llama-cpp -p rocm-engine-lemonade -p rocm-engine-atom -p rocm-engine-vllm -p rocm-engine-sglang -p xtask
         if ($LASTEXITCODE -ne 0) {
             Fail "cargo build failed"
         }
diff --git a/scripts/acceptance-install-upgrade-tui-uninstall.sh b/scripts/acceptance-install-upgrade-tui-uninstall.sh
index 77e38be8..9b3521c0 100755
--- a/scripts/acceptance-install-upgrade-tui-uninstall.sh
+++ b/scripts/acceptance-install-upgrade-tui-uninstall.sh
@@ -106,13 +106,13 @@ expect_failure() {
 }
 
 echo "acceptance: build release binaries"
-(cd "${REPO_ROOT}" && cargo build --release -p rocm -p rocmd -p rocm-engine-pytorch -p rocm-engine-llama-cpp -p rocm-engine-lemonade -p rocm-engine-atom -p rocm-engine-vllm -p rocm-engine-sglang)
+(cd "${REPO_ROOT}" && cargo build --release -p rocm -p rocmd -p rocm-engine-pytorch -p rocm-engine-llama-cpp -p rocm-engine-lemonade -p rocm-engine-atom -p rocm-engine-vllm -p rocm-engine-sglang -p xtask)
 
 echo "acceptance: generate signing key"
-openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "${SIGNING_PRIVATE_KEY}" >/dev/null 2>&1 \
-  || fail "failed to generate acceptance signing private key"
-openssl rsa -in "${SIGNING_PRIVATE_KEY}" -pubout -out "${SIGNING_PUBLIC_KEY}" >/dev/null 2>&1 \
-  || fail "failed to generate acceptance signing public key"
+(cd "${REPO_ROOT}" && cargo xtask keygen \
+  --private-out "${SIGNING_PRIVATE_KEY}" \
+  --public-out "${SIGNING_PUBLIC_KEY}") \
+  || fail "failed to generate acceptance signing keypair"
 
 echo "acceptance: package local release bundle"
 (cd "${REPO_ROOT}" && \
diff --git a/scripts/package-linux-release.sh b/scripts/package-linux-release.sh
index a4bc79f9..2cd4ecd9 100755
--- a/scripts/package-linux-release.sh
+++ b/scripts/package-linux-release.sh
@@ -50,8 +50,8 @@ if [[ "${SIGNATURE_REQUIRED}" =~ ^(1|true|TRUE|yes|YES|on|ON)$ && "${SIGNATURE_A
 fi
 
 if [[ "${SIGNATURE_AVAILABLE}" -eq 1 ]]; then
-  command -v openssl >/dev/null 2>&1 || {
-    echo "missing required command for signing: openssl" >&2
+  command -v cargo >/dev/null 2>&1 || {
+    echo "missing required command for signing: cargo" >&2
     exit 1
   }
   SIGNING_TMP_DIR="${OUTPUT_DIR}/.signing-tmp-$$"
@@ -63,7 +63,10 @@ if [[ "${SIGNATURE_AVAILABLE}" -eq 1 ]]; then
     SIGNING_PRIVATE_KEY="${SIGNING_TMP_DIR}/rocm-cli-signing-private-key.pem"
     printf '%s\n' "${ROCM_CLI_SIGNING_PRIVATE_KEY_PEM}" > "${SIGNING_PRIVATE_KEY}"
   fi
-  openssl dgst -sha256 -sign "${SIGNING_PRIVATE_KEY}" -out "${ARCHIVE_PATH}.sig" "${ARCHIVE_PATH}"
+  cargo xtask sign \
+    --private-key "${SIGNING_PRIVATE_KEY}" \
+    --in "${ARCHIVE_PATH}" \
+    --out "${ARCHIVE_PATH}.sig"
   rm -rf "${SIGNING_TMP_DIR}"
 fi
 
