diff --git a/.github/workflows/integ.yml b/.github/workflows/integ.yml
new file mode 100644
index 0000000..8eac048
--- /dev/null
+++ b/.github/workflows/integ.yml
@@ -0,0 +1,33 @@
+# GitHub Actions - CI for Go to build & test.  See ci-go-cover.yml and linters.yml for code coverage and linters.
+# Taken from: https://github.com/fxamacker/cbor/workflows/ci.yml (thanks!)
+name: integration-tests
+on: [push, pull_request]
+jobs:
+
+  # Test on various OS with specified Go version.
+  tests:
+    name: ubuntu-latest
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/setup-go@v5
+      with:
+        go-version: "1.25.1"
+    - name: Install jq
+      run:
+        sudo apt-get install --yes jq
+    - name: Install Docker
+      run: |
+        curl -fsSL https://get.docker.com | sh
+        sudo usermod -aG docker $USER
+        sudo systemctl restart docker
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Checkout code
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 1
+    - name: Build project
+      run: make
+    - name: Run tests
+      run: |
+        make integ-test
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..b7efcb4
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,9 @@
+[submodule "test/bats"]
+	path = test/bats
+	url = https://github.com/bats-core/bats-core.git
+[submodule "test/test_helper/bats-support"]
+	path = test/test_helper/bats-support
+	url = https://github.com/bats-core/bats-support.git
+[submodule "test/test_helper/bats-assert"]
+	path = test/test_helper/bats-assert
+	url = https://github.com/bats-core/bats-assert.git
diff --git a/Makefile b/Makefile
index 72fb681..1d02d43 100644
--- a/Makefile
+++ b/Makefile
@@ -25,6 +25,12 @@ build:
 test:
 	$(GO) test -tags=test ./... $(TEST_ARGS)
 
+.PHONY: integ-test
+integ-test:
+	@scripts/integration-tests.sh setup
+	@scripts/integration-tests.sh run
+	@scripts/integration-tests.sh teardown
+
 .PHONY: fmt format gofmt
 fmt format gofmt: */*/*.go */*/*/*.go
 	$(GOFMT) -w */*/*.go */*/*/*.go
@@ -43,8 +49,7 @@ cover-report coverage-report report: coverage.out
 
 .PHONY: presubmit
 presubmit:
-	# TODO: increase coverage
-	@$(MAKE) -s test && $(MAKE) -s lint && COVERAGE_THRESHOLD=30% $(MAKE) -s coverage && $(MAKE) -s format
+	@$(MAKE) -s test && $(MAKE) -s lint && $(MAKE) -s coverage && $(MAKE) -s format
 	@if ! $(GIT) diff-index --quiet HEAD --; then \
 		echo -e "\033[1;31mUNCOMMITED CHANGES!\033[0m"; \
 		exit 2; \
@@ -60,15 +65,18 @@ Targets:
         Run unit tests. Use VERBOSE=1 for SQL traces. Set TEST_DB_FILE to
         specify the path for the sqlite DB file to be used for tests (by default
         in-memory DB is used).
+    integ-test:
+        Run integration tests. These rely on a Docker container running database
+        servers.
     lint:
         Run golangci-lint.
     fmt, format, gofmt:
         Run gofmt -w on Go sourcefiles, fixing any formatting issues.
     cover, coverage:
         Report overall test coverage percentage and generate coverage.out. You
-	can specify a space-separated list of packages for which coverage will
-	not be checked by setting IGNORE_COVERAGE. You can specify alternative
-	threshold by setting COVERAGE_THRESHOLD.
+        can specify a space-separated list of packages for which coverage will
+        not be checked by setting IGNORE_COVERAGE. You can specify alternative
+        threshold by setting COVERAGE_THRESHOLD.
     cover-report, coverage-report, report:
         Open a detailed HTML coverage report in default browser.
     presubmit:
diff --git a/README.md b/README.md
index 3bee8a0..866f171 100644
--- a/README.md
+++ b/README.md
@@ -143,3 +143,42 @@ variables. To get then environment variable name, change the setting name to be
 upper case, replace `-` with `_`, and prefix it with `CORIM_STORE_`. E.g. to
 set `no-color` via an environment variable, you would set
 `CORIM_STORE_NO_COLOR=1`.
+
+## Store Design Overview
+
+The store is intended for endorsements, reference values, and trust anchors
+that will be used for attestation verification. These are stored as value and
+key triples, which associate an attesting environment description with
+corresponding measurements and cryptographic keys.
+
+Sets of triples are grouped under "module tags" (corresponding to CoMIDs),
+which are, in turn, associated with "manifests" (corresponding to CoRIMs).
+Module tags group claims (contained in triples) relating to a logical system
+module (hardware, firmware, etc). A manifest acts as an "envelope" containing
+additional metadata about the module tags it contains (such as the validity
+period).
+
+![E-R diagram](misc/corim-store-er-simplified.drawio.png)
+
+The above diagram is a simplified entity-relation diagram for the major
+entities used by the store. It omits some "meta" fields (e.g. foreign keys),
+and only shows the main logical entities within the store. For a complete
+overview of the SQL tables created by the store, please see the [schema
+diagram](misc/corim-store-schema.drawio.png).
+
+### Triple Life Cycle
+
+By default, when triples are added, they are in an inactive state. They must be
+activated in order to become available for use in verification. This decouples
+provisioning values into the store from making them available for verification.
+Triples may also be deactivated (e.g. when the associated attesters have been
+decommissioned), but remain "archived" in the store.
+
+```mermaid
+stateDiagram-v2
+    [*] --> Inactive: add
+    Inactive --> Active: activate
+    Active --> Inactive: deactivate
+    Inactive --> [*]: delete
+    Active --> [*]: delete
+```
diff --git a/cmd/corim-store/cmd/common.go b/cmd/corim-store/cmd/common.go
index f55369a..4c8dc69 100644
--- a/cmd/corim-store/cmd/common.go
+++ b/cmd/corim-store/cmd/common.go
@@ -1,8 +1,16 @@
 package cmd
 
 import (
+	"encoding/base64"
+	"encoding/hex"
 	"fmt"
 	"os"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/spf13/cobra"
+	"github.com/veraison/corim-store/pkg/model"
+	"github.com/veraison/corim/comid"
 )
 
 func CheckErr(msg interface{}) {
@@ -35,3 +43,155 @@ func Green(msg string) string {
 
 	return fmt.Sprintf("\033[1;32m%s\033[0m", msg)
 }
+
+func AddEnviromentFlags(cmd *cobra.Command) {
+	cmd.Flags().StringP("class-id", "C", "", "Environment class ID.")
+	cmd.Flags().StringP("vendor", "V", "", "Environment vendor.")
+	cmd.Flags().StringP("model", "M", "", "Environment model.")
+	cmd.Flags().Int64P("layer", "L", -1, "Environment layer.")
+	cmd.Flags().Int64P("index", "I", -1, "Environment index.")
+	cmd.Flags().StringP("instance-id", "i", "", "Environment instance ID")
+	cmd.Flags().StringP("group-id", "g", "", "Environment group ID")
+}
+
+func BuildEnvironment(cmd *cobra.Command) (*model.Environment, error) {
+	var ret model.Environment
+
+	vendor, err := cmd.Flags().GetString("vendor")
+	if err != nil {
+		return nil, fmt.Errorf("vendor: %w", err)
+	}
+	if vendor != "" {
+		ret.Vendor = &vendor
+	}
+
+	model, err := cmd.Flags().GetString("model")
+	if err != nil {
+		return nil, fmt.Errorf("model: %w", err)
+	}
+	if model != "" {
+		ret.Model = &model
+	}
+
+	layerInt, err := cmd.Flags().GetInt64("layer")
+	if err != nil {
+		return nil, fmt.Errorf("layer: %w", err)
+	}
+	if layerInt > -1 {
+		layer := uint64(layerInt)
+		ret.Layer = &layer
+	}
+
+	indexInt, err := cmd.Flags().GetInt64("index")
+	if err != nil {
+		return nil, fmt.Errorf("index: %w", err)
+	}
+	if indexInt > -1 {
+		index := uint64(indexInt)
+		ret.Index = &index
+	}
+
+	classIDText, err := cmd.Flags().GetString("class-id")
+	if err != nil {
+		return nil, fmt.Errorf("class-id: %w", err)
+	}
+
+	if classIDText != "" {
+		classIDBytes, classIDType, err := parseID(classIDText)
+		if err != nil {
+			return nil, fmt.Errorf("class-id: %w", err)
+		}
+
+		ret.ClassBytes = &classIDBytes
+		if classIDType != "" {
+			ret.ClassType = &classIDType
+		}
+	}
+
+	instanceIDText, err := cmd.Flags().GetString("instance-id")
+	if err != nil {
+		return nil, fmt.Errorf("instance-id: %w", err)
+	}
+
+	if instanceIDText != "" {
+		instanceIDBytes, instanceIDType, err := parseID(instanceIDText)
+		if err != nil {
+			return nil, fmt.Errorf("instance-id: %w", err)
+		}
+
+		ret.InstanceBytes = &instanceIDBytes
+		if instanceIDType != "" {
+			ret.InstanceType = &instanceIDType
+		}
+	}
+
+	groupIDText, err := cmd.Flags().GetString("group-id")
+	if err != nil {
+		return nil, fmt.Errorf("group-id: %w", err)
+	}
+
+	if groupIDText != "" {
+		groupIDBytes, groupIDType, err := parseID(groupIDText)
+		if err != nil {
+			return nil, fmt.Errorf("group-id: %w", err)
+		}
+
+		ret.GroupBytes = &groupIDBytes
+		if groupIDType != "" {
+			ret.GroupType = &groupIDType
+		}
+	}
+
+	return &ret, nil
+}
+
+func RenderEnviroment(env *model.Environment) (string, error) {
+	parts, err := env.RenderParts()
+	if err != nil {
+		return "", err
+	}
+
+	ret := ""
+	for _, part := range parts {
+		ret += fmt.Sprintf("%s: %s\n", part[0], part[1])
+	}
+
+	return ret, nil
+}
+
+func parseID(text string) ([]byte, string, error) {
+	var typeText string
+	var valueText string
+
+	parts := strings.SplitN(text, ":", 2)
+	if len(parts) == 2 {
+		typeText = parts[0]
+		valueText = parts[1]
+	} else {
+		valueText = text
+	}
+
+	switch typeText {
+	case "uuid":
+		ret, err := uuid.Parse(valueText)
+		return ret[:], "uuid", err
+	case "oid":
+		var ret comid.OID
+		if err := ret.FromString(valueText); err != nil {
+			return nil, "oid", err
+		}
+		return []byte(ret), "oid", nil
+	case "hex":
+		ret, err := hex.DecodeString(valueText)
+		return ret, "hex", err
+	default: // assume base64
+		// remove padding
+		valueText = strings.Trim(valueText, "=")
+		// if URL, convert to standard
+		valueText = strings.ReplaceAll(valueText, "-", "+")
+		valueText = strings.ReplaceAll(valueText, "_", "/")
+
+		ret, err := base64.RawStdEncoding.DecodeString(valueText)
+		return ret, typeText, err
+	}
+}
diff --git a/cmd/corim-store/cmd/corim.go b/cmd/corim-store/cmd/corim.go
index cd12ed5..496b792 100644
--- a/cmd/corim-store/cmd/corim.go
+++ b/cmd/corim-store/cmd/corim.go
@@ -14,6 +14,11 @@ import (
 var corimCmd = &cobra.Command{
 	Use:   "corim",
 	Short: "CoRIM-related operations.",
+	Long: `CoRIM-related operations.
+
+Subcommands allow adding and removing CoRIMs from the store. See help for the
+individual subcommands.
+	`,
 
 	Run: func(cmd *cobra.Command, args []string) {
 		CheckErr(runAddCommand(cmd, args))
@@ -23,7 +28,13 @@ var corimCmd = &cobra.Command{
 var addCmd = &cobra.Command{
 	Use:   "add PATH [PATH ...]",
 	Short: "Add a CoRIM's contents to the store.",
-	Args:  cobra.MinimumNArgs(1),
+	Long: `Add a CoRIM's contents to the store.
+
+The specified CoRIM(s) will be parsed and added as a "manifest" to the store.
+Currently, CoRIMs containing only CoMID tags, and CoMID tags containing only
+reference-triple's, endorsed-triple's, and attest-key-triple's, are supported.
+	`,
+	Args: cobra.MinimumNArgs(1),
 
 	Run: func(cmd *cobra.Command, args []string) {
 		CheckErr(runAddCommand(cmd, args))
@@ -33,7 +44,13 @@ var addCmd = &cobra.Command{
 var deleteCmd = &cobra.Command{
 	Use:   "delete PATH_OR_MANIFEST_ID",
 	Short: "Delete data associated with the specified CoRIM or manifest ID.",
-	Args:  cobra.MinimumNArgs(1),
+	Long: `Delete data associated with the specified CoRIM or manifest ID.
+
+You can specify the manifest ID directly, or you can specify a path to a CoRIM, in which case
+the ID will be extracted from it (note: either way, the matching is done based on the ID so
+the CoRIM specified does not literally have to be the same file that was previously added).
+	`,
+	Args: cobra.MinimumNArgs(1),
 
 	Run: func(cmd *cobra.Command, args []string) {
 		CheckErr(runDeleteCommand(cmd, args))
@@ -43,7 +60,13 @@ var deleteCmd = &cobra.Command{
 var dumpCmd = &cobra.Command{
 	Use:   "dump MANIFEST_ID",
 	Short: "Write a CoRIM containing data associated with the specified manifest ID.",
-	Args:  cobra.ExactArgs(1),
+	Long: `Write a CoRIM containing data associated with the specified manifest ID.
+
+This produces an unsigned CoRIM token containing the data associated with the
+specified MANIFEST_ID. It is a way to easily "retrieve" a previously added
+CoRIM.
+	`,
+	Args: cobra.ExactArgs(1),
 
 	Run: func(cmd *cobra.Command, args []string) {
 		CheckErr(runDumpCommand(cmd, args))
@@ -56,6 +79,11 @@ func runAddCommand(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
+	activate, err := cmd.Flags().GetBool("activate")
+	if err != nil {
+		return err
+	}
+
 	store, err := store.Open(context.Background(), cliConfig.Store())
 	if err != nil {
 		return err
@@ -68,7 +96,7 @@ func runAddCommand(cmd *cobra.Command, args []string) error {
 			return fmt.Errorf("error reading %s: %w", path, err)
 		}
 
-		if err := store.AddBytes(bytes, label); err != nil {
+		if err := store.AddBytes(bytes, label, activate); err != nil {
 			return fmt.Errorf("error adding %s: %w", path, err)
 		}
 
@@ -191,6 +219,8 @@ func init() {
 	corimCmd.PersistentFlags().StringP("label", "l", "",
 		"Label that will be applied to the manifest in the store.")
 
+	addCmd.Flags().BoolP("activate", "a", false, "Activate added triples.")
+
 	deleteCmd.Flags().BoolP("corim", "C", false,
 		"force interpretation the positional argument as a path to CoRIM")
 
diff --git a/cmd/corim-store/cmd/get.go b/cmd/corim-store/cmd/get.go
index dda4a35..47c861f 100644
--- a/cmd/corim-store/cmd/get.go
+++ b/cmd/corim-store/cmd/get.go
@@ -2,13 +2,9 @@ package cmd
 
 import (
 	"context"
-	"encoding/base64"
-	"encoding/hex"
 	"errors"
 	"fmt"
-	"strings"
 
-	"github.com/google/uuid"
 	"github.com/spf13/cobra"
 	"github.com/veraison/corim-store/pkg/model"
 	"github.com/veraison/corim-store/pkg/store"
@@ -18,7 +14,21 @@ import (
 var getCmd = &cobra.Command{
 	Use:   "get",
 	Short: "Get triples matching specified environment.",
-	Args:  cobra.NoArgs,
+	Long: `Get triples matching specified environment.
+
+Flags are used to specify the elements of the environment. Multiple flags can
+be used together (e.g. you can specify a class ID and a model). If a particular
+environment element is not specified, it can be any value in the matched
+environments; unless --exact flag is also used, in which case unspecified elements
+must also be unset in the matched environments.
+
+In addition to environment matching, flags can be used to specify that you only
+want to get active triples, and/or only reference values or only trust anchors
+(by default, all triples with matching environments will be returned).
+
+The triples are returned encoded as JSON.
+	`,
+	Args: cobra.NoArgs,
 
 	Run: func(cmd *cobra.Command, args []string) {
 		CheckErr(runGetCommand(cmd, args))
@@ -36,7 +46,7 @@ func runGetCommand(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	env, err := buildEnvironment(cmd)
+	env, err := BuildEnvironment(cmd)
 	if err != nil {
 		return err
 	}
@@ -50,6 +60,11 @@ func runGetCommand(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
+	activeOnly, err := cmd.Flags().GetBool("active")
+	if err != nil {
+		return err
+	}
+
 	store, err := store.Open(context.Background(), cliConfig.Store())
 	if err != nil {
 		return err
@@ -59,7 +74,15 @@ func runGetCommand(cmd *cobra.Command, args []string) error {
 	var result comid.Triples
 
 	if selector.Endorsements || selector.ReferenceValues {
-		found, err := store.GetValueTriples(env, label, exact)
+		var found []*model.ValueTriple
+		var err error
+
+		if activeOnly {
+			found, err = store.GetActiveValueTriples(env, label, exact)
+		} else {
+			found, err = store.GetValueTriples(env, label, exact)
+		}
+
 		if err != nil {
 			return err
 		}
@@ -76,7 +99,15 @@ func runGetCommand(cmd *cobra.Command, args []string) error {
 	}
 
 	if selector.TrustAnchors {
-		found, err := store.GetKeyTriples(env, label, exact)
+		var found []*model.KeyTriple
+		var err error
+
+		if activeOnly {
+			found, err = store.GetActiveKeyTriples(env, label, exact)
+		} else {
+			found, err = store.GetKeyTriples(env, label, exact)
+		}
+
 		if err != nil {
 			return err
 		}
@@ -132,143 +163,8 @@ func buildSelector(cmd *cobra.Command) (*LookupMap, error) {
 	return &ret, nil
 }
 
-func buildEnvironment(cmd *cobra.Command) (*model.Environment, error) {
-	var ret model.Environment
-
-	vendor, err := cmd.Flags().GetString("vendor")
-	if err != nil {
-		return nil, fmt.Errorf("vendor: %w", err)
-	}
-	if vendor != "" {
-		ret.Vendor = &vendor
-	}
-
-	model, err := cmd.Flags().GetString("model")
-	if err != nil {
-		return nil, fmt.Errorf("model: %w", err)
-	}
-	if model != "" {
-		ret.Model = &model
-	}
-
-	layerInt, err := cmd.Flags().GetInt64("layer")
-	if err != nil {
-		return nil, fmt.Errorf("layer: %w", err)
-	}
-	if layerInt > -1 {
-		layer := uint64(layerInt)
-		ret.Layer = &layer
-	}
-
-	indexInt, err := cmd.Flags().GetInt64("index")
-	if err != nil {
-		return nil, fmt.Errorf("index: %w", err)
-	}
-	if indexInt > -1 {
-		index := uint64(indexInt)
-		ret.Index = &index
-	}
-
-	classIDText, err := cmd.Flags().GetString("class-id")
-	if err != nil {
-		return nil, fmt.Errorf("class-id: %w", err)
-	}
-
-	if classIDText != "" {
-		classIDBytes, classIDType, err := parseID(classIDText)
-		if err != nil {
-			return nil, fmt.Errorf("class-id: %w", err)
-		}
-
-		ret.ClassBytes = &classIDBytes
-		if classIDType != "" {
-			ret.ClassType = &classIDType
-		}
-	}
-
-	instanceIDText, err := cmd.Flags().GetString("instance-id")
-	if err != nil {
-		return nil, fmt.Errorf("instance-id: %w", err)
-	}
-
-	if instanceIDText != "" {
-		instanceIDBytes, instanceIDType, err := parseID(instanceIDText)
-		if err != nil {
-			return nil, fmt.Errorf("instance-id: %w", err)
-		}
-
-		ret.InstanceBytes = &instanceIDBytes
-		if instanceIDType != "" {
-			ret.InstanceType = &instanceIDType
-		}
-	}
-
-	groupIDText, err := cmd.Flags().GetString("group-id")
-	if err != nil {
-		return nil, fmt.Errorf("group-id: %w", err)
-	}
-
-	if groupIDText != "" {
-		groupIDBytes, groupIDType, err := parseID(groupIDText)
-		if err != nil {
-			return nil, fmt.Errorf("group-id: %w", err)
-		}
-
-		ret.GroupBytes = &groupIDBytes
-		if groupIDType != "" {
-			ret.GroupType = &groupIDType
-		}
-	}
-
-	return &ret, nil
-}
-
-func parseID(text string) ([]byte, string, error) {
-	var typeText string
-	var valueText string
-
-	parts := strings.SplitN(text, ":", 2)
-	if len(parts) == 2 {
-		typeText = parts[0]
-		valueText = parts[1]
-	} else {
-		valueText = text
-	}
-
-	switch typeText {
-	case "uuid":
-		ret, err := uuid.Parse(valueText)
-		return ret[:], "uuid", err
-	case "oid":
-		var ret comid.OID
-		if err := ret.FromString(valueText); err != nil {
-			return nil, "oid", err
-		}
-		return []byte(ret), "oid", nil
-	case "hex":
-		ret, err := hex.DecodeString(valueText)
-		return ret, "hex", err
-	default: // assume base64
-		// remove padding
-		valueText = strings.Trim(valueText, "=")
-		// if URL, convert to standard
-		valueText = strings.ReplaceAll(valueText, "-", "+")
-		valueText = strings.ReplaceAll(valueText, "_", "/")
-
-		ret, err := base64.RawStdEncoding.DecodeString(valueText)
-		return ret, typeText, err
-	}
-}
-
 func init() {
-	getCmd.Flags().StringP("class-id", "C", "", "Environment class ID.")
-	getCmd.Flags().StringP("vendor", "V", "", "Environment vendor.")
-	getCmd.Flags().StringP("model", "M", "", "Environment model.")
-	getCmd.Flags().Int64P("layer", "L", -1, "Environment layer.")
-	getCmd.Flags().Int64P("index", "I", -1, "Environment index.")
-	getCmd.Flags().StringP("instance-id", "i", "", "Environment instance ID")
-	getCmd.Flags().StringP("group-id", "g", "", "Environment group ID")
-
+	AddEnviromentFlags(getCmd)
 	getCmd.Flags().BoolP("reference-values", "R", false, "Look up reference values.")
 	getCmd.Flags().BoolP("endorsements", "E", false, "Look up endorsements.")
 	getCmd.Flags().BoolP("trust-anchors", "T", false, "Look up trust anchors.")
@@ -279,6 +175,7 @@ func init() {
 	getCmd.Flags().BoolP("exact", "e", false,
 		"Match environments exactly, including null fields. The default is to assume that "+
 			"null fields (i.e. fields not explicitly specified) can match any value.")
+	getCmd.Flags().BoolP("active", "a", false, "Only look up active triples.")
 
