What's Changed

• PIV factory-reset: show proper error message when the PIN isn't locked by @sosthene-nitrokey in #771
• Windows versioninfo and version format by @mmerklinger in #774
• pre-registration for entra by @AdityaMitra5102 in #783
• nethsm generate-key: Fix interactive mechanism selection by @robin-nitrokey in #784
• PIV import and PUK fixes by @ABuljko in #766
• fido2: plug some resource leaks in the client by @kevans91 in #781
• Add NetHSM features from Nethsm v3.0.0rc by @AdityaMitra5102 in #787
• Entra provision by @AdityaMitra5102 in #789
• Update clustering features for NetHSM v5.0 and release v0.13.0rc1 by @robin-nitrokey in #788

New Contributors

• @AdityaMitra5102 made their first contribution in #783
• @ABuljko made their first contribution in #766
• @kevans91 made their first contribution in #781

Full Changelog: v0.12.3...v0.13.0rc1

• Add Failed mode for diagnosis and disaster recovery
• Add support for key labels
• Add NTP/NTS support
• Use learner mode for joining a cluster
• Fix verification of cluster CA certificate chain

Breaking Changes

• Return FullClusterJoinData instead of ClusterJoinData from add_cluster_member (requires NetHSM v5)

Changes

• Update for NetHSM v5:
  • Add State.FAILED variant
  • Update clustering functionality:
    • Add FullClusterJoinData, ClusterDiagnostics, ClusterLogItem, ClusterState and ClusterSnapshot classes
    • Change NetHSM.join_cluster to also accept FullClusterJoinData
    • Add force_new_cluster, get_cluster_diagnostics, promote_cluster_member functions to NetHSM
    • Add learner field to ClusterMember
  • Add support for key labels:
    • Add label argument to add_key, add_key_pem, generate_key, list_keys functions
    • Add NetHSM.set_key_label function
    • Add optional label field to Key
  • Add support for NTP configuration:
    • Add NtpConfig class
    • Add get_config_ntp, set_ntp_config functions to NetHSM

All Changes

• nitrokey.nk3.secrets_app: Fix discarded authentication when using SecretsApp over CCID
• Bump minimum Python version to 3.11.
• nitrokey.trussed: Add the inner_checksum field to FirmwareMetadata with the checksum of the unsigned firmware image.
• nitrokey.checksum: Add unified checksum calculation for both NRF52 and LPC55 firmware files.
• nitrokey.trussed.nrfutils: Add support for NRF52 package signing and upload
• Wrap OSError in ConnectionError and CtapError in DeviceError for transport-agnostic error types.
• Move connection handling into separate classes.
• Rename TrussedDevice.from_device to TrussedDevice.from_connection.
• Add TrussedDevice.list classmethod.
• Add Transport enum and update list functions to use it instead of the use_ccid argument.
• Replace should_default_ccid function with recommended_transport function.
• Add TrussedDevice.ctaphid_device function.
• Add support for credentials import and export in FIDO CXF format.
• Rename pcsc extra to ccid.
• Add vid and pid properties to Model enum.
• nitrokey.nk3.secrets_app: Add register_uri function

All Changes

Breaking Changes

• models:
  • Split NetworkConfig into NetworkConfigInput and NetworkConfigOutput
  • Add SystemState::Failed variant
• Add response data for error responses
• Add support for key labels (requires NetHSM v5.0):
  • apis::default_api:
    • Add label argument to key_get
    • Add keys_key_id_label_delete, keys_key_id_label_put functions
  • models: Add label field to KeyGenerateRequstData, PrivateKey and PublicKey

Features

• Add support for clustering (requires NetHSM v4.0):
  • apis::default_api: Add cluster_join_post, cluster_members_get, cluster_members_member_id_delete, cluster_members_member_id_put, cluster_members_post, config_tls_cluster_ca_pem_get, config_tls_cluster_ca_pem_put functions
• Add support for cluster recovery (requires NetHSM v5.0):
  • apis::default_api: Add cluster_force_new_post, cluster_members_member_id_promote_post, health_diagonse_get functions
• Add support for IPv6 network config (requires NetHSM v4.0)
• Add support for NTP config (requires NetHSM v5.0):
  • apis::default_api: Add config_ntp_get, config_ntp_put functions

All Changes

v1.26.15

This release includes all Nitropad variants. The ns50 variant is not tested.

Its based on upstream commit a605d04

Major Changes/Fixes

• Fix a Regression that prevented the OEM Factory reset for the Nitrokey Storage linuxboot#2170

Signature

Verify the detached signature using:

gpg --verify sha256sum.sig sha256sum

You expect an output like this one:

gpg: Signature made Tue Jul 14 11:38:38 2026 CEST gpg: using RSA key C7E32619E2F71736F5910BB144CB2D868DD16BDA gpg: Good signature from "Markus Meissner <[email protected]>" [ultimate] gpg: aka "Markus Meissner <[email protected]>" [ultimate]

If you don't have the key yet, you can get it like this:

gpg2 --keyserver keyserver.ubuntu.com --recv-keys 44CB2D868DD16BDA

Feel free to cross-validate the main-key fingerprint on this profile.

This release includes all Nitropad variants. The ns50 variant is not tested.

Its based on upstream commit 420d71e

Major Changes/Fixes

• Ubuntu luks password prompt working again PR 2130
• Better Nitrokey 3 Handling
• Interface/UI Clean up

Signature

Verify the detached signature using:

gpg --verify sha256sum.sig sha256sum

You expect an output like this one:

gpg: Signature made Tue Jul 14 11:38:38 2026 CEST gpg: using RSA key C7E32619E2F71736F5910BB144CB2D868DD16BDA gpg: Good signature from "Markus Meissner <[email protected]>" [ultimate] gpg: aka "Markus Meissner <[email protected]>" [ultimate]

If you don't have the key yet, you can get it like this:

gpg2 --keyserver keyserver.ubuntu.com --recv-keys 44CB2D868DD16BDA

Feel free to cross-validate the main-key fingerprint on this profile.

v1.26.14

v1.26.13

Changes

• Patch generated client to remove the python-dateutil dependency.

All Changes