diff --git a/scripts/package-windows-release.ps1 b/scripts/package-windows-release.ps1
index 9c7d9b3b..8f475df4 100644
--- a/scripts/package-windows-release.ps1
+++ b/scripts/package-windows-release.ps1
@@ -82,10 +82,17 @@ function Write-ArchiveSignature {
     if ([string]::IsNullOrWhiteSpace($PrivateKeyPath)) {
         return
     }
-    $openssl = Resolve-CommandPath "openssl"
-    & $openssl dgst -sha256 -sign $PrivateKeyPath -out "$ArchivePath.sig" $ArchivePath
-    if ($LASTEXITCODE -ne 0) {
-        Fail "failed to sign $ArchivePath"
+    # Run from the repo root so the `cargo xtask` alias in .cargo/config.toml resolves
+    # regardless of the caller's working directory.
+    Push-Location $repoRoot
+    try {
+        & $cargoExe xtask sign --private-key $PrivateKeyPath --in $ArchivePath --out "$ArchivePath.sig"
+        if ($LASTEXITCODE -ne 0) {
+            Fail "failed to sign $ArchivePath"
+        }
+    }
+    finally {
+        Pop-Location
     }
 }
 
diff --git a/scripts/release_readiness.py b/scripts/release_readiness.py
index ec2b329c..bf76b3be 100644
--- a/scripts/release_readiness.py
+++ b/scripts/release_readiness.py
@@ -16,6 +16,7 @@
 import zipfile
 from pathlib import Path
 
