Software-Veröffentlichungen

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Add support for revision R2 of the NK3xN using the FM11NT082C NFC chip.
• admin-app:
  • Add model and board revision to status
  • Disable destructive reboot to bootloader
• Update applications (maintenance only):
  • admin-app v0.4.0
  • fido-authenticator v0.3.0
  • opcard v1.10.0
  • piv-authenticator v0.7.0
  • secrets-app v0.16.0

• nitrokey.trussed.admin_app: Add model and revision to AdminStatus

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog

This release adds support for the new features provided by NetHSM v4.0 and v5.0.

• models:
  • Split NetworkConfig into NetworkConfigInput and NetworkConfigOutput
  • Add SystemState::Failed variant
• Add response data for error responses
• Add support for key labels (requires NetHSM v5.0):
  • apis::default_api:
    • Add label argument to keys_get, keys_key_prefix_get
    • Add keys_key_id_label_delete, keys_key_id_label_put functions
  • models: Add label field to KeyGenerateRequstData, PrivateKey, PrivateKeyPemArguments and PublicKey

• Add support for clustering (requires NetHSM v4.0):
  • apis::default_api: Add cluster_join_post, cluster_members_get, cluster_members_member_id_delete, cluster_members_member_id_put, cluster_members_post, config_tls_cluster_ca_pem_get, config_tls_cluster_ca_pem_put functions
• Add support for cluster recovery (requires NetHSM v5.0):
  • apis::default_api: Add cluster_force_new_post, cluster_members_member_id_promote_post, health_diagonse_get functions
• Add support for IPv6 network config (requires NetHSM v4.0)
• Add support for NTP config (requires NetHSM v5.0):
  • apis::default_api: Add config_ntp_get, config_ntp_put functions

All Changes

This release adds support for NethHSM v5 and the fido2 provision-credential command, updates the minimum Python version to 3.11 and fixes some bugs.

Note that the default branch for this repository is now main. The master branch will be deleted soon.

• PIV factory-reset: show proper error message when the PIN isn't locked by @sosthene-nitrokey in #771
• Windows versioninfo and version format by @mmerklinger in #774
• pre-registration for entra by @AdityaMitra5102 in #783
• nethsm generate-key: Fix interactive mechanism selection by @robin-nitrokey in #784
• PIV import and PUK fixes by @ABuljko in #766
• fido2: plug some resource leaks in the client by @kevans91 in #781
• Add NetHSM features from Nethsm v3.0.0rc by @AdityaMitra5102 in #787
• Entra provision by @AdityaMitra5102 in #789
• Update clustering features for NetHSM v5.0 and release v0.13.0rc1 by @robin-nitrokey in #788
• Release v0.13.0 by @robin-nitrokey in #793

• @AdityaMitra5102 made their first contribution in #783
• @ABuljko made their first contribution in #766
• @kevans91 made their first contribution in #781

Full Changelog: v0.12.3...v0.13.0

• Return FullClusterJoinData instead of ClusterJoinData from add_cluster_member (requires NetHSM v5)

• Update for NetHSM v5:
  • Add State.FAILED variant
  • Update clustering functionality:
    • Add FullClusterJoinData, ClusterDiagnostics, ClusterLogItem, ClusterState and ClusterSnapshot classes
    • Change NetHSM.join_cluster to also accept FullClusterJoinData
    • Add force_new_cluster, get_cluster_diagnostics, promote_cluster_member functions to NetHSM
    • Add learner field to ClusterMember
  • Add support for key labels:
    • Add label argument to add_key, add_key_pem, generate_key, list_keys functions
    • Add NetHSM.set_key_label function
    • Add optional label field to Key
  • Add support for NTP configuration:
    • Add NtpConfig class
    • Add get_config_ntp, set_ntp_config functions to NetHSM

