Software Releases

• nitrokey.trussed.admin_app: Add model and revision to AdminStatus

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

Breaking Changes

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

Bugfixes

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

Compatibility

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

Migration

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog

This release adds support for the new features provided by NetHSM v4.0 and v5.0.

Breaking Changes

• models:
  • Split NetworkConfig into NetworkConfigInput and NetworkConfigOutput
  • Add SystemState::Failed variant
• Add response data for error responses
• Add support for key labels (requires NetHSM v5.0):
  • apis::default_api:
    • Add label argument to keys_get, keys_key_prefix_get
    • Add keys_key_id_label_delete, keys_key_id_label_put functions
  • models: Add label field to KeyGenerateRequstData, PrivateKey, PrivateKeyPemArguments and PublicKey

Features

• Add support for clustering (requires NetHSM v4.0):
  • apis::default_api: Add cluster_join_post, cluster_members_get, cluster_members_member_id_delete, cluster_members_member_id_put, cluster_members_post, config_tls_cluster_ca_pem_get, config_tls_cluster_ca_pem_put functions
• Add support for cluster recovery (requires NetHSM v5.0):
  • apis::default_api: Add cluster_force_new_post, cluster_members_member_id_promote_post, health_diagonse_get functions
• Add support for IPv6 network config (requires NetHSM v4.0)
• Add support for NTP config (requires NetHSM v5.0):
  • apis::default_api: Add config_ntp_get, config_ntp_put functions

All Changes

This release adds support for NethHSM v5 and the fido2 provision-credential command, updates the minimum Python version to 3.11 and fixes some bugs.

Note that the default branch for this repository is now main. The master branch will be deleted soon.

What's Changed

• PIV factory-reset: show proper error message when the PIN isn't locked by @sosthene-nitrokey in #771
• Windows versioninfo and version format by @mmerklinger in #774
• pre-registration for entra by @AdityaMitra5102 in #783
• nethsm generate-key: Fix interactive mechanism selection by @robin-nitrokey in #784
• PIV import and PUK fixes by @ABuljko in #766
• fido2: plug some resource leaks in the client by @kevans91 in #781
• Add NetHSM features from Nethsm v3.0.0rc by @AdityaMitra5102 in #787
• Entra provision by @AdityaMitra5102 in #789
• Update clustering features for NetHSM v5.0 and release v0.13.0rc1 by @robin-nitrokey in #788
• Release v0.13.0 by @robin-nitrokey in #793

New Contributors

• @AdityaMitra5102 made their first contribution in #783
• @ABuljko made their first contribution in #766
• @kevans91 made their first contribution in #781

Full Changelog: v0.12.3...v0.13.0

Breaking Changes

• Return FullClusterJoinData instead of ClusterJoinData from add_cluster_member (requires NetHSM v5)

Changes

• Update for NetHSM v5:
  • Add State.FAILED variant
  • Update clustering functionality:
    • Add FullClusterJoinData, ClusterDiagnostics, ClusterLogItem, ClusterState and ClusterSnapshot classes
    • Change NetHSM.join_cluster to also accept FullClusterJoinData
    • Add force_new_cluster, get_cluster_diagnostics, promote_cluster_member functions to NetHSM
    • Add learner field to ClusterMember
  • Add support for key labels:
    • Add label argument to add_key, add_key_pem, generate_key, list_keys functions
    • Add NetHSM.set_key_label function
    • Add optional label field to Key
  • Add support for NTP configuration:
    • Add NtpConfig class
    • Add get_config_ntp, set_ntp_config functions to NetHSM

All Changes

Breaking Changes

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

Bugfixes

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

Compatibility

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

Migration

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog

What's Changed

• PIV factory-reset: show proper error message when the PIN isn't locked by @sosthene-nitrokey in #771
• Windows versioninfo and version format by @mmerklinger in #774
• pre-registration for entra by @AdityaMitra5102 in #783
• nethsm generate-key: Fix interactive mechanism selection by @robin-nitrokey in #784
• PIV import and PUK fixes by @ABuljko in #766
• fido2: plug some resource leaks in the client by @kevans91 in #781
• Add NetHSM features from Nethsm v3.0.0rc by @AdityaMitra5102 in #787
• Entra provision by @AdityaMitra5102 in #789
• Update clustering features for NetHSM v5.0 and release v0.13.0rc1 by @robin-nitrokey in #788