+
 ARCHIVE_SUFFIXES = (".tar.gz", ".zip")
 ROCM_RELEASE_ASSET_RE = re.compile(
     r"^rocm-cli-(?:(?:v[0-9][A-Za-z0-9._+-]*|nightly(?:-[0-9]{8}-[0-9A-Fa-f]+)?)-)?"
@@ -347,20 +348,25 @@ def validate_archive_contents(archive: Path) -> list[str]:
 def verify_signature(archive: Path, signature: Path, public_key: Path) -> None:
     if not public_key.is_file():
         raise ReadinessError(f"public key does not exist: {public_key}")
-    openssl = shutil.which("openssl")
-    if openssl is None:
-        raise ReadinessError("openssl is required for signature verification")
+    cargo = shutil.which("cargo")
+    if cargo is None:
+        raise ReadinessError("cargo is required for signature verification")
+    # Resolve to absolute paths because the subprocess runs from the repo root
+    # (so the `cargo xtask` alias resolves); relative paths would otherwise be
+    # interpreted against the repo root rather than the caller's working directory.
     completed = subprocess.run(
         [
-            openssl,
-            "dgst",
-            "-sha256",
-            "-verify",
-            str(public_key),
-            "-signature",
-            str(signature),
-            str(archive),
+            cargo,
+            "xtask",
+            "verify",
+            "--public-key",
+            str(public_key.resolve()),
+            "--in",
+            str(archive.resolve()),
+            "--signature",
+            str(signature.resolve()),
         ],
+        cwd=repo_root(),
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
         text=True,
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
new file mode 100644
index 00000000..3052f0c0
--- /dev/null
+++ b/xtask/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "xtask"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+publish = false
+
+[dependencies]
+anyhow.workspace = true
+clap.workspace = true
+rocm-core = { path = "../crates/rocm-core" }
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
new file mode 100644
index 00000000..1f619cb1
--- /dev/null
+++ b/xtask/src/main.rs
@@ -0,0 +1,142 @@
+//! Repository task runner.
+//!
+//! Currently provides the release-artifact signing toolchain in pure Rust so the
+//! project's signing, CI verification, and test keygen no longer depend on the
+//! `openssl` CLI. Run via the workspace alias `cargo xtask <command>`.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::ExitCode;
+
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
+use rocm_core::{
+    generate_rsa_signing_keypair, sign_rsa_pkcs1_sha256_signature,
+    verify_rsa_pkcs1_sha256_signature,
+};
+
+#[derive(Parser)]
+#[command(name = "xtask", about = "rocm-cli repository tasks")]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Subcommand)]
+enum Command {
+    /// Generate a 2048-bit RSA signing keypair (PKCS#8 private + SPKI public PEM).
+    Keygen {
+        /// Path to write the PKCS#8 private-key PEM.
+        #[arg(long)]
+        private_out: PathBuf,
+        /// Path to write the SubjectPublicKeyInfo public-key PEM.
+        #[arg(long)]
+        public_out: PathBuf,
+    },
+    /// Sign a file with an RSA private key (RSASSA-PKCS#1 v1.5 over SHA-256).
+    Sign {
+        /// Path to the PKCS#8 private-key PEM.
+        #[arg(long)]
+        private_key: PathBuf,
+        /// File whose contents are signed.
+        #[arg(long = "in")]
+        input: PathBuf,
+        /// Path to write the raw signature bytes.
+        #[arg(long = "out")]
+        output: PathBuf,
+    },
+    /// Verify a file's signature against an RSA public key.
+    Verify {
+        /// Path to the SubjectPublicKeyInfo public-key PEM.
+        #[arg(long)]
+        public_key: PathBuf,
+        /// File whose signature is checked.
+        #[arg(long = "in")]
+        input: PathBuf,
+        /// Path to the raw signature bytes.
+        #[arg(long)]
+        signature: PathBuf,
+    },
+}
+
+/// Write a private-key PEM, restricting it to owner-only (`0o600`) on Unix so the
+/// key is never group- or world-readable. On Unix the file is created with the
+/// restricted mode up front, and any pre-existing file is tightened too.
+fn write_private_key(path: &Path, pem: &str) -> Result<()> {
+    #[cfg(unix)]
+    {
+        use std::io::Write;
+        use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+
+        let mut file = fs::OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .mode(0o600)
+            .open(path)
+            .with_context(|| format!("failed to write {}", path.display()))?;
+        // `.mode()` only applies when creating the file; tighten an existing one too.
+        file.set_permissions(std::fs::Permissions::from_mode(0o600))
+            .with_context(|| format!("failed to restrict permissions on {}", path.display()))?;
+        file.write_all(pem.as_bytes())
+            .with_context(|| format!("failed to write {}", path.display()))?;
+    }
+    #[cfg(not(unix))]
+    {
+        fs::write(path, pem.as_bytes())
+            .with_context(|| format!("failed to write {}", path.display()))?;
+    }
+    Ok(())
+}
+
+fn run() -> Result<()> {
+    match Cli::parse().command {
+        Command::Keygen {
+            private_out,
+            public_out,
+        } => {
+            let (private_pem, public_pem) = generate_rsa_signing_keypair()?;
+            write_private_key(&private_out, &private_pem)?;
+            fs::write(&public_out, public_pem.as_bytes())
+                .with_context(|| format!("failed to write {}", public_out.display()))?;
+        }
+        Command::Sign {
+            private_key,
+            input,
+            output,
+        } => {
+            let private_pem = fs::read_to_string(&private_key)
+                .with_context(|| format!("failed to read {}", private_key.display()))?;
+            let payload =
+                fs::read(&input).with_context(|| format!("failed to read {}", input.display()))?;
+            let signature = sign_rsa_pkcs1_sha256_signature(&private_pem, &payload)?;
+            fs::write(&output, signature)
+                .with_context(|| format!("failed to write {}", output.display()))?;
+        }
+        Command::Verify {
+            public_key,
+            input,
+            signature,
+        } => {
+            let public_pem = fs::read_to_string(&public_key)
+                .with_context(|| format!("failed to read {}", public_key.display()))?;
+            let payload =
+                fs::read(&input).with_context(|| format!("failed to read {}", input.display()))?;
+            let signature_bytes = fs::read(&signature)
+                .with_context(|| format!("failed to read {}", signature.display()))?;
+            let label = input.display().to_string();
+            verify_rsa_pkcs1_sha256_signature(&public_pem, &payload, &signature_bytes, &label)?;
+        }
+    }
+    Ok(())
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("error: {error:#}");
+            ExitCode::FAILURE
+        }
+    }
+}