All Changes

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog

• PIV factory-reset: show proper error message when the PIN isn't locked by @sosthene-nitrokey in #771
• Windows versioninfo and version format by @mmerklinger in #774
• pre-registration for entra by @AdityaMitra5102 in #783
• nethsm generate-key: Fix interactive mechanism selection by @robin-nitrokey in #784
• PIV import and PUK fixes by @ABuljko in #766
• fido2: plug some resource leaks in the client by @kevans91 in #781
• Add NetHSM features from Nethsm v3.0.0rc by @AdityaMitra5102 in #787
• Entra provision by @AdityaMitra5102 in #789
• Update clustering features for NetHSM v5.0 and release v0.13.0rc1 by @robin-nitrokey in #788

• @AdityaMitra5102 made their first contribution in #783
• @ABuljko made their first contribution in #766
• @kevans91 made their first contribution in #781

Full Changelog: v0.12.3...v0.13.0rc1

• Add Failed mode for diagnosis and disaster recovery
• Add support for key labels
• Add NTP/NTS support
• Use learner mode for joining a cluster
• Fix verification of cluster CA certificate chain

• Return FullClusterJoinData instead of ClusterJoinData from add_cluster_member (requires NetHSM v5)

• Update for NetHSM v5:
  • Add State.FAILED variant
  • Update clustering functionality:
    • Add FullClusterJoinData, ClusterDiagnostics, ClusterLogItem, ClusterState and ClusterSnapshot classes
    • Change NetHSM.join_cluster to also accept FullClusterJoinData
    • Add force_new_cluster, get_cluster_diagnostics, promote_cluster_member functions to NetHSM
    • Add learner field to ClusterMember
  • Add support for key labels:
    • Add label argument to add_key, add_key_pem, generate_key, list_keys functions
    • Add NetHSM.set_key_label function
    • Add optional label field to Key
  • Add support for NTP configuration:
    • Add NtpConfig class
    • Add get_config_ntp, set_ntp_config functions to NetHSM

All Changes

• nitrokey.nk3.secrets_app: Fix discarded authentication when using SecretsApp over CCID
• Bump minimum Python version to 3.11.
• nitrokey.trussed: Add the inner_checksum field to FirmwareMetadata with the checksum of the unsigned firmware image.
• nitrokey.checksum: Add unified checksum calculation for both NRF52 and LPC55 firmware files.
• nitrokey.trussed.nrfutils: Add support for NRF52 package signing and upload
• Wrap OSError in ConnectionError and CtapError in DeviceError for transport-agnostic error types.
• Move connection handling into separate classes.
• Rename TrussedDevice.from_device to TrussedDevice.from_connection.
• Add TrussedDevice.list classmethod.
• Add Transport enum and update list functions to use it instead of the use_ccid argument.
• Replace should_default_ccid function with recommended_transport function.
• Add TrussedDevice.ctaphid_device function.
• Add support for credentials import and export in FIDO CXF format.
• Rename pcsc extra to ccid.
• Add vid and pid properties to Model enum.
• nitrokey.nk3.secrets_app: Add register_uri function

All Changes

• models:
  • Split NetworkConfig into NetworkConfigInput and NetworkConfigOutput
  • Add SystemState::Failed variant
• Add response data for error responses
• Add support for key labels (requires NetHSM v5.0):
  • apis::default_api:
    • Add label argument to key_get
    • Add keys_key_id_label_delete, keys_key_id_label_put functions
  • models: Add label field to KeyGenerateRequstData, PrivateKey and PublicKey

• Add support for clustering (requires NetHSM v4.0):
  • apis::default_api: Add cluster_join_post, cluster_members_get, cluster_members_member_id_delete, cluster_members_member_id_put, cluster_members_post, config_tls_cluster_ca_pem_get, config_tls_cluster_ca_pem_put functions
• Add support for cluster recovery (requires NetHSM v5.0):
  • apis::default_api: Add cluster_force_new_post, cluster_members_member_id_promote_post, health_diagonse_get functions
• Add support for IPv6 network config (requires NetHSM v4.0)
• Add support for NTP config (requires NetHSM v5.0):
  • apis::default_api: Add config_ntp_get, config_ntp_put functions

All Changes

v1.26.15