 	rootCmd.AddCommand(getCmd)
 }
diff --git a/cmd/corim-store/cmd/lifecycle.go b/cmd/corim-store/cmd/lifecycle.go
new file mode 100644
index 0000000..72da5d7
--- /dev/null
+++ b/cmd/corim-store/cmd/lifecycle.go
@@ -0,0 +1,201 @@
+package cmd
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"github.com/uptrace/bun"
+	"github.com/veraison/corim-store/pkg/model"
+	"github.com/veraison/corim-store/pkg/store"
+)
+
+var activateCmd = &cobra.Command{
+	Use:   "activate",
+	Short: "Activate a (set of) triple(s), making them available to the verifier.",
+	Args:  cobra.NoArgs,
+
+	Run: func(cmd *cobra.Command, args []string) {
+		CheckErr(setActiveCommand(cmd, true))
+	},
+}
+
+var deactivateCmd = &cobra.Command{
+	Use:   "deactivate",
+	Short: "Deactivate a (set of) triple(s), making them unavailable to the verifier.",
+	Args:  cobra.NoArgs,
+
+	Run: func(cmd *cobra.Command, args []string) {
+		CheckErr(setActiveCommand(cmd, false))
+	},
+}
+
+func setActiveCommand(cmd *cobra.Command, value bool) error {
+	store, err := store.Open(context.Background(), cliConfig.Store())
+	if err != nil {
+		return err
+	}
+	defer func() { CheckErr(store.Close()) }()
+
+	keyTripleIDs, err := cmd.Flags().GetInt64Slice("key-triple")
+	if err != nil {
+		return err
+	}
+
+	if len(keyTripleIDs) != 0 {
+		if err := keyTriplesSetActive(store, keyTripleIDs, value); err != nil {
+			return fmt.Errorf("key triples: %w", err)
+		}
+	}
+
+	valueTripleIDs, err := cmd.Flags().GetInt64Slice("value-triple")
+	if err != nil {
+		return err
+	}
+
+	if len(valueTripleIDs) != 0 {
+		if err := valueTriplesSetActive(store, valueTripleIDs, value); err != nil {
+			return fmt.Errorf("value triples: %w", err)
+		}
+	}
+
+	moduleTagTextIDs, err := cmd.Flags().GetStringSlice("module-tag")
+	if err != nil {
+		return err
+	}
+
+	if len(moduleTagTextIDs) != 0 {
+		var moduleTagIDs []int64
+		for _, idText := range moduleTagTextIDs {
+			var ids []int64
+			err := store.DB.NewSelect().
+				TableExpr("module_tags as mod").
+				ColumnExpr("mod.id as id").
+				Where("mod.tag_id = ?", idText).
+				Scan(store.Ctx, &ids)
+
+			if err != nil {
+				return err
+			}
+
+			moduleTagIDs = append(moduleTagIDs, ids...)
+		}
+
+		if err := moduleTagsSetActive(store, moduleTagIDs, value); err != nil {
+			return fmt.Errorf("module tags: %w", err)
+		}
+	}
+
+	manifestTextIDs, err := cmd.Flags().GetStringSlice("manifest")
+	if err != nil {
+		return err
+	}
+
+	if len(manifestTextIDs) != 0 {
+		var moduleTagIDs []int64
+		for _, idText := range manifestTextIDs {
+			var ids []int64
+			err = store.DB.NewSelect().
+				TableExpr("module_tags as mod").
+				ColumnExpr("mod.id as id").
+				Join("JOIN manifests AS man ON man.id = mod.manifest_id").
+				Where("man.manifest_id = ?", idText).
+				Scan(store.Ctx, &ids)
+
+			if err != nil {
+				return err
+			}
+
+			moduleTagIDs = append(moduleTagIDs, ids...)
+		}
+
+		if err := moduleTagsSetActive(store, moduleTagIDs, value); err != nil {
+			return fmt.Errorf("manifests: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func moduleTagsSetActive(store *store.Store, ids []int64, value bool) error {
+	for _, id := range ids {
+		var keyTripleIDs []int64
+		noKeyTriples := false
+
+		err := store.DB.NewSelect().
+			Model(&keyTripleIDs).
+			TableExpr("key_triples as kt").
+			Column("id").
+			Where("kt.module_id = ?", id).
+			Scan(store.Ctx)
+
+		if err != nil && err != sql.ErrNoRows { // nolint:gocritic
+			return fmt.Errorf("scanning key triples: %w", err)
+		} else if err == sql.ErrNoRows || len(keyTripleIDs) == 0 {
+			noKeyTriples = true
+		} else {
+			if err := keyTriplesSetActive(store, keyTripleIDs, true); err != nil {
+				return err
+			}
+		}
+
+		var valueTripleIDs []int64
+		noValueTriples := false
+
+		err = store.DB.NewSelect().
+			Model(&valueTripleIDs).
+			TableExpr("value_triples as vt").
+			Column("id").
+			Where("vt.module_id = ?", id).
+			Scan(store.Ctx)
+
+		if err != nil && err != sql.ErrNoRows { // nolint:gocritic
+			return fmt.Errorf("scanning value triples: %w", err)
+		} else if err == sql.ErrNoRows || len(valueTripleIDs) == 0 {
+			noValueTriples = true
+		} else {
+			if err := valueTriplesSetActive(store, valueTripleIDs, true); err != nil {
+				return err
+			}
+		}
+
+		if noKeyTriples && noValueTriples {
+			return fmt.Errorf("no triples associated with module tag ID %d", id)
+		}
+	}
+
+	return nil
+}
+
+func keyTriplesSetActive(store *store.Store, ids []int64, value bool) error {
+	return setActive[model.KeyTriple](store, ids, value)
+}
+
+func valueTriplesSetActive(store *store.Store, ids []int64, value bool) error {
+	return setActive[model.ValueTriple](store, ids, value)
+}
+
+func setActive[T any](store *store.Store, ids []int64, value bool) error {
+	_, err := store.DB.NewUpdate().
+		Model((*T)(nil)).
+		Set("is_active = ?", value).
+		Where("id IN (?)", bun.In(ids)).
+		Exec(store.Ctx)
+
+	return err
+}
+
+func addActivateFlags(cmd *cobra.Command) {
+	cmd.Flags().Int64Slice("key-triple", []int64{}, "Specify the key triple database ID.")
+	cmd.Flags().Int64Slice("value-triple", []int64{}, "Specify the key triple database ID.")
+	cmd.Flags().StringSlice("module-tag", []string{}, "Specify the module tag UUID.")
+	cmd.Flags().StringSlice("manifest", []string{}, "Specify the manifest ID.")
+}
+
+func init() {
+	addActivateFlags(activateCmd)
+	addActivateFlags(deactivateCmd)
+	rootCmd.AddCommand(activateCmd)
+	rootCmd.AddCommand(deactivateCmd)
+}
diff --git a/cmd/corim-store/cmd/list.go b/cmd/corim-store/cmd/list.go
index 7ab5ab6..7e47488 100644
--- a/cmd/corim-store/cmd/list.go
+++ b/cmd/corim-store/cmd/list.go
@@ -2,20 +2,29 @@ package cmd
 
 import (
 	"context"
+	"database/sql"
+	"errors"
 	"fmt"
 	"strings"
 
 	"github.com/jedib0t/go-pretty/v6/table"
 	"github.com/jedib0t/go-pretty/v6/text"
 	"github.com/spf13/cobra"
+	"github.com/veraison/corim-store/pkg/model"
 	"github.com/veraison/corim-store/pkg/store"
 	"github.com/veraison/corim-store/pkg/util"
 )
 
 var listCmd = &cobra.Command{
-	Use:   "list",
+	Use:   "list WHAT",
 	Short: "List entries of a particular type.",
-	Args:  cobra.ExactArgs(1),
+	Long: `List all entries of a particular type in the store.
+
+The WHAT can be "manifests"/"corims", "modules"/"module_tags"/"comids",
+"entities", or "triples" (slashes indicate alternate names for the same type
+of entry). When the  WHAT is \"triples\", flags can be used to filter the
+results by environment elements (e.g. by model or instance ID)."`,
+	Args: cobra.ExactArgs(1),
 
 	Run: func(cmd *cobra.Command, args []string) {
 		CheckErr(runListCommand(cmd, args))
@@ -26,6 +35,19 @@ func runListCommand(cmd *cobra.Command, args []string) error {
 	var err error
 	what := util.Normalize(args[0])
 
+	env, err := BuildEnvironment(cmd)
+	CheckErr(err)
+
+	label, err := cmd.Flags().GetString("label")
+	if err != nil {
+		return err
+	}
+
+	exact, err := cmd.Flags().GetBool("exact")
+	if err != nil {
+		return err
+	}
+
 	store, err := store.Open(context.Background(), cliConfig.Store())
 	if err != nil {
 		return err
@@ -35,6 +57,10 @@ func runListCommand(cmd *cobra.Command, args []string) error {
 	var header []any
 	var rows [][]any
 
+	if what != "triples" && !env.IsEmpty() {
+		return errors.New("environment specifiers are only allowed for triples")
+	}
+
 	switch what {
 	case "manifests", "corims":
 		header, rows, err = listManifests(store)
@@ -42,6 +68,8 @@ func runListCommand(cmd *cobra.Command, args []string) error {
 		header, rows, err = listModuleTags(store)
 	case "entities":
 		header, rows, err = listEntities(store)
+	case "triples":
+		header, rows, err = listTriples(store, env, label, exact)
 	default:
 		return fmt.Errorf("unsupported list target: %s", what)
 	}
@@ -61,6 +89,7 @@ func runListCommand(cmd *cobra.Command, args []string) error {
 		colConfigs = append(colConfigs, table.ColumnConfig{
 			Name:        h.(string),
 			AlignHeader: text.AlignCenter,
+			VAlign:      text.VAlignMiddle,
 		})
 	}
 	tw.SetColumnConfigs(colConfigs)
@@ -103,7 +132,7 @@ func listManifests(store *store.Store) ([]any, [][]any, error) {
 	for _, match := range matches {
 		retRow := make([]any, 0, len(retCols)+1)
 		for _, col := range retCols {
-			retRow = append(retRow, match[col.(string)])
+			retRow = append(retRow, unwrapNullableTypes(match[col.(string)]))
 		}
 
 		ret = append(ret, retRow)
@@ -117,14 +146,14 @@ func listModuleTags(store *store.Store) ([]any, [][]any, error) {
 	retCols := make([]any, 0, len(columns)+1)
 
 	var matches []map[string]any
-	err := store.DB.NewSelect().TableExpr("module_tags AS mod").
+	err := store.DB.NewSelect().TableExpr("module_tags AS mt").
 		ColumnExpr("tag_id").
 		ColumnExpr("language").
 		ColumnExpr(fmt.Sprintf("%s AS entities", store.StringAggregatorExpr("ent.name"))).
 		ColumnExpr("man.manifest_id as manifest").
 		ColumnExpr("man.label as label").
-		Join("LEFT JOIN entities as ent ON ent.owner_id = mod.id AND ent.owner_type = 'module_tag'").
-		Join("LEFT JOIN manifests as man ON man.id = mod.manifest_id").
+		Join("LEFT JOIN entities as ent ON ent.owner_id = mt.id AND ent.owner_type = 'module_tag'").
+		Join("LEFT JOIN manifests as man ON man.id = mt.manifest_id").
 		GroupExpr(strings.Join(columns, ", ")).
 		Scan(store.Ctx, &matches)
 
@@ -141,7 +170,7 @@ func listModuleTags(store *store.Store) ([]any, [][]any, error) {
 	for _, match := range matches {
 		retRow := make([]any, 0, len(retCols)+1)
 		for _, col := range retCols {
-			retRow = append(retRow, match[col.(string)])
+			retRow = append(retRow, unwrapNullableTypes(match[col.(string)]))
 		}
 
 		ret = append(ret, retRow)
@@ -178,9 +207,9 @@ func listEntities(store *store.Store) ([]any, [][]any, error) {
 	for _, match := range matches {
 		retRow := make([]any, 0, len(retCols)+1)
 		for _, col := range columns {
-			retRow = append(retRow, match[col])
+			retRow = append(retRow, unwrapNullableTypes(match[col]))
 		}
-		retRow = append(retRow, match["roles"])
+		retRow = append(retRow, unwrapNullableTypes(match["roles"]))
 
 		ret = append(ret, retRow)
 	}
@@ -188,6 +217,141 @@ func listEntities(store *store.Store) ([]any, [][]any, error) {
 	return retCols, ret, nil
 }
 
+func listTriples(
+	store *store.Store,
+	env *model.Environment,
+	label string,
+	exact bool,
+) ([]any, [][]any, error) {
+	var matches []map[string]any
+	err := store.DB.NewSelect().TableExpr("module_tags AS mt").
+		ColumnExpr("mt.id as id").
+		ColumnExpr("tag_id as module").
+		ColumnExpr("man.manifest_id as manifest").
+		ColumnExpr("man.label as label").
+		Join("LEFT JOIN manifests as man ON man.id = mt.manifest_id").
+		Scan(store.Ctx, &matches)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	lookup := make(map[int64]map[string]any)
+	for _, match := range matches {
+		lookup[match["id"].(int64)] = match
+	}
+
+	keyTriples, err := store.GetKeyTriples(env, label, exact)
+	if err != nil {
+		return nil, nil, fmt.Errorf("getting key triples: %w", err)
+	}
+
+	valueTriples, err := store.GetValueTriples(env, label, exact)
+	if err != nil {
+		return nil, nil, fmt.Errorf("getting value triples: %w", err)
+	}
+
+	columns := []any{"id", "active", "label", "manifest", "module", "type", "environment"}
+	rows := make([][]any, 0, len(valueTriples)+len(keyTriples))
+
+	for _, kt := range keyTriples {
+		module, ok := lookup[kt.ModuleID]
+		if !ok {
+			return nil, nil, fmt.Errorf("orphan key triple: %d", kt.ID)
+		}
+
+		envText, err := RenderEnviroment(kt.Environment)
+		if err != nil {
+			return nil, nil, fmt.Errorf("environment for key triple %d: %w", kt.ID, err)
+		}
+
+		rows = append(rows, []any{
+			kt.ID,
+			kt.IsActive,
+			unwrapNullableTypes(module["label"]),
+			unwrapNullableTypes(module["manifest"]),
+			unwrapNullableTypes(module["module"]),
+			fmt.Sprintf("%s key", kt.Type),
+			envText,
+		})
+	}
+
+	for _, vt := range valueTriples {
+		module, ok := lookup[vt.ModuleID]
+		if !ok {
+			return nil, nil, fmt.Errorf("orphan value triple: %d", vt.ID)
+		}
+
+		envText, err := RenderEnviroment(vt.Environment)
+		if err != nil {
+			return nil, nil, fmt.Errorf("environment for value triple %d: %w", vt.ID, err)
+		}
+
+		rows = append(rows, []any{
+			vt.ID,
+			vt.IsActive,
+			unwrapNullableTypes(module["label"]),
+			unwrapNullableTypes(module["manifest"]),
+			unwrapNullableTypes(module["module"]),
+			fmt.Sprintf("%s value", vt.Type),
+			envText,
+		})
+	}
+
+	return columns, rows, nil
+}
+
+func unwrapNullableTypes(val any) any {
+	switch t := val.(type) {
+	case sql.NullString:
+		if t.Valid {
+			return t.String
+		} else {
+			return nil
+		}
+	case sql.NullInt64:
+		if t.Valid {
+			return t.Int64
+		} else {
+			return nil
+		}
+	case sql.NullInt32:
+		if t.Valid {
+			return t.Int32
+		} else {
+			return nil
+		}
+	case sql.NullInt16:
+		if t.Valid {
+			return t.Int16
+		} else {
+			return nil
+		}
+	case sql.NullByte:
+		if t.Valid {
+			return t.Byte
+		} else {
+			return nil
+		}
+	case sql.NullBool:
+		if t.Valid {
+			return t.Bool
+		} else {
+			return nil
+		}
+	default:
+		return t
+	}
+}
+
 func init() {
+	AddEnviromentFlags(listCmd)
+	listCmd.Flags().StringP("label", "l", "",
+		"Label that will be applied to the manifest in the store.")
+
+	listCmd.Flags().BoolP("exact", "e", false,
+		"Match environments exactly, including null fields. The default is to assume that "+
+			"null fields (i.e. fields not explicitly specified) can match any value.")
+
 	rootCmd.AddCommand(listCmd)
 }
diff --git a/cmd/corim-store/cmd/root.go b/cmd/corim-store/cmd/root.go
index e6f3879..7df6da8 100644
--- a/cmd/corim-store/cmd/root.go
+++ b/cmd/corim-store/cmd/root.go
@@ -40,7 +40,8 @@ func init() {
 	)
 
 	rootCmd.PersistentFlags().Bool(
-		"insecure", false, "Allow insecure operations.",
+		"insecure", false, "Allow insecure operations. Currently, this allows processing signed "+
+			"commits without verifying their signature (unsigned commits are always processed).",
 	)
 
 	rootCmd.PersistentFlags().Bool(
@@ -48,15 +49,18 @@ func init() {
 	)
 
 	rootCmd.PersistentFlags().Bool(
-		"force", false, "Force an operation that would otherwise fail (use with care!).",
+		"force", false, "Force an operation that would otherwise fail potentially overwriting "+
+			"exiting artefacts (use with care!).",
 	)
 
 	rootCmd.PersistentFlags().StringP(
-		"dbms", "D", "sqlite", "DataBase Management System type",
+		"dbms", "D", "sqlite", "DataBase Management System type. Allowed values are \"sqlite\", "+
+			"\"mysql\"/\"mariadb\", and \"postgres\"/\"pg\"/\"pq\".",
 	)
 
 	rootCmd.PersistentFlags().StringP(
-		"dsn", "N", "file:store.db?cache=shared", "Datadase System Name",
+		"dsn", "N", "file:store.db?cache=shared", "Database System Name. This is used to connect to "+
+			"the database server. The format of this string is DBMS-specific.",
 	)
 
 	rootCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
diff --git a/docker/Dockerfile b/docker/Dockerfile
new file mode 100644
index 0000000..1b499e0
--- /dev/null
+++ b/docker/Dockerfile
@@ -0,0 +1,54 @@
+FROM ubuntu:24.04 AS corim-store-db
+
+RUN apt-get update  && \
+    DEBIAN_FRONTEND=noninteractive apt-get install \
+    	--assume-yes \
+	--no-install-recommends \
+        mariadb-server \
+	postgresql \
+	supervisor \
+	vim \
+	&& \
+    apt-get clean && \
+    apt-get autoremove --assume-yes && \
+    rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp*
+
+RUN mkdir -p /var/run/mysqld && chown -R mysql:mysql /var/run/mysqld && \
+    mkdir -p /tmp && chmod 1777 /tmp && \
+    mariadb-install-db --user=mysql --ldata=/var/lib/mysql && \
+    sed -i "s/^bind-address\s*=.*/bind-address = 0.0.0.0/" /etc/mysql/mariadb.conf.d/50-server.cnf
+
+RUN mariadbd-safe --datadir=/var/lib/mysql & \
+    sleep 2 && \
+    until mariadb -uroot -e "SELECT 1" &>/dev/null; do sleep 1; done && \
+    mariadb -uroot <<EOF
+CREATE DATABASE corim_store;
+GRANT ALL PRIVILEGES ON corim_store.* TO 'store_user'@'%' IDENTIFIED BY 'L3tM31n';
+ALTER USER 'store_user'@'%' REQUIRE NONE;
+FLUSH PRIVILEGES;
+EOF
+
+EXPOSE 3306
+
+USER postgres
+
+RUN /usr/lib/postgresql/16/bin/initdb -D /var/lib/postgresql/data && \
+    sed -i "s/^#listen_addresses\s*=.*$/listen_addresses = '*'/" /var/lib/postgresql/data/postgresql.conf && \
+    echo "host all all 0.0.0.0/0 scram-sha-256" >> /var/lib/postgresql/data/pg_hba.conf && \
+    /usr/lib/postgresql/16/bin/postgres --single -D /var/lib/postgresql/data postgres <<EOF
+CREATE DATABASE corim_store;
+CREATE USER store_user WITH PASSWORD 'L3tM31n';
+GRANT ALL PRIVILEGES ON DATABASE corim_store TO store_user;
+EOF
+
+RUN /usr/lib/postgresql/16/bin/postgres --single -D /var/lib/postgresql/data corim_store <<EOF
+GRANT ALL ON SCHEMA public TO store_user;
+EOF
+
+EXPOSE 5432
+
+USER root
+
+COPY supervisord.conf /etc/supervisor/supervisord.conf
+
+CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]
diff --git a/docker/supervisord.conf b/docker/supervisord.conf
new file mode 100644
index 0000000..b9d3767
--- /dev/null
+++ b/docker/supervisord.conf
@@ -0,0 +1,13 @@
+[supervisord]
+nodaemon=true
+user=root
+
+[program:mariadb]
+command=mariadbd-safe
+user=mysql
+autorestart=true
+
+[program:postgresql]
+command=/usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/data
+user=postgres
+autorestart=true
diff --git a/go.mod b/go.mod
index 60091a3..6ff1dab 100644
--- a/go.mod
+++ b/go.mod
@@ -1,26 +1,31 @@
 module github.com/veraison/corim-store
 