New Contributors

• @AdityaMitra5102 made their first contribution in #783
• @ABuljko made their first contribution in #766
• @kevans91 made their first contribution in #781

Full Changelog: v0.12.3...v0.13.0rc1

• Add Failed mode for diagnosis and disaster recovery
• Add support for key labels
• Add NTP/NTS support
• Use learner mode for joining a cluster
• Fix verification of cluster CA certificate chain

Breaking Changes

• Return FullClusterJoinData instead of ClusterJoinData from add_cluster_member (requires NetHSM v5)

Changes

• Update for NetHSM v5:
  • Add State.FAILED variant
  • Update clustering functionality:
    • Add FullClusterJoinData, ClusterDiagnostics, ClusterLogItem, ClusterState and ClusterSnapshot classes
    • Change NetHSM.join_cluster to also accept FullClusterJoinData
    • Add force_new_cluster, get_cluster_diagnostics, promote_cluster_member functions to NetHSM
    • Add learner field to ClusterMember
  • Add support for key labels:
    • Add label argument to add_key, add_key_pem, generate_key, list_keys functions
    • Add NetHSM.set_key_label function
    • Add optional label field to Key
  • Add support for NTP configuration:
    • Add NtpConfig class
    • Add get_config_ntp, set_ntp_config functions to NetHSM

All Changes

• nitrokey.nk3.secrets_app: Fix discarded authentication when using SecretsApp over CCID
• Bump minimum Python version to 3.11.
• nitrokey.trussed: Add the inner_checksum field to FirmwareMetadata with the checksum of the unsigned firmware image.
• nitrokey.checksum: Add unified checksum calculation for both NRF52 and LPC55 firmware files.
• nitrokey.trussed.nrfutils: Add support for NRF52 package signing and upload
• Wrap OSError in ConnectionError and CtapError in DeviceError for transport-agnostic error types.
• Move connection handling into separate classes.
• Rename TrussedDevice.from_device to TrussedDevice.from_connection.
• Add TrussedDevice.list classmethod.
• Add Transport enum and update list functions to use it instead of the use_ccid argument.
• Replace should_default_ccid function with recommended_transport function.
• Add TrussedDevice.ctaphid_device function.
• Add support for credentials import and export in FIDO CXF format.
• Rename pcsc extra to ccid.
• Add vid and pid properties to Model enum.
• nitrokey.nk3.secrets_app: Add register_uri function

All Changes

Breaking Changes

• models:
  • Split NetworkConfig into NetworkConfigInput and NetworkConfigOutput
  • Add SystemState::Failed variant
• Add response data for error responses
• Add support for key labels (requires NetHSM v5.0):
  • apis::default_api:
    • Add label argument to key_get
    • Add keys_key_id_label_delete, keys_key_id_label_put functions
  • models: Add label field to KeyGenerateRequstData, PrivateKey and PublicKey

Features

• Add support for clustering (requires NetHSM v4.0):
  • apis::default_api: Add cluster_join_post, cluster_members_get, cluster_members_member_id_delete, cluster_members_member_id_put, cluster_members_post, config_tls_cluster_ca_pem_get, config_tls_cluster_ca_pem_put functions
• Add support for cluster recovery (requires NetHSM v5.0):
  • apis::default_api: Add cluster_force_new_post, cluster_members_member_id_promote_post, health_diagonse_get functions
• Add support for IPv6 network config (requires NetHSM v4.0)
• Add support for NTP config (requires NetHSM v5.0):
  • apis::default_api: Add config_ntp_get, config_ntp_put functions

All Changes

v1.26.15

This release includes all Nitropad variants. The ns50 variant is not tested.

Its based on upstream commit a605d04

Major Changes/Fixes

• Fix a Regression that prevented the OEM Factory reset for the Nitrokey Storage linuxboot#2170

Signature

Verify the detached signature using:

gpg --verify sha256sum.sig sha256sum

You expect an output like this one:

gpg: Signature made Tue Jul 14 11:38:38 2026 CEST gpg: using RSA key C7E32619E2F71736F5910BB144CB2D868DD16BDA gpg: Good signature from "Markus Meissner <[email protected]>" [ultimate] gpg: aka "Markus Meissner <[email protected]>" [ultimate]

If you don't have the key yet, you can get it like this:

gpg2 --keyserver keyserver.ubuntu.com --recv-keys 44CB2D868DD16BDA

Feel free to cross-validate the main-key fingerprint on this profile.