-go 1.23.0
+go 1.24.0
 
 require (
 	github.com/fxamacker/cbor/v2 v2.8.0
+	github.com/go-sql-driver/mysql v1.9.3
 	github.com/google/uuid v1.6.0
+	github.com/jackc/pgx/v5 v5.7.6
 	github.com/jedib0t/go-pretty/v6 v6.7.0
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
-	github.com/uptrace/bun v1.2.15
+	github.com/uptrace/bun v1.2.16
 	github.com/uptrace/bun/dbfixture v1.2.15
-	github.com/uptrace/bun/dialect/sqlitedialect v1.2.15
+	github.com/uptrace/bun/dialect/mysqldialect v1.2.16
+	github.com/uptrace/bun/dialect/pgdialect v1.2.16
+	github.com/uptrace/bun/dialect/sqlitedialect v1.2.16
 	github.com/uptrace/bun/driver/sqliteshim v1.2.15
 	github.com/uptrace/bun/extra/bundebug v1.2.15
-	github.com/veraison/corim v1.1.3-0.20251111094726-d91c44caaec0
+	github.com/veraison/corim v1.1.3-0.20251209103150-ef6dbb7ed63f
 	github.com/veraison/eat v0.0.0-20210331113810-3da8a4dd42ff
 	github.com/veraison/swid v1.1.1-0.20251003121634-fd1f7f1e1897
 )
 
 require (
+	filippo.io/edwards25519 v1.1.0 // indirect
 	fortio.org/safecast v1.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
@@ -30,6 +35,9 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
@@ -59,9 +67,11 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/crypto v0.37.0 // indirect
 	golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc // indirect
-	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.66.3 // indirect
diff --git a/go.sum b/go.sum
index 6befc2b..29218b0 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,5 @@
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 fortio.org/safecast v1.0.0 h1:dr3131WPX8iS1pTf76+39WeXbTrerDYLvi9s7Oi3wiY=
 fortio.org/safecast v1.0.0/go.mod h1:xZmcPk3vi4kuUFf+tq4SvnlVdwViqf6ZSZl91Jr9Jdg=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -18,6 +20,8 @@ github.com/fxamacker/cbor/v2 v2.2.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrt
 github.com/fxamacker/cbor/v2 v2.3.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
 github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
 github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
@@ -31,6 +35,14 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jedib0t/go-pretty/v6 v6.7.0 h1:DanoN1RnjXTwDN+B8yqtixXzXqNBCs2Vxo2ARsnrpsY=
 github.com/jedib0t/go-pretty/v6 v6.7.0/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -61,8 +73,6 @@ github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEu
 github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -95,7 +105,9 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
@@ -103,18 +115,22 @@ github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc h1:9lRDQMhESg+zvGYmW5DyG0UqvY96Bu5QYsTLvCHdrgo=
 github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc/go.mod h1:bciPuU6GHm1iF1pBvUfxfsH0Wmnc2VbpgvbI9ZWuIRs=
-github.com/uptrace/bun v1.2.15 h1:Ut68XRBLDgp9qG9QBMa9ELWaZOmzHNdczHQdrOZbEFE=
-github.com/uptrace/bun v1.2.15/go.mod h1:Eghz7NonZMiTX/Z6oKYytJ0oaMEJ/eq3kEV4vSqG038=
+github.com/uptrace/bun v1.2.16 h1:QlObi6ZIK5Ao7kAALnh91HWYNZUBbVwye52fmlQM9kc=
+github.com/uptrace/bun v1.2.16/go.mod h1:jMoNg2n56ckaawi/O/J92BHaECmrz6IRjuMWqlMaMTM=
 github.com/uptrace/bun/dbfixture v1.2.15 h1:0wncXVJ7L6iYIukWe7WtCpTIxKc3Z3vFX5tAFqV674c=
 github.com/uptrace/bun/dbfixture v1.2.15/go.mod h1:vCAi8ESyYHcjFZNTcalwNHI3KYl9TC4CtzL26FsulkQ=
-github.com/uptrace/bun/dialect/sqlitedialect v1.2.15 h1:7upGMVjFRB1oI78GQw6ruNLblYn5CR+kxqcbbeBBils=
-github.com/uptrace/bun/dialect/sqlitedialect v1.2.15/go.mod h1:c7YIDaPNS2CU2uI1p7umFuFWkuKbDcPDDvp+DLHZnkI=
+github.com/uptrace/bun/dialect/mysqldialect v1.2.16 h1:ok06dAS094cEKvKg38SVAnXMroNHNaM5ZtpRkPE/Oz0=
+github.com/uptrace/bun/dialect/mysqldialect v1.2.16/go.mod h1:fjbFYeJZCK8z0m0ACvdgs+dbFdDIaLYWDr+jvaPLedQ=
+github.com/uptrace/bun/dialect/pgdialect v1.2.16 h1:KFNZ0LxAyczKNfK/IJWMyaleO6eI9/Z5tUv3DE1NVL4=
+github.com/uptrace/bun/dialect/pgdialect v1.2.16/go.mod h1:IJdMeV4sLfh0LDUZl7TIxLI0LipF1vwTK3hBC7p5qLo=
+github.com/uptrace/bun/dialect/sqlitedialect v1.2.16 h1:6wVAiYLj1pMibRthGwy4wDLa3D5AQo32Y8rvwPd8CQ0=
+github.com/uptrace/bun/dialect/sqlitedialect v1.2.16/go.mod h1:Z7+5qK8CGZkDQiPMu+LSdVuDuR1I5jcwtkB1Pi3F82E=
 github.com/uptrace/bun/driver/sqliteshim v1.2.15 h1:M/rZJSjOPV4OmfTVnDPtL+wJmdMTqDUn8cuk5ycfABA=
 github.com/uptrace/bun/driver/sqliteshim v1.2.15/go.mod h1:YqwxFyvM992XOCpGJtXyKPkgkb+aZpIIMzGbpaw1hIk=
 github.com/uptrace/bun/extra/bundebug v1.2.15 h1:IY2Z/pVyVg0ApWnQ/pEnwe6BWxlDDATCz7IFZghutCs=
 github.com/uptrace/bun/extra/bundebug v1.2.15/go.mod h1:JuE+BT7NjTZ9UKr74eC8s9yZ9dnQCeufDwFRTC8w3Xo=
-github.com/veraison/corim v1.1.3-0.20251111094726-d91c44caaec0 h1:WcvZHdEfu2TVRAV2MoHrCLqHwIDkkSxPJpESR3/sOX8=
-github.com/veraison/corim v1.1.3-0.20251111094726-d91c44caaec0/go.mod h1:96PQ0lk+O9bzutKTDz66G2DaARYUp1BeR06EYwEwSH0=
+github.com/veraison/corim v1.1.3-0.20251209103150-ef6dbb7ed63f h1:ANVwskQLZ0YEzivFZqreGIftxakfd579fpOcjU8rHjo=
+github.com/veraison/corim v1.1.3-0.20251209103150-ef6dbb7ed63f/go.mod h1:96PQ0lk+O9bzutKTDz66G2DaARYUp1BeR06EYwEwSH0=
 github.com/veraison/eat v0.0.0-20210331113810-3da8a4dd42ff h1:r6I2eJL/z8dp5flsQIKHMeDjyV6UO8If3MaVBLvTjF4=
 github.com/veraison/eat v0.0.0-20210331113810-3da8a4dd42ff/go.mod h1:+kxt8iuFiVvKRs2VQ1Ho7bbAScXAB/kHFFuP5Biw19I=
 github.com/veraison/go-cose v1.2.1 h1:Gj4x20D0YP79J2+cK3anjGEMwIkg2xX+TKVVGUXwNAc=
@@ -129,24 +145,24 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
 golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc h1:TS73t7x3KarrNd5qAipmspBDS1rkMcgVG/fS1aRb4Rc=
 golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
 golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
 golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
-golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/misc/corim-store-er-simplified.drawio.png b/misc/corim-store-er-simplified.drawio.png
new file mode 100644
index 0000000..0c71577
Binary files /dev/null and b/misc/corim-store-er-simplified.drawio.png differ
diff --git a/misc/corim-store-schema.drawio.png b/misc/corim-store-schema.drawio.png
new file mode 100644
index 0000000..baede67
Binary files /dev/null and b/misc/corim-store-schema.drawio.png differ
diff --git a/pkg/db/db.go b/pkg/db/db.go
index 627cc74..da8e887 100644
--- a/pkg/db/db.go
+++ b/pkg/db/db.go
@@ -4,10 +4,15 @@ import (
 	"database/sql"
 	"fmt"
 
+	_ "github.com/go-sql-driver/mysql"
+	_ "github.com/jackc/pgx/v5/stdlib"
 	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect/mysqldialect"
+	"github.com/uptrace/bun/dialect/pgdialect"
 	"github.com/uptrace/bun/dialect/sqlitedialect"
 	"github.com/uptrace/bun/driver/sqliteshim"
 	"github.com/uptrace/bun/extra/bundebug"
+	"github.com/uptrace/bun/schema"
 )
 
 type Config struct {
@@ -18,19 +23,30 @@ type Config struct {
 
 func Open(cfg *Config) (*bun.DB, error) {
 	var ret *bun.DB
+	var sqldb *sql.DB
+	var err error
+	var dialect schema.Dialect
 
 	switch cfg.DBMS {
+	case "mysql", "mariadb":
+		sqldb, err = sql.Open("mysql", cfg.DSN)
+		dialect = mysqldialect.New()
 	case "sqlite", "sqlite3":
-		sqldb, err := sql.Open(sqliteshim.ShimName, cfg.DSN)
-		if err != nil {
-			return nil, err
-		}
-
-		ret = bun.NewDB(sqldb, sqlitedialect.New())
+		sqldb, err = sql.Open(sqliteshim.ShimName, cfg.DSN)
+		dialect = sqlitedialect.New()
+	case "postgres", "pq", "pgx", "pg":
+		sqldb, err = sql.Open("pgx", cfg.DSN)
+		dialect = pgdialect.New()
 	default:
 		return nil, fmt.Errorf("unsupported DBMS: %s", cfg.DBMS)
 	}
 
+	if err != nil {
+		return nil, err
+	}
+
+	ret = bun.NewDB(sqldb, dialect)
+
 	if cfg.TraceSQL {
 		ret.AddQueryHook(bundebug.NewQueryHook(
 			bundebug.WithVerbose(true),
diff --git a/pkg/db/db_test.go b/pkg/db/db_test.go
index 61c1792..1bf858d 100644
--- a/pkg/db/db_test.go
+++ b/pkg/db/db_test.go
@@ -12,4 +12,10 @@ func TestDB_Create(t *testing.T) {
 
 	_, err = Open(&Config{DBMS: "foo"})
 	assert.EqualError(t, err, "unsupported DBMS: foo")
+
+	_, err = Open(&Config{DBMS: "mysql", DSN: "foo", TraceSQL: true})
+	assert.ErrorContains(t, err, "invalid DSN")
+
+	_, err = Open(&Config{DBMS: "pg", DSN: "foo", TraceSQL: true})
+	assert.NoError(t, err)
 }
diff --git a/pkg/migrations/0000_initial.go b/pkg/migrations/0000_initial.go
index e8c482c..6cac0ba 100644
--- a/pkg/migrations/0000_initial.go
+++ b/pkg/migrations/0000_initial.go
@@ -144,7 +144,10 @@ type keyTriple_v1 struct {
 	KeyList []*cryptoKey_v1 `bun:"rel:has-many,join:id=owner_id,join:type=owner_type,polymorphic:key_triple"`
 
 	AuthorizedBy []*cryptoKey_v1 `bun:"rel:has-many,join:id=owner_id,join:type=owner_type,polymorphic:key_triple_auth"`
-	ModuleID     int64           `bun:",nullzero"`
+
+	IsActive bool
+
+	ModuleID int64 `bun:",nullzero"`
 }
 
 type valueTriple_v1 struct {
@@ -157,7 +160,10 @@ type valueTriple_v1 struct {
 
 	Type         string
 	Measurements []*measurement_v1 `bun:"rel:has-many,join:id=owner_id,join:type=owner_type,polymorphic:value_triple"`
-	ModuleID     int64             `bun:",nullzero"`
+
+	IsActive bool
+
+	ModuleID int64 `bun:",nullzero"`
 }
 
 type linkedTag_v1 struct {
diff --git a/pkg/model/common_test.go b/pkg/model/common_test.go
new file mode 100644
index 0000000..01d647b
--- /dev/null
+++ b/pkg/model/common_test.go
@@ -0,0 +1,14 @@
+package model
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/veraison/corim-store/pkg/db"
+)
+
+func TestRegisterModel(t *testing.T) {
+	testDB, err := db.Open(&db.Config{DBMS: "sqlite", DSN: "file::memory:"})
+	require.NoError(t, err)
+	RegisterModels(testDB)
+}
diff --git a/pkg/model/cryptokey.go b/pkg/model/cryptokey.go
index b226045..8672b2b 100644
--- a/pkg/model/cryptokey.go
+++ b/pkg/model/cryptokey.go
@@ -156,8 +156,7 @@ func (o *CryptoKey) Select(ctx context.Context, db bun.IDB) error {
 		return errors.New("ID not set")
 	}
 
-	_, err := db.NewSelect().Model(o).Where("ck.id = ?", o.ID).Exec(ctx)
-	return err
+	return db.NewSelect().Model(o).Where("ck.id = ?", o.ID).Scan(ctx)
 }
 
 func (o *CryptoKey) Delete(ctx context.Context, db bun.IDB) error {
diff --git a/pkg/model/cryptokey_test.go b/pkg/model/cryptokey_test.go
index 083c5ec..23ac16a 100644
--- a/pkg/model/cryptokey_test.go
+++ b/pkg/model/cryptokey_test.go
@@ -2,6 +2,7 @@ package model
 
 import (
 	"context"
+	"crypto"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -15,7 +16,7 @@ func TestCrypoKey_round_trip(t *testing.T) {
 	db := test.NewTestDB(t)
 	defer func() { assert.NoError(t, db.Close()) }()
 
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		key   *comid.CryptoKey
 	}{
@@ -53,7 +54,7 @@ func TestCrypoKey_round_trip(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			key, err := NewCryptoKeyFromCoRIM(tc.key)
 			assert.NoError(t, err)
@@ -71,3 +72,70 @@ func TestCrypoKey_round_trip(t *testing.T) {
 		})
 	}
 }
+
+func TestCryptoKey_Select(t *testing.T) {
+	var ck CryptoKey
+	db := test.NewTestDB(t)
+
+	err := ck.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	ck.ID = 1
+	err = ck.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestCryptoKey_Delete(t *testing.T) {
+	var ck CryptoKey
+	db := test.NewTestDB(t)
+
+	err := ck.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	ck.ID = 1
+	err = ck.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
+
+type testCryptoKey [4]byte
+
+func newTestCryptoKey(_ any) (*comid.CryptoKey, error) {
+	return &comid.CryptoKey{Value: &testCryptoKey{0x74, 0x64, 0x73, 0x74}}, nil
+}
+
+func (o testCryptoKey) PublicKey() (crypto.PublicKey, error) {
+	return crypto.PublicKey(o[:]), nil
+}
+
+func (o testCryptoKey) Type() string {
+	return "test-crypto-key"
+}
+
+func (o testCryptoKey) String() string {
+	return "test"
+}
+
+func (o testCryptoKey) Valid() error {
+	return nil
+}
+
+func Test_RegisterCryptoKey(t *testing.T) {
+	err := comid.RegisterCryptoKeyType(99998, newTestCryptoKey)
+	require.NoError(t, err)
+
+	origin, err := comid.NewCryptoKey(nil, "test-crypto-key")
+	require.NoError(t, err)
+
+	ck, err := NewCryptoKeyFromCoRIM(origin)
+	assert.NoError(t, err)
+	assert.Equal(t, "test-crypto-key", ck.KeyType)
+	assert.Equal(t, []byte{
+		0xda, 0x00, 0x01, 0x86, 0x9e, // tag(99998)
+		0x44,                   // bstr(4)
+		0x74, 0x64, 0x73, 0x74, // data
+	}, ck.KeyBytes)
+
+	other, err := ck.ToCoRIM()
+	assert.NoError(t, err)
+	assert.Equal(t, origin, other)
+}
diff --git a/pkg/model/digest.go b/pkg/model/digest.go
index 322f0a8..2afd3d1 100644
--- a/pkg/model/digest.go
+++ b/pkg/model/digest.go
@@ -61,12 +61,12 @@ func (o *Digest) Insert(ctx context.Context, db bun.IDB) error {
 	return err
 }
 
-func (o *Digest) Select(ctx context.Context, db bun.IDB, id int64) error {
+func (o *Digest) Select(ctx context.Context, db bun.IDB) error {
 	if o.ID == 0 {
 		return errors.New("ID not set")
 	}
 
-	return db.NewSelect().Model(o).Where("id = ?", id).Scan(ctx)
+	return db.NewSelect().Model(o).Where("id = ?", o.ID).Scan(ctx)
 }
 
 func (o *Digest) Delete(ctx context.Context, db bun.IDB) error {
diff --git a/pkg/model/digest_test.go b/pkg/model/digest_test.go
new file mode 100644
index 0000000..888c1e1
--- /dev/null
+++ b/pkg/model/digest_test.go
@@ -0,0 +1,33 @@
+package model
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/veraison/corim-store/pkg/test"
+)
+
+func TestDigest_Select(t *testing.T) {
+	var digest Digest
+	db := test.NewTestDB(t)
+
+	err := digest.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	digest.ID = 1
+	err = digest.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestDigest_Delete(t *testing.T) {
+	var digest Digest
+	db := test.NewTestDB(t)
+
+	err := digest.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	digest.ID = 1
+	err = digest.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/entity.go b/pkg/model/entity.go
index 02f0daa..d9d8c90 100644
--- a/pkg/model/entity.go
+++ b/pkg/model/entity.go
@@ -35,10 +35,10 @@ func CoRIMEntitiesToCoRIM(origin []*Entity) (*corim.Entities, error) {
 	}
 
 	ret := corim.NewEntities()
-	for _, origEntity := range origin {
+	for i, origEntity := range origin {
 		entity, err := origEntity.ToCoRIMCoRIM()
 		if err != nil {
-			return nil, fmt.Errorf("problem with entity %+v: %w", origEntity, err)
+			return nil, fmt.Errorf("entity at index %d: %w", i, err)
 		}
 
 		ret.Add(entity)
@@ -251,6 +251,15 @@ func (o *Entity) Insert(ctx context.Context, db bun.IDB) error {
 		}
 	}
 
+	for _, ext := range o.Extensions {
+		ext.OwnerID = o.ID
+		ext.OwnerType = "entity"
+
+		if err := ext.Insert(ctx, db); err != nil {
+			return fmt.Errorf("error inserting extension %+v: %w", ext, err)
+		}
+	}
+
 	return nil
 }
 
diff --git a/pkg/model/entity_test.go b/pkg/model/entity_test.go
new file mode 100644
index 0000000..1e1abc1
--- /dev/null
+++ b/pkg/model/entity_test.go
@@ -0,0 +1,108 @@
+package model
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/veraison/corim-store/pkg/test"
+	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/corim"
+	"github.com/veraison/corim/extensions"
+)
+
+type entityExtension struct {
+	Foo string `cbor:"-1,keyasint" json:"foo"`
+}
+
+func TestEntity_comid_roundtrip(t *testing.T) {
+	origin := new(comid.Entity).
+		SetName("test-entity").
+		SetRegID("http://example.com").
+		SetRoles(comid.RoleMaintainer)
+
+	exts := extensions.Map{
+		comid.ExtEntity: &entityExtension{},
+	}
+	err := origin.RegisterExtensions(exts)
+	require.NoError(t, err)
+
+	err = origin.Set("foo", "bar")
+	require.NoError(t, err)
+
+	entity, err := NewCoMIDEntityFromCoRIM(origin)
+	assert.NoError(t, err)
+
+	db := test.NewTestDB(t)
+	err = entity.Insert(context.Background(), db)
+	assert.NoError(t, err)
+
+	var selection Entity
+	err = selection.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	selection.ID = 1
+	err = selection.Select(context.Background(), db)
+	assert.NoError(t, err)
+
+	assert.Equal(t, selection.Roles(), []string{"maintainer"})
+
+	other, err := selection.ToCoMIDCoRIM()
+	assert.NoError(t, err)
+
+	assert.Equal(t, origin.Name, other.Name)
+	assert.Equal(t, origin.RegID, other.RegID)
+	assert.Equal(t, origin.Roles, other.Roles)
+	assert.Equal(t, origin.MustGetString("foo"), other.MustGetString("foo"))
+
+	err = selection.Delete(context.Background(), db)
+	assert.NoError(t, err)
+
+	selection.ID = 0
+	err = selection.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	missing := Entity{ID: 1}
+	err = missing.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows")
+}
+
+func TestEntity_corim_roundtrip(t *testing.T) {
+	origin := new(corim.Entity).
+		SetName("test-entity").
+		SetRegID("http://example.com").
+		SetRoles(corim.RoleManifestCreator)
+
+	exts := extensions.Map{
+		corim.ExtEntity: &entityExtension{},
+	}
+	err := origin.RegisterExtensions(exts)
+	require.NoError(t, err)
+
+	err = origin.Set("foo", "bar")
+	require.NoError(t, err)
+
+	entity, err := NewCoRIMEntityFromCoRIM(origin)
+	assert.NoError(t, err)
+
+	db := test.NewTestDB(t)
+	err = entity.Insert(context.Background(), db)
+	assert.NoError(t, err)
+
+	var selection Entity
+	err = selection.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	selection.ID = 1
+	err = selection.Select(context.Background(), db)
+	assert.NoError(t, err)
+
+	other, err := selection.ToCoRIMCoRIM()
+	assert.NoError(t, err)
+
+	assert.Equal(t, origin.Name, other.Name)
+	assert.Equal(t, origin.RegID, other.RegID)
+	assert.Equal(t, origin.Roles, other.Roles)
+	assert.Equal(t, origin.MustGetString("foo"), other.MustGetString("foo"))
+}
diff --git a/pkg/model/environment.go b/pkg/model/environment.go
index e3d0dd9..2f0652c 100644
--- a/pkg/model/environment.go
+++ b/pkg/model/environment.go
@@ -3,10 +3,12 @@ package model
 import (
 	"context"
 	"database/sql"
+	"encoding/hex"
 	"errors"
 	"fmt"
 
 	"github.com/fxamacker/cbor/v2"
+	"github.com/google/uuid"
 	"github.com/uptrace/bun"
 	"github.com/veraison/corim/comid"
 )
@@ -272,8 +274,7 @@ func (o *Environment) Select(ctx context.Context, db bun.IDB) error {
 		return errors.New("ID not set")
 	}
 
-	_, err := db.NewSelect().Model(o).Where("env.id = ?", o.ID).Exec(ctx)
-	return err
+	return db.NewSelect().Model(o).Where("env.id = ?", o.ID).Scan(ctx)
 }
 
 func (o *Environment) DeleteIfOrphaned(ctx context.Context, db bun.IDB) error {
@@ -298,6 +299,86 @@ func (o *Environment) DeleteIfOrphaned(ctx context.Context, db bun.IDB) error {
 	return err
 }
 
+func (o Environment) RenderParts() ([][2]string, error) {
+	if o.IsEmpty() {
+		return nil, nil
+	}
+
+	if err := o.Validate(); err != nil {
+		return nil, err
+	}
+
+	var ret [][2]string
+
+	if o.Vendor != nil && *o.Vendor != "" {
+		ret = append(ret, [2]string{"vendor", *o.Vendor})
+	}
+
+	if o.Model != nil && *o.Model != "" {
+		ret = append(ret, [2]string{"model", *o.Model})
+	}
+
+	if o.ClassBytes != nil {
+		var val string
+		switch *o.ClassType {
+		case comid.OIDType:
+			val = comid.OID(*o.ClassBytes).String()
+		case comid.UUIDType:
+			u, err := uuid.ParseBytes(*o.ClassBytes)
+			if err != nil {
+				return nil, fmt.Errorf("class: %w", err)
+			}
+			val = u.String()
+		default:
+			val = hex.EncodeToString(*o.ClassBytes)
+		}
+
+		ret = append(ret, [2]string{"class", val})
+	}
+
+	if o.InstanceBytes != nil {
+		var val string
+		switch *o.InstanceType {
+		case comid.OIDType:
+			val = comid.OID(*o.InstanceBytes).String()
+		case comid.UUIDType:
+			u, err := uuid.ParseBytes(*o.InstanceBytes)
+			if err != nil {
+				return nil, fmt.Errorf("class: %w", err)
+			}
+			val = u.String()
+		case comid.UEIDType:
+			val = comid.UEID(*o.InstanceBytes).String()
+		default:
+			val = hex.EncodeToString(*o.InstanceBytes)
+		}
+
+		ret = append(ret, [2]string{"instance", val})
+	}
+
+	if o.GroupBytes != nil {
+		var val string
+		switch *o.GroupType {
+		case comid.OIDType:
+			val = comid.OID(*o.GroupBytes).String()
+		default:
+			val = hex.EncodeToString(*o.GroupBytes)
+		}
+
+		ret = append(ret, [2]string{"group", val})
+	}
+
+	if o.Layer != nil {
+		ret = append(ret, [2]string{"layer", fmt.Sprintf("%d", *o.Layer)})
+	}
+
+	if o.Index != nil {
+		ret = append(ret, [2]string{"index", fmt.Sprintf("%d", *o.Index)})
+	}
+
+	return ret, nil
+}
+
 func (o *Environment) getOwnerIDs(ctx context.Context, db bun.IDB, ownerTable string) ([]int64, error) {
 	var ownerIDs []int64
 	err := db.NewSelect().
diff --git a/pkg/model/environment_test.go b/pkg/model/environment_test.go
index f5a6bcb..a9619c4 100644
--- a/pkg/model/environment_test.go
+++ b/pkg/model/environment_test.go
@@ -44,12 +44,64 @@ func (o IntInstance) Bytes() []byte {
 	return buf
 }
 
+type IntClassID struct {
+	V int64 `cbor:"1,keyasint"`
+}
+
+func NewIntClassID(v int64) *IntClassID {
+	return &IntClassID{v}
+}
+
+func (o IntClassID) Type() string {
+	return "int64"
+}
+
+func (o IntClassID) Valid() error {
+	return nil
+}
+
+func (o IntClassID) String() string {
+	return fmt.Sprintf("%d", o)
+}
+
+func (o IntClassID) Bytes() []byte {
+	buf := make([]byte, 8)
+	binary.BigEndian.PutUint64(buf, uint64(o.V))
+	return buf
+}
+
+type IntGroup struct {
+	V int64 `cbor:"1,keyasint"`
+}
+
+func NewIntGroup(v int64) *IntGroup {
+	return &IntGroup{v}
+}
+
+func (o IntGroup) Type() string {
+	return "int64"
+}
+
+func (o IntGroup) Valid() error {
+	return nil
+}
+
+func (o IntGroup) String() string {
+	return fmt.Sprintf("%d", o)
+}
+
+func (o IntGroup) Bytes() []byte {
+	buf := make([]byte, 8)
+	binary.BigEndian.PutUint64(buf, uint64(o.V))
+	return buf
+}
+
 func TestEnvironment_round_trip(t *testing.T) {
 	ctx := context.Background()
 	db := test.NewTestDB(t)
 	defer func() { assert.NoError(t, db.Close()) }()
 
-	factory := func(v any) (*comid.Instance, error) {
+	instanceFactory := func(v any) (*comid.Instance, error) {
 		if v == nil {
 			return &comid.Instance{Value: NewIntInstance(0)}, nil
 		}
@@ -64,13 +116,55 @@ func TestEnvironment_round_trip(t *testing.T) {
 		}
 	}
 
-	err := comid.RegisterInstanceType(777, factory)
+	err := comid.RegisterInstanceType(777, instanceFactory)
+	require.NoError(t, err)
+
+	testExtInstance, err := instanceFactory(7)
+	require.NoError(t, err)
+
+	classIDFactory := func(v any) (*comid.ClassID, error) {
+		if v == nil {
+			return &comid.ClassID{Value: NewIntClassID(0)}, nil
+		}
+
+		switch t := v.(type) {
+		case int:
+			return &comid.ClassID{Value: NewIntClassID(int64(t))}, nil
+		case int64:
+			return &comid.ClassID{Value: NewIntClassID(t)}, nil
+		default:
+			return nil, fmt.Errorf("invalid IntClass: %+v", t)
+		}
+	}
+
+	err = comid.RegisterClassIDType(778, classIDFactory)
+	require.NoError(t, err)
+
+	testExtClassID, err := classIDFactory(7)
+	require.NoError(t, err)
+
+	groupFactory := func(v any) (*comid.Group, error) {
+		if v == nil {
+			return &comid.Group{Value: NewIntGroup(0)}, nil
+		}
+
+		switch t := v.(type) {
+		case int:
+			return &comid.Group{Value: NewIntGroup(int64(t))}, nil
+		case int64:
+			return &comid.Group{Value: NewIntGroup(t)}, nil
+		default:
+			return nil, fmt.Errorf("invalid IntGroup: %+v", t)
+		}
+	}
+
+	err = comid.RegisterGroupType(779, groupFactory)
 	require.NoError(t, err)
 
-	testExtInstance, err := factory(7)
+	testExtGroup, err := groupFactory(7)
 	require.NoError(t, err)
 
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		env   comid.Environment
 	}{
@@ -89,20 +183,62 @@ func TestEnvironment_round_trip(t *testing.T) {
 			},
 		},
 		{
-			title: "minimal",
+			title: "class UUID",
+			env: comid.Environment{
+				Class: &comid.Class{
+					ClassID: comid.MustNewUUIDClassID(comid.TestUUID),
+				},
+			},
+		},
+		{
+			title: "class bytes",
+			env: comid.Environment{
+				Class: &comid.Class{
+					ClassID: comid.MustNewBytesClassID(comid.TestBytes),
+				},
+			},
+		},
+		{
+			title: "class extension",
+			env: comid.Environment{
+				Class: &comid.Class{
+					ClassID: testExtClassID,
+				},
+			},
+		},
+		{
+			title: "instance UEID",
 			env: comid.Environment{
 				Instance: comid.MustNewUEIDInstance(comid.TestUEID),
 			},
 		},
 		{
-			title: "extension",
+			title: "instance bytes",
+			env: comid.Environment{
+				Instance: comid.MustNewBytesInstance(comid.TestBytes),
+			},
+		},
+		{
+			title: "instance extension",
 			env: comid.Environment{
 				Instance: testExtInstance,
 			},
 		},
+		{
+			title: "group bytes",
+			env: comid.Environment{
+				Group: comid.MustNewBytesGroup(comid.TestBytes),
+			},
+		},
+		{
+			title: "group extension",
+			env: comid.Environment{
+				Group: testExtGroup,
+			},
+		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			env, err := NewEnvironmentFromCoRIM(&tc.env)
 			assert.NoError(t, err)
@@ -121,10 +257,40 @@ func TestEnvironment_round_trip(t *testing.T) {
 	}
 }
 
+func TestEnvironment_ToCoRIM_bad(t *testing.T) {
+	uuidType := comid.UUIDType
+	bytes := comid.MustHexDecode(t, "deadbeef")
+	testCases := []struct {
+		title string
+		env   Environment
+		err   string
+	}{
+		{
+			title: "UUID class ID",
+			env: Environment{
+				ClassType:  &uuidType,
+				ClassBytes: &bytes,
+			},
+			err: "could not initialize UUID class ID",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			_, err := tc.env.ToCoRIM()
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
 func TestEnvironment_Validate(t *testing.T) {
 	testType := comid.BytesType
 	testBytes := comid.MustHexDecode(t, "deadbeef")
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		env   Environment
 		err   string
@@ -165,7 +331,7 @@ func TestEnvironment_Validate(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			err := tc.env.Validate()
 			if tc.err == "" {
@@ -213,3 +379,109 @@ func TestEnvironment_uniqueness(t *testing.T) {
 	assert.NoError(t, db.NewSelect().Model(&allEnvs).Scan(ctx))
 	assert.Len(t, allEnvs, 2)
 }
+
+func TestEnvironment_Select(t *testing.T) {
+	var env Environment
+	db := test.NewTestDB(t)
+
+	err := env.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	env.ID = 1
+	err = env.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestEnvironment_DeleteIfOrphaned(t *testing.T) {
+	var env Environment
+	db := test.NewTestDB(t)
+
+	err := env.DeleteIfOrphaned(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	env.ID = 1
+	err = env.DeleteIfOrphaned(context.Background(), db)
+	assert.NoError(t, err)
+}
+
+func TestEnvironment_IsEmpty(t *testing.T) {
+	var env Environment
+	assert.True(t, env.IsEmpty())
+
+	env.ClassBytes = &comid.TestBytes
+	assert.False(t, env.IsEmpty())
+}
+
+func TestEnvironment_RenderParts(t *testing.T) {
+	oidType := comid.OIDType
+	ueidType := comid.UEIDType
+	vendor := "foo"
+	model := "bar"
+	layer := uint64(1)
+	index := uint64(0)
+
+	testCases := []struct {
+		title    string
+		env      Environment
+		expected [][2]string
+		err      string
+	}{
+		{
+			title: "ok full",
+			env: Environment{
+				Vendor:        &vendor,
+				Model:         &model,
+				ClassType:     &oidType,
+				ClassBytes:    &[]byte{0x01, 0x02, 0x03, 0x04},
+				InstanceType:  &ueidType,
+				InstanceBytes: &[]byte{0x05, 0x06, 0x07, 0x08},
+				GroupType:     &oidType,
+				GroupBytes:    &[]byte{0x09, 0x0a, 0x0b, 0x0c},
+				Layer:         &layer,
+				Index:         &index,
+			},
+			expected: [][2]string{
+				{"vendor", "foo"},
+				{"model", "bar"},
+				{"class", "0.1.2.3.4"},
+				{"instance", "BQYHCA=="},
+				{"group", "0.9.10.11.12"},
+				{"layer", "1"},
+				{"index", "0"},
+			},
+		},
+		{
+			title: "ok minimal",
+			env: Environment{
+				Model: &model,
+			},
+			expected: [][2]string{
+				{"model", "bar"},
+			},
+		},
+		{
+			title:    "ok empty",
+			env:      Environment{},
+			expected: nil,
+		},
+		{
+			title: "bad",
+			env: Environment{
+				ClassBytes: &[]byte{0x01, 0x02, 0x03, 0x04},
+			},
+			err: "ClassType and ClassBytes must be set together",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			res, err := tc.env.RenderParts()
+			if tc.err == "" {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expected, res)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
diff --git a/pkg/model/extension.go b/pkg/model/extension.go
index 6fa60a8..e5b66d5 100644
--- a/pkg/model/extension.go
+++ b/pkg/model/extension.go
@@ -193,12 +193,12 @@ func (o *ExtensionValue) Insert(ctx context.Context, db bun.IDB) error {
 	return err
 }
 
-func (o *ExtensionValue) Select(ctx context.Context, db bun.IDB, id int64) error {
+func (o *ExtensionValue) Select(ctx context.Context, db bun.IDB) error {
 	if o.ID == 0 {
 		return errors.New("ID not set")
 	}
 
-	return db.NewSelect().Model(o).Where("id = ?", id).Scan(ctx)
+	return db.NewSelect().Model(o).Where("id = ?", o.ID).Scan(ctx)
 }
 
 func (o *ExtensionValue) Delete(ctx context.Context, db bun.IDB) error {
diff --git a/pkg/model/extension_test.go b/pkg/model/extension_test.go
index 992cd67..95aaf26 100644
--- a/pkg/model/extension_test.go
+++ b/pkg/model/extension_test.go
@@ -13,15 +13,26 @@ func TestExtensionValue_round_trip(t *testing.T) {
 	ctx := context.Background()
 	db := test.NewTestDB(t)
 	defer func() { assert.NoError(t, db.Close()) }()
+	testStr := "acme"
 
 	extStruct := struct {
 		Foo int64              `cbor:"0,keyasint,omitempty" json:"foo,omitempty"`
 		Bar string             `cbor:"1,keyasint,omitempty" json:"bar,omitempty"`
 		Qux struct{ Zap bool } `cbor:"2,keyasint,omitempty" json:"qux,omitempty"`
+		Baz uint               `cbor:"3,keyasint,omitempty" json:"baz,omitempty"`
+		Zot bool               `cbor:"4,keyasint,omitempty" json:"zot,omitempty"`
+		Zof bool               `cbor:"5,keyasint,omitempty" json:"zof,omitempty"`
+		Bap *string            `cbor:"6,keyasint,omitempty" json:"bap,omitempty"`
+		Fop float64            `cbor:"7,keyasint,omitempty" json:"fop,omitempty"`
 	}{
 		Foo: 7,
 		Bar: "baz",
 		Qux: struct{ Zap bool }{true},
+		Baz: 42,
+		Zot: true,
+		Zof: false,
+		Bap: &testStr,
+		Fop: 1.7,
 	}
 
 	var original comid.Extensions
@@ -29,7 +40,7 @@ func TestExtensionValue_round_trip(t *testing.T) {
 
 	extVals, err := CoMIDExtensionsFromCoRIM(original)
 	assert.NoError(t, err)
-	assert.Len(t, extVals, 3)
+	assert.Len(t, extVals, 8)
 
 	for _, ev := range extVals {
 		ev.OwnerID = 1
@@ -42,7 +53,7 @@ func TestExtensionValue_round_trip(t *testing.T) {
 
 	err = db.NewSelect().Model(&resVals).Scan(ctx)
 	assert.NoError(t, err)
-	assert.Len(t, resVals, 3)
+	assert.Len(t, resVals, 8)
 
 	returnedExts, err := CoMIDExtensionsToCoRIM(resVals)
 	assert.NoError(t, err)
@@ -53,3 +64,27 @@ func TestExtensionValue_round_trip(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, map[interface{}]interface{}{"Zap": true}, val)
 }
+
+func TestExtensionValue_Select(t *testing.T) {
+	var ev ExtensionValue
+	db := test.NewTestDB(t)
+
+	err := ev.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	ev.ID = 1
+	err = ev.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestExtensionValue_Delete(t *testing.T) {
+	var ev ExtensionValue
+	db := test.NewTestDB(t)
+
+	err := ev.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	ev.ID = 1
+	err = ev.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/flag.go b/pkg/model/flag.go
index e11d136..1c595a6 100644
--- a/pkg/model/flag.go
+++ b/pkg/model/flag.go
@@ -158,12 +158,12 @@ func (o *Flag) Insert(ctx context.Context, db bun.IDB) error {
 	return err
 }
 
-func (o *Flag) Select(ctx context.Context, db bun.IDB, id int64) error {
+func (o *Flag) Select(ctx context.Context, db bun.IDB) error {
 	if o.ID == 0 {
 		return errors.New("ID not set")
 	}
 
-	return db.NewSelect().Model(o).Where("id = ?", id).Scan(ctx)
+	return db.NewSelect().Model(o).Where("id = ?", o.ID).Scan(ctx)
 }
 
 func (o *Flag) Delete(ctx context.Context, db bun.IDB) error {
diff --git a/pkg/model/flag_test.go b/pkg/model/flag_test.go
new file mode 100644
index 0000000..11575d4
--- /dev/null
+++ b/pkg/model/flag_test.go
@@ -0,0 +1,140 @@
+package model
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/veraison/corim-store/pkg/test"
+	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/extensions"
+)
+
+type flagsMapExtension struct {
+	Foo bool `cbor:"-1,keyasint" json:"foo"`
+}
+
+type badFlagsMapExtension struct {
+	Bar string `cbor:"-1,keyasint" json:"bar"`
+}
+
+func TestFlags_round_trip(t *testing.T) {
+	trueVal := true
+	falseVal := false
+
+	testCases := []struct {
+		title    string
+		flags    *comid.FlagsMap
+		expected []*Flag
+		err      string
+	}{
+		{
+			title: "ok full",
+			flags: &comid.FlagsMap{
+				IsConfigured:               &trueVal,
+				IsSecure:                   &trueVal,
+				IsRecovery:                 &falseVal,
+				IsDebug:                    &falseVal,
+				IsReplayProtected:          &trueVal,
+				IsIntegrityProtected:       &falseVal,
+				IsRuntimeMeasured:          &trueVal,
+				IsImmutable:                &trueVal,
+				IsTcb:                      &trueVal,
+				IsConfidentialityProtected: &trueVal,
+			},
+			expected: []*Flag{
+				&Flag{CodePoint: IsConfiguredFlag, Value: true},
+				&Flag{CodePoint: IsSecureFlag, Value: true},
+				&Flag{CodePoint: IsRecoveryFlag, Value: false},
+				&Flag{CodePoint: IsDebugFlag, Value: false},
+				&Flag{CodePoint: IsReplayProtectedFlag, Value: true},
+				&Flag{CodePoint: IsIntegrityProtectedFlag, Value: false},
+				&Flag{CodePoint: IsRuntimeMeasuredFlag, Value: true},
+				&Flag{CodePoint: IsImmutableFlag, Value: true},
+				&Flag{CodePoint: IsTcbFlag, Value: true},
+				&Flag{CodePoint: IsConfidentialityProtectedFlag, Value: true},
+			},
+		},
+		{
+			title: "ok minimal",
+			flags: &comid.FlagsMap{
+				IsSecure: &falseVal,
+			},
+			expected: []*Flag{
+				&Flag{CodePoint: IsSecureFlag, Value: false},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			flags, err := FlagsFromCoRIM(tc.flags)
+			if tc.err == "" {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expected, flags)
+
+				other, err := FlagsToCoRIM(flags)
+				assert.NoError(t, err)
+				assert.Equal(t, tc.flags, other)
+
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+
+	flagsMap := comid.NewFlagsMap()
+	err := flagsMap.RegisterExtensions(extensions.Map{
+		comid.ExtFlags: &flagsMapExtension{},
+	})
+	require.NoError(t, err)
+	err = flagsMap.Set("foo", true)
+	require.NoError(t, err)
+
+	flags, err := FlagsFromCoRIM(flagsMap)
+	assert.NoError(t, err)
+	assert.Equal(t, []*Flag{&Flag{CodePoint: -1, Value: true}}, flags)
+
+	other, err := FlagsToCoRIM(flags)
+	assert.NoError(t, err)
+
+	val, err := other.GetBool("-1")
+	assert.NoError(t, err)
+	assert.Equal(t, true, val)
+
+	flagsMap = comid.NewFlagsMap()
+	err = flagsMap.RegisterExtensions(extensions.Map{
+		comid.ExtFlags: &badFlagsMapExtension{},
+	})
+	require.NoError(t, err)
+	err = flagsMap.Set("bar", "qux")
+	require.NoError(t, err)
+
+	_, err = FlagsFromCoRIM(flagsMap)
+	assert.ErrorContains(t, err, "invalid Flags extension")
+}
+
+func TestFlag_Select(t *testing.T) {
+	var digest Flag
+	db := test.NewTestDB(t)
+
+	err := digest.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	digest.ID = 1
+	err = digest.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestFlag_Delete(t *testing.T) {
+	var flag Flag
+	db := test.NewTestDB(t)
+
+	err := flag.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	flag.ID = 1
+	err = flag.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/integrityregister.go b/pkg/model/integrityregister.go
index 8f5680a..08b09b3 100644
--- a/pkg/model/integrityregister.go
+++ b/pkg/model/integrityregister.go
@@ -98,6 +98,20 @@ type IntegrityRegister struct {
 	MeasurementID int64 `bun:",nullzero"`
 }
 
+// StringIndex return the index of this IntegrityRegister as a string. If
+// IndexText is set, it returns the value it points at, If IndexUint is set,
+// the value it points to formatted as a string is returned. Otherwise, the
+// string "nil" is returned.
+func (o *IntegrityRegister) StringIndex() string {
+	if o.IndexText != nil { // nolint: gocritic
+		return *o.IndexText
+	} else if o.IndexUint != nil {
+		return fmt.Sprint(*o.IndexUint)
+	} else {
+		return "nil"
+	}
+}
+
 func (o *IntegrityRegister) Insert(ctx context.Context, db bun.IDB) error {
 	if _, err := db.NewInsert().Model(o).Exec(ctx); err != nil {
 		return err
@@ -115,11 +129,15 @@ func (o *IntegrityRegister) Insert(ctx context.Context, db bun.IDB) error {
 	return nil
 }
 
-func (o *IntegrityRegister) Select(ctx context.Context, db bun.IDB, id int64) error {
+func (o *IntegrityRegister) Select(ctx context.Context, db bun.IDB) error {
+	if o.ID == 0 {
+		return errors.New("ID not set")
+	}
+
 	return db.NewSelect().
 		Model(o).
 		Relation("Digests").
-		Where("id = ?", id).
+		Where("id = ?", o.ID).
 		Scan(ctx)
 }
 
diff --git a/pkg/model/integrityregister_test.go b/pkg/model/integrityregister_test.go
new file mode 100644
index 0000000..ba7d35f
--- /dev/null
+++ b/pkg/model/integrityregister_test.go
@@ -0,0 +1,94 @@
+package model
+
+import (
+	"context"
+	"sort"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/veraison/corim-store/pkg/test"
+	"github.com/veraison/corim/comid"
+	"github.com/veraison/swid"
+)
+
+var testDigest = Digest{
+	AlgID: 1,
+	Value: []byte{
+		0xe4, 0x5b, 0x72, 0xf5, 0xc0, 0xc0, 0xb5, 0x72,
+		0xdb, 0x4d, 0x8d, 0x3a, 0xb7, 0xe9, 0x7f, 0x36,
+		0x8f, 0xf7, 0x4e, 0x62, 0x34, 0x7a, 0x82, 0x4d,
+		0xec, 0xb6, 0x7a, 0x84, 0xe5, 0x22, 0x4d, 0x75,
+	},
+}
+
+func TestIntegrityRegister_round_trip(t *testing.T) {
+	originDigest := swid.HashEntry{
+		HashAlgID: swid.Sha256,
+		HashValue: comid.MustHexDecode(
+			t,
+			"e45b72f5c0c0b572db4d8d3ab7e97f368ff74e62347a824decb67a84e5224d75",
+		),
+	}
+	idxOne := uint(1)
+	idxOne64 := uint64(1)
+	idxTwo := uint64(2)
+	idxFoo := "foo"
+	origin := comid.NewIntegrityRegisters()
+	require.NoError(t, origin.AddDigest(idxFoo, originDigest))
+	require.NoError(t, origin.AddDigest(idxOne, originDigest))
+	require.NoError(t, origin.AddDigest(idxTwo, originDigest))
+
+	regs, err := IntegerityRegistersFromCoRIM(origin)
+	sort.SliceStable(regs, func(i, j int) bool {
+		return regs[i].StringIndex() < regs[j].StringIndex()
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []*IntegrityRegister{
+		{IndexUint: &idxOne64, Digests: []*Digest{&testDigest}},
+		{IndexUint: &idxTwo, Digests: []*Digest{&testDigest}},
+		{IndexText: &idxFoo, Digests: []*Digest{&testDigest}},
+	}, regs)
+
+	other, err := IntegerityRegistersToCoRIM(regs)
+	assert.NoError(t, err)
+	assert.Equal(t, origin.IndexMap[idxFoo], other.IndexMap[idxFoo])
+	// note: different index types because the store make no distinction
+	// between different unsigned integer types -- they are all stored as
+	// uint64.
+	assert.Equal(t, origin.IndexMap[idxOne], other.IndexMap[idxOne64])
+	assert.Equal(t, origin.IndexMap[idxTwo], other.IndexMap[idxTwo])
+}
+
+func TestIntegrityRegistersToCoRIM_bad(t *testing.T) {
+	_, err := IntegerityRegistersToCoRIM([]*IntegrityRegister{{Digests: []*Digest{&testDigest}}})
+	assert.ErrorContains(t, err, "neither index set")
+
+	idx := uint64(1)
+	_, err = IntegerityRegistersToCoRIM([]*IntegrityRegister{{IndexUint: &idx}})
+	assert.ErrorContains(t, err, "no digests")
+}
+
+func TestIntegrityRegister_Select(t *testing.T) {
+	var reg IntegrityRegister
+	db := test.NewTestDB(t)
+
+	err := reg.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	reg.ID = 1
+	err = reg.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestIntegrityRegister_Delete(t *testing.T) {
+	var reg IntegrityRegister
+	db := test.NewTestDB(t)
+
+	err := reg.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	reg.ID = 1
+	err = reg.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/keytriple.go b/pkg/model/keytriple.go
index 47707d0..b3f0263 100644
--- a/pkg/model/keytriple.go
+++ b/pkg/model/keytriple.go
@@ -71,7 +71,10 @@ type KeyTriple struct {
 	KeyList []*CryptoKey `bun:"rel:has-many,join:id=owner_id,join:type=owner_type,polymorphic:key_triple"`
 
 	AuthorizedBy []*CryptoKey `bun:"rel:has-many,join:id=owner_id,join:type=owner_type,polymorphic:key_triple_auth"`
-	ModuleID     int64        `bun:",nullzero"`
+
+	IsActive bool
+
+	ModuleID int64 `bun:",nullzero"`
 }
 
 func NewKeyTripleFromCoRIM(origin *comid.KeyTriple) (*KeyTriple, error) {
diff --git a/pkg/model/keytriple_test.go b/pkg/model/keytriple_test.go
index f3e9197..e5988fd 100644
--- a/pkg/model/keytriple_test.go
+++ b/pkg/model/keytriple_test.go
@@ -15,7 +15,7 @@ func TestKeyTriple_round_trip(t *testing.T) {
 	db := test.NewTestDB(t)
 	defer func() { assert.NoError(t, db.Close()) }()
 
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		kt    comid.KeyTriple
 	}{
@@ -32,7 +32,7 @@ func TestKeyTriple_round_trip(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			kt, err := NewKeyTripleFromCoRIM(&tc.kt)
 			assert.NoError(t, err)
@@ -59,7 +59,7 @@ func TestKeyTriple_round_trip(t *testing.T) {
 func TestKeyTriple_Validate(t *testing.T) {
 	testType := comid.BytesType
 	testBytes := comid.MustHexDecode(t, "deadbeef")
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		kt    KeyTriple
 		err   string
@@ -112,7 +112,7 @@ func TestKeyTriple_Validate(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			err := tc.kt.Validate()
 			if tc.err == "" {
@@ -123,3 +123,65 @@ func TestKeyTriple_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestKeyTriple_CRUD(t *testing.T) {
+	model := "foo"
+	kt := KeyTriple{
+		Environment: &Environment{
+			Model: &model,
+		},
+		Type: AttestKeyTriple,
+		KeyList: []*CryptoKey{
+			{
+				KeyType:  comid.PKIXBase64KeyType,
+				KeyBytes: []byte{0x01, 0x02, 0x03, 0x04},
+			},
+		},
+		AuthorizedBy: []*CryptoKey{
+			{
+				KeyType:  comid.PKIXBase64KeyType,
+				KeyBytes: []byte{0x05, 0x06, 0x07, 0x08},
+			},
+		},
+	}
+
+	db := test.NewTestDB(t)
+
+	err := kt.Insert(context.Background(), db)
+	assert.NoError(t, err)
+	assert.Equal(t, int64(1), kt.ID)
+	assert.Equal(t, int64(1), kt.EnvironmentID)
+	assert.Equal(t, int64(1), kt.KeyList[0].OwnerID)
+	assert.Equal(t, "key_triple", kt.KeyList[0].OwnerType)
+	assert.Equal(t, int64(1), kt.AuthorizedBy[0].OwnerID)
+	assert.Equal(t, "key_triple_auth", kt.AuthorizedBy[0].OwnerType)
+
+	err = kt.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
+
+func TestKeyTriple_Select(t *testing.T) {
+	var kt KeyTriple
+	db := test.NewTestDB(t)
+
+	err := kt.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	kt.ID = 1
+	err = kt.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestKeyTriple_Delete(t *testing.T) {
+	var kt KeyTriple
+	db := test.NewTestDB(t)
+
+	err := kt.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+}
+
+func TestKeyTriple_accessors(t *testing.T) {
+	var kt KeyTriple
+	assert.Equal(t, "key", kt.TripleType())
+	assert.Equal(t, int64(0), kt.DatabaseID())
+}
diff --git a/pkg/model/linkedtag.go b/pkg/model/linkedtag.go
index 2496f88..2553818 100644
--- a/pkg/model/linkedtag.go
+++ b/pkg/model/linkedtag.go
@@ -67,14 +67,9 @@ func NewLinkedTagFromCoRIM(origin *comid.LinkedTag) (*LinkedTag, error) {
 
 func SelectLinkedTag(ctx context.Context, db bun.IDB, id int64) (*LinkedTag, error) {
 	var ret LinkedTag
+	ret.ID = id
 
-	err := db.NewSelect().
-		Model(&ret).
-		Relation("Module").
-		Where("lnk.id = ?", id).
-		Scan(ctx)
-
-	if err != nil {
+	if err := ret.Select(ctx, db); err != nil {
 		return nil, err
 	}
 
@@ -152,6 +147,14 @@ func (o *LinkedTag) ToCoRIM() (*comid.LinkedTag, error) {
 	return &ret, nil
 }
 
+func (o *LinkedTag) Select(ctx context.Context, db bun.IDB) error {
+	if o.ID == 0 {
+		return errors.New("ID not set")
+	}
+
+	return db.NewSelect().Model(o).Where("lnk.id = ?", o.ID).Scan(ctx)
+}
+
 func (o *LinkedTag) Insert(ctx context.Context, db bun.IDB) error {
 	_, err := db.NewInsert().Model(o).Exec(ctx)
 	return err
diff --git a/pkg/model/linkedtag_test.go b/pkg/model/linkedtag_test.go
new file mode 100644
index 0000000..e338260
--- /dev/null
+++ b/pkg/model/linkedtag_test.go
@@ -0,0 +1,71 @@
+package model
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/veraison/corim-store/pkg/test"
+	"github.com/veraison/corim/comid"
+	"github.com/veraison/swid"
+)
+
+func TestLinkedTag_conversion(t *testing.T) {
+	origin := &comid.LinkedTag{
+		LinkedTagID: *swid.NewTagID(uuid.UUID(comid.TestUUID)),
+		Rel:         comid.RelReplaces,
+	}
+
+	var lt LinkedTag
+	err := lt.FromCoRIM(origin)
+	assert.NoError(t, err)
+
+	other, err := lt.ToCoRIM()
+	assert.NoError(t, err)
+	assert.Equal(t, origin, other)
+
+	badCorim := &comid.LinkedTag{
+		LinkedTagID: *swid.NewTagID(uuid.UUID(comid.TestUUID)),
+		Rel:         comid.Rel(-1),
+	}
+	err = lt.FromCoRIM(badCorim)
+	assert.ErrorContains(t, err, "unexpected tag relation")
+
+	badTag := LinkedTag{
+		LinkedTagIDType: "foo",
+	}
+	_, err = badTag.ToCoRIM()
+	assert.ErrorContains(t, err, "unexpected linked tag ID type")
+
+	badTag = LinkedTag{
+		LinkedTagIDType: StringTagID,
+		LinkedTagID:     "foo",
+		TagRelation:     TagRelation("bar"),
+	}
+	_, err = badTag.ToCoRIM()
+	assert.ErrorContains(t, err, "unexpected tag relation")
+}
+
+func TestLinkedTag_Select(t *testing.T) {
+	var tag LinkedTag
+	db := test.NewTestDB(t)
+
+	err := tag.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	_, err = SelectLinkedTag(context.Background(), db, 1)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestLinkedTag_Delete(t *testing.T) {
+	var tag LinkedTag
+	db := test.NewTestDB(t)
+
+	err := tag.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	tag.ID = 1
+	err = tag.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/locator_test.go b/pkg/model/locator_test.go
new file mode 100644
index 0000000..4b18db3
--- /dev/null
+++ b/pkg/model/locator_test.go
@@ -0,0 +1,52 @@
+package model
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/veraison/corim-store/pkg/test"
+)
+
+func TestLocator_conversion(t *testing.T) {
+	ret, err := LocatorsFromCoRIM(nil)
+	assert.Nil(t, ret)
+	assert.NoError(t, err)
+
+	other, err := LocatorsToCoRIM(nil)
+	assert.Nil(t, other)
+	assert.NoError(t, err)
+
+	locs := []*Locator{
+		{
+			Href:       "http://example.com",
+			Thumbprint: []*Digest{{}, {}},
+		},
+	}
+	_, err = LocatorsToCoRIM(locs)
+	assert.ErrorContains(t, err, "locator at index 0: multiple digests not supported")
+}
+
+func TestLocator_Select(t *testing.T) {
+	var loc Locator
+	db := test.NewTestDB(t)
+
+	err := loc.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	loc.ID = 1
+	err = loc.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestLocator_Delete(t *testing.T) {
+	var loc Locator
+	db := test.NewTestDB(t)
+
+	err := loc.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	loc.ID = 1
+	err = loc.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/manifest.go b/pkg/model/manifest.go
index 5dccc9e..0249f71 100644
--- a/pkg/model/manifest.go
+++ b/pkg/model/manifest.go
@@ -69,6 +69,10 @@ func SelectManifest(ctx context.Context, db bun.IDB, id int64) (*Manifest, error
 func (o *Manifest) FromCoRIM(origin *corim.UnsignedCorim) error {
 	var err error
 
+	if origin == nil {
+		return errors.New("nil input")
+	}
+
 	o.ManifestID = origin.ID.String()
 
 	// swid.TagID does not expose the underlying type in any way, but we
@@ -210,6 +214,12 @@ func (o *Manifest) ToCoRIM() (*corim.UnsignedCorim, error) {
 	return &ret, nil
 }
 
+func (o *Manifest) SetActive(value bool) {
+	for _, mt := range o.ModuleTags {
+		mt.SetActive(value)
+	}
+}
+
 func (o *Manifest) Insert(ctx context.Context, db bun.IDB) error {
 	if err := o.Validate(); err != nil {
 		return err
diff --git a/pkg/model/manifest_test.go b/pkg/model/manifest_test.go
index b851e8e..97b6d43 100644
--- a/pkg/model/manifest_test.go
+++ b/pkg/model/manifest_test.go
@@ -2,9 +2,11 @@ package model
 
 import (
 	"context"
+	"reflect"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/veraison/corim-store/pkg/test"
@@ -24,34 +26,48 @@ func TestManifest_round_trip(t *testing.T) {
 		Name:  comid.MustNewEntityName("foo", "string"),
 		Roles: *comid.NewRoles().Add(comid.RoleCreator),
 	})
+	testValueTriple := comid.ValueTriple{
+		Environment: comid.Environment{
+			Instance: comid.MustNewUUIDInstance(comid.TestUUID),
+		},
+		Measurements: *comid.NewMeasurements().Add(&comid.Measurement{
+			Val: comid.Mval{
+				RawValue: comid.NewRawValue().
+					SetBytes(
+						comid.MustHexDecode(
+							t,
+							"deadbeef")),
+			},
+		}),
+	}
 	testComid := comid.Comid{
 		Language:    &testLanguage,
 		Entities:    testEntities,
 		TagIdentity: comid.TagIdentity{TagID: *swid.NewTagID("foo"), TagVersion: 1},
 		Triples: comid.Triples{
-			ReferenceValues: comid.NewValueTriples().Add(&comid.ValueTriple{
-				Environment: comid.Environment{
-					Instance: comid.MustNewUUIDInstance(comid.TestUUID),
-				},
-				Measurements: *comid.NewMeasurements().Add(&comid.Measurement{
-					Val: comid.Mval{
-						RawValue: comid.NewRawValue().
-							SetBytes(
-								comid.MustHexDecode(
-									t,
-									"deadbeef")),
-					},
+			ReferenceValues: comid.NewValueTriples().Add(&testValueTriple),
+		},
+	}
+	testComidCondEnd := comid.Comid{
+		Language:    &testLanguage,
+		Entities:    testEntities,
+		TagIdentity: comid.TagIdentity{TagID: *swid.NewTagID("foo"), TagVersion: 1},
+		Triples: comid.Triples{
+			CondEndorseSeries: comid.NewCondEndorseSeriesTriples().
+				Add(&comid.CondEndorseSeriesTriple{
+					Condition: comid.StatefulEnv(testValueTriple),
+					Series:    *comid.NewCondEndorseSeriesRecords(),
 				}),
-			}),
 		},
 	}
 	testEpoch := time.Unix(0, 0)
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		man   *corim.UnsignedCorim
+		err   string
 	}{
 		{
-			title: "ok",
+			title: "ok string ID/OID profile",
 			man: corim.NewUnsignedCorim().
 				SetID("bar").
 				SetProfile("1.2.3.4").
@@ -63,39 +79,144 @@ func TestManifest_round_trip(t *testing.T) {
 				AddEntity("zot", nil, corim.RoleManifestCreator).
 				SetRimValidity(time.Now(), &testEpoch),
 		},
+		{
+			title: "ok UUID ID/URI profile",
+			man: corim.NewUnsignedCorim().
+				SetID(uuid.UUID(comid.TestUUID)).
+				SetProfile("http://example.com").
+				AddComid(&testComid).
+				SetRimValidity(time.Now(), &testEpoch),
+		},
+		{
+			title: "nok CoSWID tag",
+			man: corim.NewUnsignedCorim().
+				SetID(uuid.UUID(comid.TestUUID)).
+				SetProfile("http://example.com").
+				AddCoswid(&swid.SoftwareIdentity{
+					Entities: swid.Entities{
+						swid.Entity{},
+					},
+				}),
+			err: "tag 505 at index 0",
+		},
+		{
+			title: "nok conditional endorsement series in CoMID",
+			man: corim.NewUnsignedCorim().
+				SetID(uuid.UUID(comid.TestUUID)).
+				AddComid(&testComidCondEnd),
+			err: "conditional endorsement series are not supported",
+		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			mt, err := NewManifestFromCoRIM(tc.man)
-			assert.NoError(t, err)
-
-			err = mt.Insert(ctx, db)
-			require.NoError(t, err)
-
-			selectedManifest, err := SelectManifest(ctx, db, mt.ID)
-			require.NoError(t, err)
-
-			selectedCoRIM, err := selectedManifest.ToCoRIM()
-			assert.NoError(t, err)
-
-			// time.Time has a complicated internal structure that does not
-			// get fully preserved on round trip. We don't really care about
-			// that as long as the actual timestamps match. So compare the
-			// timestamps manually and then set actual validity to expected,
-			// so that that we can do a single equality test on the rest of
-			// the CoRIM.
-			assert.Equal(t,
-				tc.man.RimValidity.NotBefore.Unix(),
-				selectedCoRIM.RimValidity.NotBefore.Unix(),
-			)
-			assert.Equal(t,
-				tc.man.RimValidity.NotAfter.Unix(),
-				selectedCoRIM.RimValidity.NotAfter.Unix(),
-			)
-			selectedCoRIM.RimValidity = tc.man.RimValidity
-
-			assert.Equal(t, tc.man, selectedCoRIM)
+
+			if tc.err == "" {
+				assert.NoError(t, err)
+
+				err = mt.Insert(ctx, db)
+				require.NoError(t, err)
+
+				selectedManifest, err := SelectManifest(ctx, db, mt.ID)
+				require.NoError(t, err)
+
+				selectedCoRIM, err := selectedManifest.ToCoRIM()
+				assert.NoError(t, err)
+
+				// time.Time has a complicated internal structure that does not
+				// get fully preserved on round trip. We don't really care about
+				// that as long as the actual timestamps match. So compare the
+				// timestamps manually and then set actual validity to expected,
+				// so that that we can do a single equality test on the rest of
+				// the CoRIM.
+				assert.Equal(t,
+					tc.man.RimValidity.NotBefore.Unix(),
+					selectedCoRIM.RimValidity.NotBefore.Unix(),
+				)
+				assert.Equal(t,
+					tc.man.RimValidity.NotAfter.Unix(),
+					selectedCoRIM.RimValidity.NotAfter.Unix(),
+				)
+				selectedCoRIM.RimValidity = tc.man.RimValidity
+
+				assert.Equal(t, tc.man, selectedCoRIM)
+			} else {
+				// tc.err != nil
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestManifest_ToCoRIM_nok(t *testing.T) {
+	testCases := []struct {
+		title    string
+		manifest Manifest
+		err      string
+	}{
+		{
+			title: "bad UUID",
+			manifest: Manifest{
+				ManifestIDType: UUIDTagID,
+				ManifestID:     "foo",
+			},
+			err: "invalid UUID",
+		},
+		{
+			title: "unexpected ID type",
+			manifest: Manifest{
+				ManifestIDType: "foo",
+			},
+			err: "unexpected manifest ID type",
+		},
+		{
+			title: "bad profile",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "foo",
+				Profile:        "@@@@/",
+			},
+			err: "profile string must be an absolute URL or an ASN.1 OID",
+		},
+		{
+			title: "bad dependent RIMs",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "foo",
+				DependentRIMs: []*Locator{
+					{
+						Href:       "http://example.com",
+						Thumbprint: []*Digest{{}, {}},
+					},
+				},
+			},
+			err: "locator at index 0",
+		},
+		{
+			title: "bad entities",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "foo",
+				Entities:       []*Entity{{}},
+			},
+			err: "entity at index 0",
+		},
+		{
+			title: "bad module tag",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "foo",
+				ModuleTags:     []*ModuleTag{{}},
+			},
+			err: "module tag at index 0",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			_, err := tc.manifest.ToCoRIM()
+			assert.ErrorContains(t, err, tc.err)
 		})
 	}
 }
@@ -122,7 +243,7 @@ func TestManifest_Validate(t *testing.T) {
 			},
 		},
 	}
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		man   Manifest
 		err   string
@@ -159,7 +280,7 @@ func TestManifest_Validate(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			err := tc.man.Validate()
 			if tc.err == "" {
@@ -170,3 +291,143 @@ func TestManifest_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestManifest_SetActive(t *testing.T) {
+	manifest := Manifest{
+		ModuleTags: []*ModuleTag{
+			&ModuleTag{KeyTriples: []*KeyTriple{{}}},
+			&ModuleTag{ValueTriples: []*ValueTriple{{}}},
+		},
+	}
+
+	manifest.SetActive(true)
+	assert.True(t, manifest.ModuleTags[0].KeyTriples[0].IsActive)
+	assert.True(t, manifest.ModuleTags[1].ValueTriples[0].IsActive)
+}
+
+func TestManifest_Insert(t *testing.T) {
+	db := test.NewTestDB(t)
+	testModuleTag := ModuleTag{
+		TagIDType: StringTagID,
+		TagID:     "bar",
+		ValueTriples: []*ValueTriple{
+			{
+				Type:         ReferenceValueTriple,
+				Environment:  &Environment{},
+				Measurements: []*Measurement{{}},
+			},
+		},
+	}
+	testCases := []struct {
+		title    string
+		manifest Manifest
+		err      string
+	}{
+		{
+			title: "ok manifest with extensions",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "foo",
+				ModuleTags:     []*ModuleTag{&testModuleTag},
+				Entities: []*Entity{
+					{
+						RoleEntries: []RoleEntry{{}},
+					},
+				},
+				DependentRIMs: []*Locator{{}},
+				Extensions: []*ExtensionValue{
+					{
+						FieldKind: reflect.Int64,
+						FieldName: "zot",
+						ValueInt:  7,
+					},
+				},
+			},
+		},
+		{
+			title:    "nok invalid manifest",
+			manifest: Manifest{},
+			err:      "manifest ID not set",
+		},
+		{
+			title: "nok entities insert error",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "qux",
+				Entities: []*Entity{
+					{
+						ID:          1,
+						RoleEntries: []RoleEntry{{}},
+					},
+				},
+				ModuleTags: []*ModuleTag{&testModuleTag},
+			},
+			err: "UNIQUE constraint failed: entities.id",
+		},
+		{
+			title: "nok dependent RIMs insert error",
+			manifest: Manifest{
+				ManifestIDType: StringTagID,
+				ManifestID:     "qux",
+				DependentRIMs:  []*Locator{{ID: 1}},
+				ModuleTags:     []*ModuleTag{&testModuleTag},
+			},
+			err: "UNIQUE constraint failed: locators.id",
+		},
+		{
+			title: "nok duplicate database ID",
+			manifest: Manifest{
+				ID:             1,
+				ManifestIDType: StringTagID,
+				ManifestID:     "foo",
+				ModuleTags:     []*ModuleTag{&testModuleTag},
+			},
+			err: "UNIQUE constraint failed: manifests.id",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			testModuleTag.ID = 0
+			testModuleTag.ValueTriples[0].ID = 0
+			testModuleTag.ValueTriples[0].Environment.ID = 0
+			testModuleTag.ValueTriples[0].Measurements[0].ID = 0
+
+			err := tc.manifest.Insert(context.Background(), db)
+			if tc.err != "" {
+				assert.ErrorContains(t, err, tc.err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestManifest_Select_nok(t *testing.T) {
+	var manifest Manifest
+	err := manifest.Select(context.TODO(), nil)
+	assert.ErrorContains(t, err, "ID not set")
+}
+
+func TestManifest_Delete(t *testing.T) {
+	var manifest Manifest
+	db := test.NewTestDB(t)
+
+	err := manifest.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	manifest.ID = 1
+	err = manifest.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
+
+func TestNewManifestFromCoRIM_nil_input(t *testing.T) {
+	_, err := NewManifestFromCoRIM(nil)
+	assert.ErrorContains(t, err, "nil input")
+}
+
+func TestSelectManifest_bad(t *testing.T) {
+	db := test.NewTestDB(t)
+	_, err := SelectManifest(context.Background(), db, 1)
+	assert.ErrorContains(t, err, "no rows")
+}
diff --git a/pkg/model/measurement.go b/pkg/model/measurement.go
index 3385afd..0abd861 100644
--- a/pkg/model/measurement.go
+++ b/pkg/model/measurement.go
@@ -1,9 +1,7 @@
 package model
 
 import (
-	"bytes"
 	"context"
-	"encoding/binary"
 	"errors"
 	"fmt"
 	"net"
@@ -88,7 +86,7 @@ func MeasurementsToCoRIM(origin []*Measurement) (comid.Measurements, error) {
 		corimMea, err := originMea.ToCoRIM()
 		if err != nil {
 			return comid.Measurements{}, fmt.Errorf(
-				"could not conver measurement at index %d: %w", i, err)
+				"could not convert measurement at index %d: %w", i, err)
 		}
 
 		ret.Add(corimMea)
@@ -143,13 +141,8 @@ func (o *Measurement) FromCoRIM(origin *comid.Measurement) error {
 		var mkeyBytes []byte
 
 		switch t := origin.Key.Value.(type) {
-		case comid.UintMkey:
-			mkeyBytes = make([]byte, 8)
-			binary.BigEndian.PutUint64(mkeyBytes, uint64(t))
-		case comid.StringMkey:
-			mkeyBytes = []byte(t)
-		case comid.TaggedUUID:
-			mkeyBytes = t[:]
+		case *comid.StringMkey:
+			mkeyBytes = []byte(*t)
 		case *comid.TaggedUUID:
 			mkeyBytes = (*t)[:]
 		case *comid.TaggedOID:
@@ -312,18 +305,6 @@ func (o *Measurement) ToCoRIM() (*comid.Measurement, error) {
 			if err != nil {
 				return nil, fmt.Errorf("could not initialize UUID mkey: %w", err)
 			}
-		case comid.UintType:
-			var val uint64
-			reader := bytes.NewReader(*o.KeyBytes)
-			err = binary.Read(reader, binary.BigEndian, &val)
-			if err != nil {
-				return nil, fmt.Errorf("could not parse uint64: %w", err)
-			}
-
-			mkey, err = comid.NewMkeyUint(val)
-			if err != nil {
-				return nil, fmt.Errorf("could not create UintMkey: %w", err)
-			}
 		case comid.StringType:
 			mkey, err = comid.NewMkeyString(*o.KeyBytes)
 			if err != nil {
@@ -468,7 +449,7 @@ func (o *Measurement) ToCoRIM() (*comid.Measurement, error) {
 				entry.CodePoint,
 			)
 		default:
-			return nil, fmt.Errorf("unexpted code point: %d", entry.CodePoint)
+			return nil, fmt.Errorf("unexpected code point: %d", entry.CodePoint)
 		}
 	}
 
diff --git a/pkg/model/measurement_test.go b/pkg/model/measurement_test.go
index 32f2b23..c2b6487 100644
--- a/pkg/model/measurement_test.go
+++ b/pkg/model/measurement_test.go
@@ -2,6 +2,7 @@ package model
 
 import (
 	"context"
+	"fmt"
 	"net"
 	"testing"
 
@@ -82,3 +83,374 @@ func TestMeasurement_round_trip(t *testing.T) {
 	assert.NotNil(t, selectedMeas.AuthorizedBy)
 	assert.Equal(t, comid.TestECPubKey, (*selectedMeas.AuthorizedBy)[0].Value.String())
 }
+
+func newBoolMkey(val any) (*comid.Mkey, error) {
+	ret := boolMkeyType(false)
+	if val == nil {
+		return &comid.Mkey{Value: &ret}, nil
+	}
+
+	b, ok := val.(bool)
+	if !ok {
+		return nil, fmt.Errorf("invalid boolMkeyType value: %v", val)
+	}
+	ret = boolMkeyType(b)
+
+	return &comid.Mkey{Value: &ret}, nil
+}
+
+type boolMkeyType bool
+
+func (o boolMkeyType) String() string {
+	return fmt.Sprint(bool(o))
+}
+
+func (o boolMkeyType) Valid() error {
+	return nil
+}
+
+func (o boolMkeyType) Type() string {
+	return "bool"
+}
+
+var (
+	uuidType   = comid.UUIDType
+	stringType = comid.StringType
+	uintType   = comid.UintType
+	oidType    = comid.OIDType
+	boolType   = "bool"
+)
+
+func TestMeasurement_convert(t *testing.T) {
+	boolMkey := boolMkeyType(true)
+	svnInt := int64(7)
+	testCases := []struct {
+		title    string
+		origin   comid.Measurement
+		expected Measurement
+		err      string
+	}{
+		{
+			title: "ok uint mkey",
+			origin: comid.Measurement{
+				Key: comid.MustNewMkey(uint(7), comid.UintType),
+			},
+			expected: Measurement{KeyType: &uintType, KeyBytes: &[]byte{0x07}},
+		},
+		{
+			title: "ok string mkey",
+			origin: comid.Measurement{
+				Key: comid.MustNewMkey("foo", comid.StringType),
+			},
+			expected: Measurement{KeyType: &stringType, KeyBytes: &[]byte{0x66, 0x6f, 0x6f}},
+		},
+		{
+			title: "ok OID mkey",
+			origin: comid.Measurement{
+				Key: comid.MustNewMkey("0.1.2.3", comid.OIDType),
+			},
+			expected: Measurement{KeyType: &oidType, KeyBytes: &[]byte{0x01, 0x02, 0x03}},
+		},
+		{
+			title: "ok extension mkey",
+			origin: comid.Measurement{
+				Key: &comid.Mkey{Value: &boolMkey},
+			},
+			expected: Measurement{KeyType: &boolType, KeyBytes: &[]byte{0xd9, 0x03, 0x0d, 0xf5}},
+		},
+		{
+			title: "ok MinSVN",
+			origin: comid.Measurement{
+				Val: comid.Mval{
+					SVN: comid.MustNewTaggedMinSVN(7),
+				},
+			},
+			expected: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{
+						CodePoint: MvalSvn,
+						ValueType: "min-value",
+						ValueInt:  &svnInt,
+					},
+				},
+			},
+		},
+	}
+
+	err := comid.RegisterMkeyType(781, newBoolMkey)
+	require.NoError(t, err)
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			mea, err := NewMeasurementFromCoRIM(&tc.origin)
+			if tc.err == "" {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expected, *mea)
+
+				other, err := mea.ToCoRIM()
+				assert.NoError(t, err)
+				assert.Equal(t, tc.origin, *other)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestMeasurement_Delete(t *testing.T) {
+	db := test.NewTestDB(t)
+	testCases := []struct {
+		title string
+		mea   Measurement
+		err   string
+	}{
+		{
+			title: "ok minimal",
+			mea:   Measurement{ID: 1},
+		},
+		{
+			title: "ok full",
+			mea: Measurement{
+				ID:                 1,
+				AuthorizedBy:       []*CryptoKey{{ID: 1}},
+				Digests:            []*Digest{{ID: 1}},
+				Flags:              []*Flag{{ID: 1}},
+				IntegrityRegisters: []*IntegrityRegister{{ID: 1}},
+				ValueEntries:       []*MeasurementValueEntry{{ID: 1}},
+				Extensions:         []*ExtensionValue{{ID: 1}},
+			},
+		},
+		{
+			title: "nok no ID",
+			mea:   Measurement{},
+			err:   "ID not set",
+		},
+		{
+			title: "nok bad AuthorizedBy",
+			mea: Measurement{
+				ID:           1,
+				AuthorizedBy: []*CryptoKey{{}},
+			},
+			err: "authorized-by key at index 0: ID not set",
+		},
+		{
+			title: "nok bad Digests",
+			mea: Measurement{
+				ID:      1,
+				Digests: []*Digest{{}},
+			},
+			err: "digest at index 0: ID not set",
+		},
+		{
+			title: "nok bad Flags",
+			mea: Measurement{
+				ID:    1,
+				Flags: []*Flag{{}},
+			},
+			err: "flag at index 0: ID not set",
+		},
+		{
+			title: "nok bad IntegrityRegisters",
+			mea: Measurement{
+				ID:                 1,
+				IntegrityRegisters: []*IntegrityRegister{{}},
+			},
+			err: "integrity register at index 0: ID not set",
+		},
+		{
+			title: "nok bad ValueEntries",
+			mea: Measurement{
+				ID:           1,
+				ValueEntries: []*MeasurementValueEntry{{}},
+			},
+			err: "value entry at index 0: ID not set",
+		},
+		{
+			title: "nok bad Extensions",
+			mea: Measurement{
+				ID:         1,
+				Extensions: []*ExtensionValue{{}},
+			},
+			err: "extension at index 0: ID not set",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			err := tc.mea.Delete(context.Background(), db)
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestMeasurement_ToCoRIM_nok(t *testing.T) {
+	testText := "foo"
+	testInt := int64(7)
+	testCases := []struct {
+		title string
+		mea   Measurement
+		err   string
+	}{
+		{
+			title: "bad UUID mkey",
+			mea: Measurement{
+				KeyType:  &uuidType,
+				KeyBytes: &[]byte{0x1},
+			},
+			err: "unexpected size for UUID",
+		},
+		{
+			title: "bad string mkey",
+			mea: Measurement{
+				KeyType:  &stringType,
+				KeyBytes: &[]byte{0xff},
+			},
+			err: "invalid utf-8 string",
+		},
+		{
+			title: "missing version data",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{
+						CodePoint: MvalVersion,
+					},
+				},
+			},
+			err: "missing version data",
+		},
+		{
+			title: "bad version scheme",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{
+						CodePoint: MvalVersion,
+						ValueText: &testText,
+						ValueType: "foo",
+					},
+				},
+			},
+			err: "invalid version scheme: foo",
+		},
+		{
+			title: "bad SVN type",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{
+						CodePoint: MvalSvn,
+						ValueInt:  &testInt,
+						ValueType: "foo",
+					},
+				},
+			},
+			err: "unexpected SVN type: foo",
+		},
+		{
+			title: "missing name data",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{CodePoint: MvalName},
+				},
+			},
+			err: "missing Name data",
+		},
+		{
+			title: "unexpected name type",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{
+						CodePoint: MvalName,
+						ValueText: &testText,
+						ValueType: "bar",
+					},
+				},
+			},
+			err: "unexpected Name type",
+		},
+		{
+			title: "unexpected code point",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{CodePoint: MvalDigests},
+				},
+			},
+			err: "unexpected value entry for code point",
+		},
+		{
+			title: "invalid code point",
+			mea: Measurement{
+				ValueEntries: []*MeasurementValueEntry{
+					{CodePoint: -1},
+				},
+			},
+			err: "unexpected code point: -1",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			_, err := tc.mea.ToCoRIM()
+			assert.ErrorContains(t, err, tc.err)
+		})
+	}
+}
+
+func TestMeasurementValueEntry_Delete(t *testing.T) {
+	var mve MeasurementValueEntry
+	db := test.NewTestDB(t)
+
+	err := mve.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	mve.ID = 1
+	err = mve.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
+
+func TestMeasurementsFromCoRIM(t *testing.T) {
+	ret, err := MeasurementsFromCoRIM(*comid.NewMeasurements())
+	assert.Nil(t, ret)
+	assert.NoError(t, err)
+
+	_, err = MeasurementsFromCoRIM(*comid.NewMeasurements().
+		Add(&comid.Measurement{Val: comid.Mval{SVN: &comid.SVN{}}}))
+	assert.ErrorContains(t, err, "could not construct measurement at index 0: unexpected SVN type: <nil>")
+}
+
+func TestMeasurementsToCoRIM_nok(t *testing.T) {
+	testKT := "foo"
+	_, err := MeasurementsToCoRIM([]*Measurement{{KeyType: &testKT}})
+	assert.ErrorContains(t, err, "could not convert measurement at index 0")
+}
+
+func TestParseVersionScheme(t *testing.T) {
+	testCases := []struct {
+		scheme string
+		err    string
+	}{
+		{scheme: "multipartnumeric"},
+		{scheme: "multipartnumeric+suffix"},
+		{scheme: "alphanumeric"},
+		{scheme: "decimal"},
+		{scheme: "semver"},
+		{scheme: "version-scheme(1)"},
+		{
+			scheme: "foo",
+			err:    "invalid version scheme: foo",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.scheme, func(t *testing.T) {
+			_, err := parseVersionScheme(tc.scheme)
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
diff --git a/pkg/model/moduletag.go b/pkg/model/moduletag.go
index 46be977..b27d194 100644
--- a/pkg/model/moduletag.go
+++ b/pkg/model/moduletag.go
@@ -13,7 +13,7 @@ import (
 )
 
 type ModuleTag struct {
-	bun.BaseModel `bun:"table:module_tags,alias:mod"`
+	bun.BaseModel `bun:"table:module_tags,alias:mt"`
 
 	ID int64 `bun:",pk,autoincrement"`
 
@@ -61,7 +61,7 @@ func (o *ModuleTag) FromCoRIM(origin *comid.Comid) error {
 	var err error
 
 	if origin.Triples.CondEndorseSeries != nil && len(origin.Triples.CondEndorseSeries.Values) != 0 {
-		return errors.New("conditional endosement series are not supported") // TODO
+		return errors.New("conditional endorsement series are not supported") // TODO
 	}
 
 	o.Language = origin.Language
@@ -194,6 +194,16 @@ func (o *ModuleTag) ToCoRIM() (*comid.Comid, error) {
 	return ret, nil
 }
 
+func (o *ModuleTag) SetActive(value bool) {
+	for _, kt := range o.KeyTriples {
+		kt.IsActive = value
+	}
+
+	for _, vt := range o.ValueTriples {
+		vt.IsActive = value
+	}
+}
+
 func (o *ModuleTag) Insert(ctx context.Context, db bun.IDB) error {
 	if err := o.Validate(); err != nil {
 		return err
@@ -270,7 +280,7 @@ func (o *ModuleTag) Select(ctx context.Context, db bun.IDB) error {
 		Relation("KeyTriples").
 		Relation("Extensions").
 		Relation("TriplesExtensions").
-		Where("mod.id = ?", o.ID).
+		Where("mt.id = ?", o.ID).
 		Scan(ctx)
 
 	if err != nil {
diff --git a/pkg/model/moduletag_test.go b/pkg/model/moduletag_test.go
index f1afb1e..206235d 100644
--- a/pkg/model/moduletag_test.go
+++ b/pkg/model/moduletag_test.go
@@ -21,7 +21,7 @@ func TestModuleTag_round_trip(t *testing.T) {
 		Name:  comid.MustNewEntityName("foo", "string"),
 		Roles: *comid.NewRoles().Add(comid.RoleCreator),
 	})
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		mt    comid.Comid
 	}{
@@ -90,7 +90,7 @@ func TestModuleTag_round_trip(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			mt, err := NewModuleTagFromCoRIM(&tc.mt)
 			assert.NoError(t, err)
@@ -112,7 +112,7 @@ func TestModuleTag_round_trip(t *testing.T) {
 func TestModuleTag_Validate(t *testing.T) {
 	testType := comid.BytesType
 	testBytes := comid.MustHexDecode(t, "deadbeefdeadbeefdeadbeefdeadbeef")
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		mt    ModuleTag
 		err   string
@@ -156,7 +156,7 @@ func TestModuleTag_Validate(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			err := tc.mt.Validate()
 			if tc.err == "" {
@@ -167,3 +167,94 @@ func TestModuleTag_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestModuleTag_ToCoRIM(t *testing.T) {
+	testCases := []struct {
+		title string
+		mt    ModuleTag
+		err   string
+	}{
+		{
+			title: "ok UUID tag ID",
+			mt: ModuleTag{
+				TagIDType: comid.UUIDType,
+				TagID:     comid.TestUUID.String(),
+			},
+		},
+		{
+			title: "nok bad UUID tag ID",
+			mt: ModuleTag{
+				TagIDType: comid.UUIDType,
+				TagID:     "foo",
+			},
+			err: "invalid UUID length",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			_, err := tc.mt.ToCoRIM()
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestModuleTag_Insert_extensions(t *testing.T) {
+	db := test.NewTestDB(t)
+	testType := comid.BytesType
+	testBytes := comid.MustHexDecode(t, "deadbeefdeadbeefdeadbeefdeadbeef")
+	mt := ModuleTag{
+		TagIDType: StringTagID,
+		TagID:     "foo",
+		KeyTriples: []*KeyTriple{
+			{
+				Type: AttestKeyTriple,
+				Environment: &Environment{
+					ClassType:  &testType,
+					ClassBytes: &testBytes,
+				},
+				KeyList: []*CryptoKey{
+					&CryptoKey{
+						KeyType:  comid.PKIXBase64KeyType,
+						KeyBytes: []byte(comid.TestECPubKey),
+					},
+				},
+			},
+		},
+		Extensions:        []*ExtensionValue{{}},
+		TriplesExtensions: []*ExtensionValue{{}},
+	}
+
+	err := mt.Insert(context.Background(), db)
+	assert.NoError(t, err)
+	assert.Equal(t, mt.Extensions[0].ID, int64(1))
+	assert.Equal(t, mt.TriplesExtensions[0].ID, int64(2))
+}
+
+func TestModuleTag_Select(t *testing.T) {
+	var mt ModuleTag
+	db := test.NewTestDB(t)
+
+	err := mt.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	mt.ID = 1
+	err = mt.Select(context.Background(), db)
+	assert.ErrorContains(t, err, "no rows in result")
+}
+
+func TestModuleTag_Delete(t *testing.T) {
+	var mt ModuleTag
+	db := test.NewTestDB(t)
+
+	err := mt.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	mt.ID = 1
+	err = mt.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
diff --git a/pkg/model/role.go b/pkg/model/role.go
index 2ace02d..fe8e059 100644
--- a/pkg/model/role.go
+++ b/pkg/model/role.go
@@ -43,8 +43,8 @@ func ParseCoRIMRole(text string) (corim.Role, error) {
 	default:
 		matches := roleRegex.FindStringSubmatch(text)
 		switch len(matches) {
-		case 1:
-			role, err := strconv.Atoi(matches[0])
+		case 2:
+			role, err := strconv.Atoi(matches[1])
 			return corim.Role(role), err
 		default:
 			return corim.Role(0), fmt.Errorf("invalid CoRIM role: %s", text)
@@ -63,8 +63,8 @@ func ParseCoMIDRole(text string) (comid.Role, error) {
 	default:
 		matches := roleRegex.FindStringSubmatch(text)
 		switch len(matches) {
-		case 1:
-			role, err := strconv.Atoi(matches[0])
+		case 2:
+			role, err := strconv.Atoi(matches[1])
 			return comid.Role(role), err
 		default:
 			return comid.Role(0), fmt.Errorf("invalid CoMID role: %s", text)
@@ -83,13 +83,12 @@ type RoleEntry struct {
 }
 
 func MustNewCoRIMRoleEntry(text string) *RoleEntry {
-	if _, err := ParseCoRIMRole(text); err != nil {
+	ret, err := NewCoRIMRoleEntry(text)
+	if err != nil {
 		panic(err)
 	}
 
-	ret := RoleEntry{Role: text}
-
-	return &ret
+	return ret
 }
 
 func NewCoRIMRoleEntry(text string) (*RoleEntry, error) {
@@ -103,13 +102,12 @@ func NewCoRIMRoleEntry(text string) (*RoleEntry, error) {
 }
 
 func MustNewCoMIDRoleEntry(text string) *RoleEntry {
-	if _, err := ParseCoMIDRole(text); err != nil {
+	ret, err := NewCoMIDRoleEntry(text)
+	if err != nil {
 		panic(err)
 	}
 
-	ret := RoleEntry{Role: text}
-
-	return &ret
+	return ret
 }
 
 func NewCoMIDRoleEntry(text string) (*RoleEntry, error) {
diff --git a/pkg/model/role_test.go b/pkg/model/role_test.go
new file mode 100644
index 0000000..f6816bc
--- /dev/null
+++ b/pkg/model/role_test.go
@@ -0,0 +1,97 @@
+package model
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/corim"
+)
+
+func TestParseCoRIMRole(t *testing.T) {
+	testCases := []struct {
+		role     string
+		expected corim.Role
+		err      string
+	}{
+		{
+			role:     "manifestCreator",
+			expected: corim.RoleManifestCreator,
+		},
+		{
+			role:     "manifestSigner",
+			expected: corim.RoleManifestSigner,
+		},
+		{
+			role:     "Role(3)",
+			expected: corim.Role(3),
+		},
+		{
+			role: "foo",
+			err:  "invalid CoRIM role: foo",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.role, func(t *testing.T) {
+			role, err := ParseCoRIMRole(tc.role)
+			if tc.err == "" {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expected, role)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestParseCoMIDRole(t *testing.T) {
+	testCases := []struct {
+		role     string
+		expected comid.Role
+		err      string
+	}{
+		{
+			role:     "creator",
+			expected: comid.RoleCreator,
+		},
+		{
+			role:     "maintainer",
+			expected: comid.RoleMaintainer,
+		},
+		{
+			role:     "Role(3)",
+			expected: comid.Role(3),
+		},
+		{
+			role: "foo",
+			err:  "invalid CoMID role: foo",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.role, func(t *testing.T) {
+			role, err := ParseCoMIDRole(tc.role)
+			if tc.err == "" {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expected, role)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestMustNewCoRIMRoleEntry(t *testing.T) {
+	entry := MustNewCoRIMRoleEntry("manifestCreator")
+	assert.Equal(t, "manifestCreator", entry.Role)
+
+	assert.Panics(t, func() { MustNewCoRIMRoleEntry("foo") })
+}
+
+func TestMustNewCoMIDRoleEntry(t *testing.T) {
+	entry := MustNewCoMIDRoleEntry("creator")
+	assert.Equal(t, "creator", entry.Role)
+
+	assert.Panics(t, func() { MustNewCoMIDRoleEntry("foo") })
+}
diff --git a/pkg/model/valuetriple.go b/pkg/model/valuetriple.go
index c978f43..89ec4d1 100644
--- a/pkg/model/valuetriple.go
+++ b/pkg/model/valuetriple.go
@@ -69,7 +69,10 @@ type ValueTriple struct {
 
 	Type         ValueTripleType
 	Measurements []*Measurement `bun:"rel:has-many,join:id=owner_id,join:type=owner_type,polymorphic:value_triple"`
-	ModuleID     int64          `bun:",nullzero"`
+
+	IsActive bool
+
+	ModuleID int64 `bun:",nullzero"`
 }
 
 func NewValueTripleFromCoRIM(origin *comid.ValueTriple) (*ValueTriple, error) {
@@ -213,7 +216,13 @@ func (o *ValueTriple) Delete(ctx context.Context, db bun.IDB) error {
 		return err
 	}
 
-	return o.Environment.DeleteIfOrphaned(ctx, db)
+	if o.Environment != nil {
+		if err := o.Environment.DeleteIfOrphaned(ctx, db); err != nil {
+			return fmt.Errorf("environment: %w", err)
+		}
+	}
+
+	return nil
 }
 
 func (o *ValueTriple) TripleType() string {
diff --git a/pkg/model/valuetriple_test.go b/pkg/model/valuetriple_test.go
index 33305b2..9fb3798 100644
--- a/pkg/model/valuetriple_test.go
+++ b/pkg/model/valuetriple_test.go
@@ -19,7 +19,7 @@ func TestValueTriple_round_trip(t *testing.T) {
 	testSvn, err := comid.NewTaggedSVN(42)
 	require.NoError(t, err)
 
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		vt    comid.ValueTriple
 	}{
@@ -39,7 +39,7 @@ func TestValueTriple_round_trip(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			vt, err := NewValueTripleFromCoRIM(&tc.vt)
 			assert.NoError(t, err)
@@ -66,7 +66,7 @@ func TestValueTriple_round_trip(t *testing.T) {
 func TestValueTriple_Validate(t *testing.T) {
 	testType := comid.BytesType
 	testBytes := comid.MustHexDecode(t, "deadbeefdeadbeefdeadbeefdeadbeef")
-	test_cases := []struct {
+	testCases := []struct {
 		title string
 		vt    ValueTriple
 		err   string
@@ -117,7 +117,7 @@ func TestValueTriple_Validate(t *testing.T) {
 		},
 	}
 
-	for _, tc := range test_cases {
+	for _, tc := range testCases {
 		t.Run(tc.title, func(t *testing.T) {
 			err := tc.vt.Validate()
 			if tc.err == "" {
@@ -128,3 +128,32 @@ func TestValueTriple_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestValueTriple_Delete(t *testing.T) {
+	var vt ValueTriple
+	db := test.NewTestDB(t)
+
+	err := vt.Delete(context.Background(), db)
+	assert.ErrorContains(t, err, "ID not set")
+
+	vt = ValueTriple{
+		ID:           1,
+		Measurements: []*Measurement{{ID: 1}},
+		Environment:  &Environment{ID: 1},
+	}
+	err = vt.Delete(context.Background(), db)
+	assert.NoError(t, err)
+}
+
+func TestValueTriple_TripleType(t *testing.T) {
+	var vt ValueTriple
+	assert.Equal(t, "value", vt.TripleType())
+}
+
+func TestValueTriple_DatabaseID(t *testing.T) {
+	var vt ValueTriple
+	assert.Equal(t, int64(0), vt.DatabaseID())
+
+	vt.ID = 1
+	assert.Equal(t, int64(1), vt.DatabaseID())
+}
diff --git a/pkg/store/config.go b/pkg/store/config.go
index 8206b5a..9778370 100644
--- a/pkg/store/config.go
+++ b/pkg/store/config.go
@@ -52,7 +52,7 @@ func (o *Config) WithOptions(options ...ConfigOption) *Config {
 
 func (o *Config) Validate() error {
 	if !slices.Contains([]string{
-		"sqlite", "sqlite3",
+		"sqlite", "sqlite3", "mysql", "mariadb", "postgres", "pq", "pgx",
 	}, o.DBMS) {
 		return fmt.Errorf("invalid DBMS: %s", o.DBMS)
 	}
diff --git a/pkg/store/config_test.go b/pkg/store/config_test.go
new file mode 100644
index 0000000..e411c1c
--- /dev/null
+++ b/pkg/store/config_test.go
@@ -0,0 +1,76 @@
+package store
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConfig_Validate(t *testing.T) {
+	testCases := []struct {
+		title string
+		dbms  string
+		opts  []ConfigOption
+		err   string
+	}{
+		{
+			title: "ok multi-opt",
+			dbms:  "mysql",
+			opts: []ConfigOption{
+				OptionMD5,
+				OptionTraceSQL,
+				OptionInsecure,
+				OptionForce,
+				OptionRequireLabel,
+			},
+		},
+		{
+			title: "ok sha256",
+			dbms:  "mysql",
+			opts:  []ConfigOption{OptionSHA256},
+		},
+		{
+			title: "ok sha512",
+			dbms:  "mysql",
+			opts:  []ConfigOption{OptionSHA512},
+		},
+		{
+			title: "invalid DBMS",
+			dbms:  "foo",
+			err:   "invalid DBMS: foo",
+		},
+		{
+			title: "invalid hash alg",
+			dbms:  "mysql",
+			opts: []ConfigOption{func(c *Config) {
+				c.HashAlg = "bar"
+			}},
+			err: "invalid hash algorithm: bar",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			testConfig := NewConfig(tc.dbms, "", tc.opts...)
+			err := testConfig.Validate()
+
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestConfig_DB(t *testing.T) {
+	dbConfig := NewConfig("postgres", "foo").DB()
+	assert.Equal(t, "postgres", dbConfig.DBMS)
+	assert.Equal(t, "foo", dbConfig.DSN)
+	assert.False(t, dbConfig.TraceSQL)
+
+	dbConfig = NewConfig("mysql", "bar", OptionTraceSQL).DB()
+	assert.Equal(t, "mysql", dbConfig.DBMS)
+	assert.Equal(t, "bar", dbConfig.DSN)
+	assert.True(t, dbConfig.TraceSQL)
+}
diff --git a/pkg/store/store.go b/pkg/store/store.go
index 271ec4c..6b06e56 100644
--- a/pkg/store/store.go
+++ b/pkg/store/store.go
@@ -32,6 +32,10 @@ type Store struct {
 // Open a Store configured according to provided Config that will use the
 // provided Context for its transactions.
 func Open(ctx context.Context, cfg *Config) (*Store, error) {
+	if cfg == nil {
+		return nil, errors.New("nil config")
+	}
+
 	if err := cfg.Validate(); err != nil {
 		return nil, err
 	}
@@ -84,8 +88,9 @@ func (o *Store) Migrate() error {
 // Signature validation of signed CoRIMs is not supported. If insecure
 // transactions are allowed by the Store's configuration, signed corims will
 // be added without validating their signatures. Otherwise, an error will be
-// returned.
-func (o *Store) AddBytes(buf []byte, label string) error {
+// returned. If activate is true, the contained triples will be activated
+// before they are added.
+func (o *Store) AddBytes(buf []byte, label string, activate bool) error {
 	if len(buf) < 3 {
 		return fmt.Errorf("input too short")
 	}
@@ -105,7 +110,7 @@ func (o *Store) AddBytes(buf []byte, label string) error {
 			return err
 		}
 
-		return o.AddCoRIM(&signed.UnsignedCorim, digest, label)
+		return o.AddCoRIM(&signed.UnsignedCorim, digest, label, activate)
 	} else if slices.Equal(buf[:3], []byte{0xd9, 0x01, 0xf5}) {
 		// tag 501 -> unsigned corim
 		var unsigned corim.UnsignedCorim
@@ -113,7 +118,7 @@ func (o *Store) AddBytes(buf []byte, label string) error {
 			return err
 		}
 
-		return o.AddCoRIM(&unsigned, digest, label)
+		return o.AddCoRIM(&unsigned, digest, label, activate)
 	} else {
 		return fmt.Errorf("unrecognized input format")
 	}
@@ -121,8 +126,9 @@ func (o *Store) AddBytes(buf []byte, label string) error {
 
 // AddCoRIM adds the provided CoRIM to the store. The digest, if not nil,
 // should be the digest of the CBOR token the provided CoRIM was decoded
-// from.
-func (o *Store) AddCoRIM(c *corim.UnsignedCorim, digest []byte, label string) error {
+// from. If activate is true, the contained triples will be activated
+// before they are added.
+func (o *Store) AddCoRIM(c *corim.UnsignedCorim, digest []byte, label string, activate bool) error {
 	m, err := model.NewManifestFromCoRIM(c)
 	if err != nil {
 		return err
@@ -131,6 +137,10 @@ func (o *Store) AddCoRIM(c *corim.UnsignedCorim, digest []byte, label string) er
 	m.Digest = digest
 	m.Label = label
 
+	if activate {
+		m.SetActive(true)
+	}
+
 	return o.AddManifest(m)
 }
 
@@ -237,6 +247,18 @@ func (o *Store) DeleteManifest(manifestID string, label string) error {
 	return manifest.Delete(o.Ctx, o.DB)
 }
 
+// GetActiveValueTriples returns a slice of ValueTriple's whose environment
+// matches the one provided. If exact is true, any unset fields in the provided
+// environment must be NULL in the database; otherwise, unset fields will
+// match any value. Only active triples are returned.
+func (o *Store) GetActiveValueTriples(
+	env *model.Environment,
+	label string,
+	exact bool,
+) ([]*model.ValueTriple, error) {
+	return getTriples[*model.ValueTriple](o, env, label, exact, true)
+}
+
 // GetValueTriples returns a slice of ValueTriple's whose environment matches
 // the one provided. If exact is true, any unset fields in the provided
 // environment must be NULL in the database; otherwise, unset fields will
@@ -246,7 +268,19 @@ func (o *Store) GetValueTriples(
 	label string,
 	exact bool,
 ) ([]*model.ValueTriple, error) {
-	return getTriples[*model.ValueTriple](o, env, label, exact)
+	return getTriples[*model.ValueTriple](o, env, label, exact, false)
+}
+
+// GetActiveKeyTriples returns a slice of KeyTriple's whose environment matches
+// the one provided. If exact is true, any unset fields in the provided
+// environment must be NULL in the database; otherwise, unset fields will
+// match any value. Only active triples are returned.
+func (o *Store) GetActiveKeyTriples(
+	env *model.Environment,
+	label string,
+	exact bool,
+) ([]*model.KeyTriple, error) {
+	return getTriples[*model.KeyTriple](o, env, label, exact, true)
 }
 
 // GetKeyTriples returns a slice of KeyTriple's whose environment matches
@@ -258,7 +292,7 @@ func (o *Store) GetKeyTriples(
 	label string,
 	exact bool,
 ) ([]*model.KeyTriple, error) {
-	return getTriples[*model.KeyTriple](o, env, label, exact)
+	return getTriples[*model.KeyTriple](o, env, label, exact, false)
 }
 
 func (o *Store) FindEnvironmentIDs(env *model.Environment, exact bool) ([]int64, error) {
@@ -309,7 +343,10 @@ func (o *Store) FindModuleTagIDsForLabel(label string) ([]int64, error) {
 // comma-separated list.
 func (o *Store) StringAggregatorExpr(columnName string) string {
 	dialect := o.DB.Dialect().Name().String()
+	return StringAggregatorExprForDialect(dialect, columnName)
+}
 
+func StringAggregatorExprForDialect(dialect, columnName string) string {
 	switch dialect {
 	case "pg":
 		return fmt.Sprintf("STRING_AGG(%s, ', ')", columnName)
@@ -327,12 +364,15 @@ func (o *Store) StringAggregatorExpr(columnName string) string {
 // ConcatExpr returns dialect-specific expression concatenated provided
 // strings.
 func (o *Store) ConcatExpr(tokens ...string) string {
+	dialect := o.DB.Dialect().Name().String()
+	return ConcatExprForDialect(dialect, tokens...)
+}
+
+func ConcatExprForDialect(dialect string, tokens ...string) string {
 	if len(tokens) == 0 {
 		return "''"
 	}
 
-	dialect := o.DB.Dialect().Name().String()
-
 	switch dialect {
 	case "mysql":
 		return fmt.Sprintf("CONCAT(%s)", strings.Join(tokens, ", "))
@@ -347,6 +387,10 @@ func (o *Store) ConcatExpr(tokens ...string) string {
 
 func (o *Store) HexExpr(columnName string) string {
 	dialect := o.DB.Dialect().Name().String()
+	return HexExprForDialect(dialect, columnName)
+}
+
+func HexExprForDialect(dialect, columnName string) string {
 
 	switch dialect {
 	case "mysql", "sqlite":
@@ -393,21 +437,29 @@ func getTriples[T triple](
 	env *model.Environment,
 	label string,
 	exact bool,
+	activeOnly bool,
 ) ([]T, error) { // nolint:dupl
-	envIDs, err := store.FindEnvironmentIDs(env, exact)
-	if err != nil {
-		return nil, err
-	}
-
 	var ret []T
 	query := store.DB.NewSelect().Model(&ret)
-	query.WhereGroup(" AND ", func(q *bun.SelectQuery) *bun.SelectQuery {
-		for _, envID := range envIDs {
-			q.WhereOr("environment_id = ?", envID)
+
+	if activeOnly {
+		query.Where("is_active = true")
+	}
+
+	if env != nil && !env.IsEmpty() {
+		envIDs, err := store.FindEnvironmentIDs(env, exact)
+		if err != nil {
+			return nil, err
 		}
 
-		return q
-	})
+		query.WhereGroup(" AND ", func(q *bun.SelectQuery) *bun.SelectQuery {
+			for _, envID := range envIDs {
+				q.WhereOr("environment_id = ?", envID)
+			}
+
+			return q
+		})
+	}
 
 	if label != "" {
 		modIDs, err := store.FindModuleTagIDsForLabel(label)
@@ -428,7 +480,7 @@ func getTriples[T triple](
 
 	if err := query.Scan(store.Ctx); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return nil, fmt.Errorf("orphaned evironment(s)?: %v", envIDs)
+			return nil, fmt.Errorf("no triples matched")
 		}
 
 		return nil, err
diff --git a/pkg/store/store_test.go b/pkg/store/store_test.go
index dd901c5..f0f1820 100644
--- a/pkg/store/store_test.go
+++ b/pkg/store/store_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/veraison/corim-store/pkg/model"
 	"github.com/veraison/corim-store/pkg/test"
 	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/corim"
 )
 
 func TestStore_roundtrip(t *testing.T) {
@@ -26,7 +27,7 @@ func TestStore_roundtrip(t *testing.T) {
 		bytes, err := os.ReadFile(path)
 		require.NoError(t, err)
 
-		err = store.AddBytes(bytes, "cca")
+		err = store.AddBytes(bytes, "cca", false)
 		require.NoError(t, err)
 	}
 
@@ -46,3 +47,372 @@ func TestStore_roundtrip(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, keyTriples, 1)
 }
+
+func TestStore_Open(t *testing.T) {
+	testCases := []struct {
+		title string
+		cfg   *Config
+		err   string
+	}{
+		{
+			title: "ok",
+			cfg:   NewConfig("sqlite", "file::memory:?cache=shared"),
+		},
+		{
+			title: "bad DSN",
+			cfg:   NewConfig("mysql", "foo"),
+			err:   "invalid DSN: missing the slash separating the database name",
+		},
+		{
+			title: "nil config",
+			err:   "nil config",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			_, err := Open(context.Background(), tc.cfg)
+
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestStore_initialization(t *testing.T) {
+	testStore, err := Open(context.Background(), NewConfig("sqlite", "file::memory:?cache=shared"))
+	require.NoError(t, err)
+
+	_, err = testStore.DB.DB.Exec("select * from measurements")
+	assert.ErrorContains(t, err, "no such table")
+
+	err = testStore.Init()
+	require.NoError(t, err)
+
+	err = testStore.Migrate()
+	require.NoError(t, err)
+
+	_, err = testStore.DB.DB.Exec("select * from measurements")
+	assert.NoError(t, err)
+}
+
+func TestStore_AddBytes(t *testing.T) {
+	testCases := []struct {
+		title    string
+		path     string
+		bytes    []byte
+		opts     []ConfigOption
+		label    string
+		activate bool
+		err      string
+	}{
+		{
+			title: "ok unsigned/no label/no activate",
+			path:  "../../sample/corim/unsigned-cca-ta.cbor",
+		},
+		{
+			title:    "ok unsigned/label/activate",
+			path:     "../../sample/corim/unsigned-cca-ta.cbor",
+			label:    "foo",
+			activate: true,
+		},
+		{
+			title: "ok signed",
+			path:  "../../sample/corim/signed-cca-ta.cose",
+			opts:  []ConfigOption{OptionInsecure},
+		},
+		{
+			title: "nok signed without insecure",
+			path:  "../../sample/corim/signed-cca-ta.cose",
+			err:   "signed CoRIM validation not supported",
+		},
+		{
+			title: "nok input too short",
+			bytes: []byte{0x01, 0x02},
+			err:   "input too short",
+		},
+		{
+			title: "nok unrecognized input format",
+			bytes: []byte{0x01, 0x02, 0x03, 0x04},
+			err:   "unrecognized input format",
+		},
+		{
+			title: "nok bad unsigned",
+			bytes: []byte{0xd9, 0x01, 0xf5, 0x01},
+			err:   "found Major Type 0",
+		},
+		{
+			title: "nok bad signed",
+			bytes: []byte{0xd2, 0x01, 0x02, 0x03},
+			opts:  []ConfigOption{OptionInsecure},
+			err:   "failed CBOR decoding for COSE-Sign1",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			var err error
+			var bytes []byte
+
+			if tc.path != "" {
+				bytes, err = os.ReadFile(tc.path)
+			} else {
+				bytes = tc.bytes
+			}
+			require.NoError(t, err)
+
+			cfg := NewConfig("sqlite", "file::memory:", tc.opts...)
+			store, err := Open(context.Background(), cfg)
+			require.NoError(t, err)
+			require.NoError(t, store.Init())
+			require.NoError(t, store.Migrate())
+
+			err = store.AddBytes(bytes, tc.label, tc.activate)
+
+			if tc.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorContains(t, err, tc.err)
+			}
+
+			require.NoError(t, store.Close())
+		})
+	}
+}
+
+func TestStore_Manifest_CRUD(t *testing.T) {
+	bytes, err := os.ReadFile("../../sample/corim/unsigned-cca-ta.cbor")
+	require.NoError(t, err)
+
+	var unsigned corim.UnsignedCorim
+	err = unsigned.FromCBOR(bytes)
+	require.NoError(t, err)
+
+	manifest, err := model.NewManifestFromCoRIM(&unsigned)
+	require.NoError(t, err)
+	manifest.Digest = []byte{0xde, 0xad, 0xbe, 0xef}
+	manifest.Label = "label"
+
+	store, err := OpenWithDB(context.Background(), test.NewTestDB(t))
+	require.NoError(t, err)
+
+	err = store.AddManifest(manifest)
+	assert.NoError(t, err)
+
+	otherManifest, err := store.GetManifest(manifest.ManifestID, "label")
+	assert.NoError(t, err)
+
+	// note: we cannot simply compare ModuleTag's for equality be cause the
+	// original is not going to have database-internal files (e.g. ID,
+	// OwnerID, etc) set.
+
+	modOrig := manifest.ModuleTags[0]
+	modDB := otherManifest.ModuleTags[0]
+	assert.Equal(t, modOrig.TagIDType, modDB.TagIDType)
+	assert.Equal(t, modOrig.TagID, modDB.TagID)
+	assert.Equal(t, modOrig.TagID, modDB.TagID)
+
+	envOrig := modOrig.KeyTriples[0].Environment
+	envDB := modDB.KeyTriples[0].Environment
+	assert.Equal(t, envOrig.ClassType, envDB.ClassType)
+	assert.Equal(t, envOrig.ClassBytes, envDB.ClassBytes)
+	assert.Equal(t, envOrig.Vendor, envDB.Vendor)
+	assert.Equal(t, envOrig.Model, envDB.Model)
+	assert.Equal(t, envOrig.Layer, envDB.Layer)
+	assert.Equal(t, envOrig.Index, envDB.Index)
+	assert.Equal(t, envOrig.InstanceType, envDB.InstanceType)
+	assert.Equal(t, envOrig.InstanceBytes, envDB.InstanceBytes)
+	assert.Equal(t, envOrig.GroupType, envDB.GroupType)
+	assert.Equal(t, envOrig.GroupBytes, envDB.GroupBytes)
+
+	_, err = store.GetActiveKeyTriples(envOrig, "", false)
+	assert.NoError(t, err)
+
+	_, err = store.GetActiveKeyTriples(envOrig, "label", false)
+	assert.NoError(t, err)
+
+	_, err = store.GetActiveValueTriples(envOrig, "label", false)
+	assert.NoError(t, err)
+
+	err = store.AddManifest(otherManifest)
+	assert.ErrorContains(t, err, "already in store (digests match)")
+
+	otherManifest.Digest = []byte{0x01, 0x02, 0x03, 0x04}
+	err = store.AddManifest(otherManifest)
+	assert.ErrorContains(t, err, "already in store but digests differ")
+
+	store.cfg.Force = true
+	err = store.AddManifest(otherManifest)
+	assert.NoError(t, err)
+
+	store.cfg.RequireLabel = true
+	_, err = store.GetManifest(manifest.ManifestID, "")
+	assert.ErrorContains(t, err, "a label must be specified")
+
+	err = store.DeleteManifest(manifest.ManifestID, "label")
+	assert.NoError(t, err)
+
+	err = store.DeleteManifest(manifest.ManifestID, "label")
+	assert.ErrorContains(t, err, "manifest with ID \"cca-ta\" not found")
+}
+
+func TestStore_Find_bad(t *testing.T) {
+	store, err := OpenWithDB(context.Background(), test.NewTestDB(t))
+	require.NoError(t, err)
+
+	testLayer := uint64(1)
+	lookupEnv := model.Environment{Layer: &testLayer}
+	_, err = store.FindEnvironmentIDs(&lookupEnv, false)
+	assert.ErrorContains(t, err, "no matching environments found")
+
+	_, err = store.FindModuleTagIDsForLabel("")
+	assert.ErrorContains(t, err, "no label specified")
+}
+
+func TestStore_StringAggregatorExpr(t *testing.T) {
+	store, err := OpenWithDB(context.Background(), test.NewTestDB(t))
+	require.NoError(t, err)
+
+	ret := store.StringAggregatorExpr("foo")
+	assert.Equal(t, "GROUP_CONCAT(foo, ', ')", ret)
+
+	testCases := []struct {
+		title    string
+		expected string
+	}{
+		{
+			title:    "mysql",
+			expected: "GROUP_CONCAT(foo SEPARATOR ', ')",
+		},
+		{
+			title:    "pg",
+			expected: "STRING_AGG(foo, ', ')",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			ret := StringAggregatorExprForDialect(tc.title, "foo")
+			assert.Equal(t, tc.expected, ret)
+		})
+	}
+
+	assert.Panics(t, func() { StringAggregatorExprForDialect("foo", "bar") })
+}
+
+func TestStore_ConcatExpr(t *testing.T) {
+	store, err := OpenWithDB(context.Background(), test.NewTestDB(t))
+	require.NoError(t, err)
+
+	ret := store.ConcatExpr("foo", "bar")
+	assert.Equal(t, "foo || bar", ret)
+
+	testCases := []struct {
+		title    string
+		expected string
+	}{
+		{
+			title:    "mysql",
+			expected: "CONCAT(foo, bar)",
+		},
+		{
+			title:    "pg",
+			expected: "foo || bar",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			ret := ConcatExprForDialect(tc.title, "foo", "bar")
+			assert.Equal(t, tc.expected, ret)
+		})
+	}
+
+	assert.Panics(t, func() { ConcatExprForDialect("foo", "bar", "qux") })
+}
+
+func TestStore_HexExpr(t *testing.T) {
+	store, err := OpenWithDB(context.Background(), test.NewTestDB(t))
+	require.NoError(t, err)
+
+	ret := store.HexExpr("foo")
+	assert.Equal(t, "hex(foo)", ret)
+
+	testCases := []struct {
+		title    string
+		expected string
+	}{
+		{
+			title:    "mysql",
+			expected: "hex(foo)",
+		},
+		{
+			title:    "pg",
+			expected: "encode(foo, 'hex')",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			ret := HexExprForDialect(tc.title, "foo")
+			assert.Equal(t, tc.expected, ret)
+		})
+	}
+
+	assert.Panics(t, func() { HexExprForDialect("foo", "bar") })
+}
+
+func TestStore_Digest(t *testing.T) {
+	test_input := []byte{0xde, 0xad, 0xbe, 0xef}
+	testCases := []struct {
+		title    string
+		expected []byte
+	}{
+		{
+			title: "md5",
+			expected: []byte{
+				0x2f, 0x24, 0x92, 0x30, 0xa8, 0xe7, 0xc2, 0xbf,
+				0x60, 0x05, 0xcc, 0xd2, 0x67, 0x92, 0x59, 0xec,
+			},
+		},
+		{
+			title: "sha256",
+			expected: []byte{
+				0x5f, 0x78, 0xc3, 0x32, 0x74, 0xe4, 0x3f, 0xa9,
+				0xde, 0x56, 0x59, 0x26, 0x5c, 0x1d, 0x91, 0x7e,
+				0x25, 0xc0, 0x37, 0x22, 0xdc, 0xb0, 0xb8, 0xd2,
+				0x7d, 0xb8, 0xd5, 0xfe, 0xaa, 0x81, 0x39, 0x53,
+			},
+		},
+		{
+			title: "sha512",
+			expected: []byte{
+				0x12, 0x84, 0xb2, 0xd5, 0x21, 0x53, 0x51, 0x96,
+				0xf2, 0x21, 0x75, 0xd5, 0xf5, 0x58, 0x10, 0x42,
+				0x20, 0xa6, 0xad, 0x76, 0x80, 0xe7, 0x8b, 0x49,
+				0xfa, 0x6f, 0x20, 0xe5, 0x7e, 0xa7, 0xb1, 0x85,
+				0xd7, 0x1e, 0xc1, 0xed, 0xb1, 0x37, 0xe7, 0x0e,
+				0xba, 0x52, 0x8d, 0xed, 0xb1, 0x41, 0xf5, 0xd2,
+				0xf8, 0xbb, 0x53, 0x14, 0x9d, 0x26, 0x29, 0x32,
+				0xb2, 0x7c, 0xf4, 0x1f, 0xed, 0x96, 0xaa, 0x7f,
+			},
+		},
+	}
+
+	store, err := OpenWithDB(context.Background(), test.NewTestDB(t))
+	require.NoError(t, err)
+
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			store.cfg.HashAlg = tc.title
+			ret := store.Digest(test_input)
+			assert.Equal(t, tc.expected, ret)
+		})
+	}
+
+	store.cfg.HashAlg = "foo"
+	assert.Panics(t, func() { store.Digest(test_input) })
+}
diff --git a/pkg/test/test_helpers.go b/pkg/test/test_helpers.go
index fce8071..b2e17a3 100644
--- a/pkg/test/test_helpers.go
+++ b/pkg/test/test_helpers.go
@@ -30,7 +30,7 @@ func NewTestDB(t *testing.T) *bun.DB {
 
 	testDB, err := db.Open(&db.Config{
 		DBMS:     "sqlite",
-		DSN:      fmt.Sprintf("file:%s?cache=shared", testDbFile),
+		DSN:      fmt.Sprintf("file:%s", testDbFile),
 		TraceSQL: trace,
 	})
 	require.NoError(t, err)
diff --git a/sample/config/mariadb.yaml b/sample/config/mariadb.yaml
new file mode 100644
index 0000000..44c0fc0
--- /dev/null
+++ b/sample/config/mariadb.yaml
@@ -0,0 +1,2 @@
+dbms: mariadb
+dsn: store_user:L3tM31n@tcp(localhost:33306)/corim_store?parseTime=true
diff --git a/sample/config/postgres.yaml b/sample/config/postgres.yaml
new file mode 100644
index 0000000..05408f7
--- /dev/null
+++ b/sample/config/postgres.yaml
@@ -0,0 +1,2 @@
+dbms: postgres
+dsn: postgres://store_user:L3tM31n@localhost:55432/corim_store?sslmode=disable
diff --git a/sample/config/sqlite3.yaml b/sample/config/sqlite3.yaml
new file mode 100644
index 0000000..a4d3d7c
--- /dev/null
+++ b/sample/config/sqlite3.yaml
@@ -0,0 +1,2 @@
+dbms: sqlite
+dsn: file:/tmp/test-corim-store-db.sqlite?cache=shared
diff --git a/sample/corim/key.priv.jwk b/sample/corim/key.priv.jwk
new file mode 100644
index 0000000..65bd5ac
--- /dev/null
+++ b/sample/corim/key.priv.jwk
@@ -0,0 +1,7 @@
+{
+  "kty": "EC",
+  "crv": "P-256",
+  "x": "_gPssLIiLnF0XrTGU73XMKlTIk4QhU80ttXzJ7waTpo",
+  "y": "HgibD8RtoczLlJBzDi62cTacMR9NOL8mh6RfU2E3lwk",
+  "d": "ZxfIqWVgn8uXSNQj0t8r_u6iS8WJuKxbmUzwNlpE760"
+}
diff --git a/sample/corim/key.priv.pem b/sample/corim/key.priv.pem
new file mode 100644
index 0000000..a2713b3
--- /dev/null
+++ b/sample/corim/key.priv.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIGcXyKllYJ/Ll0jUI9LfK/7uokvFibisW5lM8DZaRO+toAoGCCqGSM49
+AwEHoUQDQgAE/gPssLIiLnF0XrTGU73XMKlTIk4QhU80ttXzJ7waTpoeCJsPxG2h
+zMuUkHMOLrZxNpwxH004vyaHpF9TYTeXCQ==
+-----END EC PRIVATE KEY-----
diff --git a/sample/corim/key.pub.jwk b/sample/corim/key.pub.jwk
new file mode 100644
index 0000000..4b700cd
--- /dev/null
+++ b/sample/corim/key.pub.jwk
@@ -0,0 +1,6 @@
+{
+  "kty": "EC",
+  "crv": "P-256",
+  "x": "_gPssLIiLnF0XrTGU73XMKlTIk4QhU80ttXzJ7waTpo",
+  "y": "HgibD8RtoczLlJBzDi62cTacMR9NOL8mh6RfU2E3lwk",
+}
diff --git a/sample/corim/key.pub.pem b/sample/corim/key.pub.pem
new file mode 100644
index 0000000..3fb4852
--- /dev/null
+++ b/sample/corim/key.pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/gPssLIiLnF0XrTGU73XMKlTIk4Q
+hU80ttXzJ7waTpoeCJsPxG2hzMuUkHMOLrZxNpwxH004vyaHpF9TYTeXCQ==
+-----END PUBLIC KEY-----
diff --git a/sample/corim/signed-cca-ref-plat.cose b/sample/corim/signed-cca-ref-plat.cose
new file mode 100644
index 0000000..8e13fbb
Binary files /dev/null and b/sample/corim/signed-cca-ref-plat.cose differ
diff --git a/sample/corim/signed-cca-ref-realm.cose b/sample/corim/signed-cca-ref-realm.cose
new file mode 100644
index 0000000..8630295
Binary files /dev/null and b/sample/corim/signed-cca-ref-realm.cose differ
diff --git a/sample/corim/signed-cca-ta.cose b/sample/corim/signed-cca-ta.cose
new file mode 100644
index 0000000..ab52b45
Binary files /dev/null and b/sample/corim/signed-cca-ta.cose differ
diff --git a/scripts/compile-sample-corims.sh b/scripts/compile-sample-corims.sh
index 8aaa30b..16cf4c6 100755
--- a/scripts/compile-sample-corims.sh
+++ b/scripts/compile-sample-corims.sh
@@ -15,8 +15,12 @@ SAMPLE_DIR=${THIS_DIR}/../sample/corim
 for file in "${SAMPLE_DIR}"/*.json; do
 	outfile=$(basename "$file")
 	outfile=${outfile//corim-/unsigned-}
+	signed_outfile=${outfile//unsigned-/signed-}
 	outfile=${SAMPLE_DIR}/${outfile%.json}.cbor
+	signed_outfile=${SAMPLE_DIR}/${signed_outfile%.json}.cose
+	key="${SAMPLE_DIR}"/key.priv.pem
 
 	echo "Compiling ${outfile}..."
 	${CORIM_TOOL} compile --force "${file}" --output "${outfile}"
+	${CORIM_TOOL} compile --force "${file}" --key "${key}" --output "${signed_outfile}"
 done
diff --git a/scripts/db-container.sh b/scripts/db-container.sh
new file mode 100755
index 0000000..915d8ce
--- /dev/null
+++ b/scripts/db-container.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+set -ueo pipefail
+
+TEST_DB_CONTAINER_NAME=${TEST_DB_CONTAINER_NAME:-corim-store-db}
+TEST_DB_MYSQL_PORT=${TEST_DB_MYSQL_PORT:-33306}
+TEST_DB_POSTGRES_PORT=${TEST_DB_POSTGRES_PORT:-55432}
+TEST_DB_LOG_FILE=${TEST_DB_LOG_FILE:-/tmp/corim-store-db-output.log}
+
+error='\e[0;31mERROR\e[0m'
+this_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+root_dir=$this_dir/..
+mysql_args="--ssl=0 -h 127.0.0.1 -P $TEST_DB_MYSQL_PORT -u store_user --password=L3tM31n corim_store"
+psql_args="-U store_user -h localhost -p 55432 -d corim_store"
+
+function check_image() {
+    if [[ "$(docker images -q "$TEST_DB_CONTAINER_NAME")" == "" ]]; then
+	    exit 1
+    fi
+}
+
+function build() {
+	if [[ "$(type -p docker)" == "" ]]; then
+		echo -e "$error: docker must be installed."
+		exit 1
+	fi
+
+	if ! (docker buildx version &>/dev/null); then
+		echo -e "$error: docker-buildx Docker plugin must be installed."
+		exit 1
+	fi
+
+	pushd "$root_dir/docker" &>/dev/null
+	trap 'popd &>/dev/null' RETURN
+
+	echo "building $TEST_DB_CONTAINER_NAME..."
+	docker build . -t "$TEST_DB_CONTAINER_NAME"
+	echo "done."
+}
+
+function run() {
+	if [[ "$(docker images -q "$TEST_DB_CONTAINER_NAME")" == "" ]]; then
+		echo -e "$error: container $TEST_DB_CONTAINER_NAME does not exist " \
+			"(run db-container.sh build first)."
+		exit 1
+	fi
+
+	echo "running $TEST_DB_CONTAINER_NAME..."
+	echo "----------------------------------------------------" >>"$TEST_DB_LOG_FILE"
+	nohup docker run -p "${TEST_DB_MYSQL_PORT}":3306 -p "${TEST_DB_POSTGRES_PORT}":5432 \
+		"$TEST_DB_CONTAINER_NAME" &>>"$TEST_DB_LOG_FILE" &
+
+	if [[ "$(type -p mariadb)" != "" ]]; then
+		sleep 2
+		count=0
+		# shellcheck disable=SC2086
+		until mariadb $mysql_args -e "SELECT 1" &>/dev/null; do
+			sleep 1
+			((count += 1))
+
+			if [[ $count -gt 20 ]]; then
+				echo -e "$error: timed out waiting for MariaDB server."
+				exit 1
+			fi
+		done
+	else
+		# don't have MariaDB client not installed on the host, so just use a constant delay
+		# to give the server time to start.
+		sleep 10
+	fi
+
+	echo "done."
+}
+
+function stop() {
+	echo "stopping $TEST_DB_CONTAINER_NAME..."
+	for cid in $(docker ps -q --filter "ancestor=$TEST_DB_CONTAINER_NAME"); do
+		docker stop "$cid"
+	done
+	echo "done."
+}
+
+function shell() {
+	for cid in $(docker ps -q --filter "ancestor=$TEST_DB_CONTAINER_NAME"); do
+		docker exec -it "$cid" /bin/bash
+		break
+	done
+}
+
+function mariadb_shell() {
+	if [[ "$(type -p mariadb)" == "" ]]; then
+		echo -e "$error: MariaDB client (mariadb) must be installed."
+		exit 1
+	fi
+
+	echo "mariadb $mysql_args"
+	# shellcheck disable=SC2086
+	mariadb $mysql_args
+}
+
+function psql_shell() {
+	if [[ "$(type -p psql)" == "" ]]; then
+		echo -e "$error: PosogreSQL client (psql) must be installed."
+		exit 1
+	fi
+
+	export PGPASSWORD='L3tM31n'
+	echo "PGPASSWORD=$PGPASSWORD psql $psql_args"
+	# shellcheck disable=SC2086
+	psql $psql_args
+}
+
+function help() {
+	set +e
+	local usage
+	read -r -d '' usage <<-EOF
+	Usage: db-container.sh COMMAND
+
+	Commands:
+
+	help
+	    Print this message and exist (the same as -h).
+
+	check-image
+	    Check whether the Docker container image has been created. Non-zero exit code
+	    indicates that it was not.
+
+	build
+	    Build Docker image that runs MariaDB and PosogreSQL servers with appropriate
+	    database and users created.
+
+	run | start
+	    Run a Docker container built using the build command (see above).
+
+	stop
+	    Stop the container started with run/start command.
+
+	shell
+	    Start a (root) shell  inside the container.
+
+	mariadb | mysql
+	   Start an interactive session shell on the MariaDB server running inside the container.
+
+	postgres | psql
+	   Start an interactive session shell on the PostgreSQL server running inside the container.
+
+	Environment Variables:
+
+	A number of environment variables control the Docker image/container. Please make sure
+	the values of these variables remain consisten across command invocations.
+
+	TEST_DB_CONTAINER_NAME
+	    The name of the Docker container image  name that will be built. (Defaults to
+	    corim-store-db).
+
+	TEST_DB_MYSQL_PORT
+	    The host post that the MariaDB servier will be listening on. (Defaults to 33306).
+
+	TEST_DB_POSTGRES_PORT
+	    The host post that the PostgreSQL servier will be listening on. (Defaults to 55432).
+
+	TEST_DB_LOG_FILE
+	   The file that the output from the running container will be logged to (Defaults to
+	   /tmp/corim-store-db-output.log).
+
+	EOF
+	set -e
+
+	echo "$usage"
+}
+
+while getopts "h" opt; do
+	case "$opt" in
+		h) help; exit 0;;
+		*) break;;
+	esac
+done
+
+shift $((OPTIND-1))
+[ "${1:-}" = "--" ] && shift
+
+if [[ "${1:-}" == "" ]]; then
+	echo -e "$error: a command must be specified (see -h output)."
+	exit 1
+fi
+
+command=${1:-}; shift
+command=$(echo "$command" | tr -- _ -)
+case $command in
+	help) help;;
+	check-image) check_image;;
+	build) build;;
+	run | start) run;;
+	mariadb | mysql) mariadb_shell;;
+	postgres | psql) psql_shell;;
+	shell) shell;;
+	stop) stop;;
+    	*) echo -e "$error: unexpected command: \"$command\"";;
+esac
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
new file mode 100755
index 0000000..4e1c0f5
--- /dev/null
+++ b/scripts/integration-tests.sh
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+
+error='\e[0;31mERROR\e[0m'
+this_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+root_dir=$this_dir/..
+corim_store=$root_dir/corim-store
+
+function check_installed() {
+        what=$1
+
+	if [[ "$(type -p "$what")" == "" ]]; then
+		echo -e "$error: $what must be installed."
+		exit 1
+	fi
+}
+
+function check_requirements() {
+    check_installed docker
+    check_installed jq
+}
+
+function setup() {
+    echo "updating submods..."
+    git submodule update --init
+
+    echo "building corim-store..."
+    make -s build
+
+    if ! "$root_dir"/scripts/db-container.sh check-image; then
+        echo "building DB container..."
+        "$root_dir"/scripts/db-container.sh build >/dev/null
+    fi
+
+    echo "starting DB container..."
+    "$root_dir"/scripts/db-container.sh start >/dev/null
+
+    echo "initializing store..."
+    $corim_store --config "$root_dir"/sample/config/sqlite3.yaml db init
+    $corim_store --config "$root_dir"/sample/config/mariadb.yaml db init
+    $corim_store --config "$root_dir"/sample/config/postgres.yaml db init
+}
+
+function teardown() {
+    echo "stopping DB container..."
+    "$root_dir"/scripts/db-container.sh stop >/dev/null
+
+    echo "done."
+}
+
+function run() {
+    "$root_dir"/test/bats/bin/bats test
+}
+
+function help() {
+	set +e
+	local usage
+	read -r -d '' usage <<-EOF
+        Usage: db-container.sh COMMAND
+
+        Commands:
+
+        help
+            Print this message and exist (the same as -h).
+
+        setup
+            Set up integration tests infrastructure.
+
+        run
+            Run integration tests.
+
+        teardown
+            Tear down integartion tests infrastructure.
+	EOF
+	set -e
+
+	echo "$usage"
+}
+
+check_requirements
+
+while getopts "h" opt; do
+	case "$opt" in
+		h) help; exit 0;;
+		*) break;;
+	esac
+done
+
+shift $((OPTIND-1))
+[ "${1:-}" = "--" ] && shift
+
+if [[ "${1:-}" == "" ]]; then
+	echo -e "$error: a command must be specified (see -h output)."
+	exit 1
+fi
+
+command=${1:-}; shift
+command=$(echo "$command" | tr -- _ -)
+case $command in
+	help) help;;
+	setup) setup;;
+	run ) run;;
+	teardown) teardown;;
+	*) echo -e "$error: unexpected command: \"$command\"";;
+esac
diff --git a/test/bats b/test/bats
new file mode 160000
index 0000000..33ae886
--- /dev/null
+++ b/test/bats
@@ -0,0 +1 @@
+Subproject commit 33ae8862cd058e004f9f04e1f9ad6197763a1cb2
diff --git a/test/test.bats b/test/test.bats
new file mode 100644
index 0000000..68337db
--- /dev/null
+++ b/test/test.bats
@@ -0,0 +1,47 @@
+function setup_file() {
+    this_dir=$( cd -- "$( dirname -- "${BATS_TEST_FILENAME}" )" &> /dev/null && pwd )
+    ROOT_DIR=$this_dir/..
+    CORIM_STORE=$ROOT_DIR/corim-store
+
+    export ROOT_DIR
+    export CORIM_STORE
+}
+
+function setup() {
+    load 'test_helper/bats-support/load'
+    load 'test_helper/bats-assert/load'
+
+    $CORIM_STORE --config "$ROOT_DIR"/sample/config/mariadb.yaml db migrate
+    $CORIM_STORE --config "$ROOT_DIR"/sample/config/postgres.yaml db migrate
+}
+
+function teardown() {
+    $CORIM_STORE --config "$ROOT_DIR"/sample/config/mariadb.yaml db rollback
+    $CORIM_STORE --config "$ROOT_DIR"/sample/config/postgres.yaml db rollback
+}
+
+
+function do_get() {
+    config_path=$1
+
+     $CORIM_STORE --config "$config_path" corim add "$ROOT_DIR"/sample/corim/*cbor &>/dev/null
+     $CORIM_STORE --config "$config_path" get --class-id 2QJYWCB/RUxGAgEBAAAAAAAAAAAAAwA+AAEAAABQWAAAAAAAAA==
+}
+
+@test "SQLite3 get" {
+    run bats_pipe \
+        do_get "$ROOT_DIR"/sample/config/sqlite3.yaml \| jq ".\"reference-values\" | length"
+    assert_output "1"
+}
+
+@test "MariaDB get" {
+    run bats_pipe \
+        do_get "$ROOT_DIR"/sample/config/mariadb.yaml \| jq ".\"reference-values\" | length"
+    assert_output "1"
+}
+
+@test "PostgreSQL get" {
+    run bats_pipe \
+        do_get "$ROOT_DIR"/sample/config/postgres.yaml \| jq ".\"reference-values\" | length"
+    assert_output "1"
+}
diff --git a/test/test_helper/bats-assert b/test/test_helper/bats-assert
new file mode 160000
index 0000000..697471b
--- /dev/null
+++ b/test/test_helper/bats-assert
@@ -0,0 +1 @@
+Subproject commit 697471b7a89d3ab38571f38c6c7c4b460d1f5e35
diff --git a/test/test_helper/bats-support b/test/test_helper/bats-support
new file mode 160000
index 0000000..0954abb
--- /dev/null
+++ b/test/test_helper/bats-support
@@ -0,0 +1 @@
+Subproject commit 0954abb9925cad550424cebca2b99255d4eabe96