Software Releases

This release includes all Nitropad variants. The ns50 variant is not tested.

Its based on upstream commit ce8b359

Major Changes:

• Enables persistent MAC Randomisation feature thanks @FckBigTch PR linuxboot#2207

Signature

Verify the detached signature using:

gpg --verify sha256sum.txt.sig sha256sum.txt

You expect an output like this one:

gpg: Signature made Wed Oct 21 19:33:55 2026 CEST gpg: using RSA key C7E32619E2F71736F5910BB144CB2D868DD16BDA gpg: Good signature from "Markus Meissner <[email protected]>" [unknown] gpg: aka "Markus Meissner <[email protected]>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: CC74 B712 0BFA A36F F428 6872 4C14 49F1 C980 4176 Subkey fingerprint: C7E3 2619 E2F7 1736 F591 0BB1 44CB 2D86 8DD1 6BDA

If you don't have the key yet, you can get it like this:

gpg2 --keyserver keyserver.ubuntu.com --recv-keys 44CB2D868DD16BDA

Feel free to cross-validate the main-key fingerprint on this profile.

v1.26.20

v1.26.19

• Explicitely reject compromised emSign intermediary certificates
• Add missing environment variable to error message
• Add v5.0 tag to test matrix
• Do not report CKA_DERIVE as true for EC keys (ECDSA, EdDSA and Brainpool), as NetHSM only supports signing with them
• Set CKA_DECRYPT and CKA_SIGN for RSA keys according to the key mechanisms reported by the NetHSM
• Set CKA_DECRYPT and CKA_SIGN for AES keys according to the key mechanisms reported by the NetHSM

Full Changelog

This is a maintenance release that updates the bundled root certificates to remove the compromised emSign certificate, see GHSA-6q48-6c7w-9gw2.

What's Changed

• Add test for nethsm commands by @AdityaMitra5102 in #805
• NetHSM CLI improvements by @mmerklinger in #809
• Update OpenPGP key for Markus by @robin-nitrokey in #811
• Update dependencies and release v0.14.1 by @robin-nitrokey in #812

Full Changelog: v0.14.0...v0.14.1

v1.26.18

Release v1.26.17

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Fix USB descriptor for compatibility with Windows when using CCID (#708)

What's Changed

• trussed: Add model and revision to status output by @robin-nitrokey in #795
• Allow cryptography <53 by @robin-nitrokey in #798
• Use secrets rather than random to generate secrets by @dirkmueller in #800
• nk3: secret: Make get-password pipe compatible by @symptog in #801
• Fix typo in NetHSM error message by @mmerklinger in #802

New Contributors

• @dirkmueller made their first contribution in #800
• @symptog made their first contribution in #801

Full Changelog: v0.13.0...v0.14.0

Breaking Changes

• Bump minimum Python version to 3.11.
• Refactor connection handling:
  • Wrap OSError in ConnectionError and CtapError in DeviceError for transport-agnostic error types.
  • Move connection handling into separate classes.
  • Rename TrussedDevice.from_device to TrussedDevice.from_connection.
  • Add TrussedDevice.list classmethod.
  • Add Transport enum.
  • Add TrussedDevice.ctaphid_device function.
  • Change type of TrussedDevice.path to Optional[str]
• Remove support for fido2 v1.

Features

• Add support for credentials import and export in FIDO CXF format.
• nitrokey.trussed.admin_app: Add model and revision to AdminStatus
• nitrokey.trussed: Add the inner_checksum field to FirmwareMetadata with the checksum of the unsigned firmware image.
• nitrokey.checksum: Add unified checksum calculation for both NRF52 and LPC55 firmware files.
• nitrokey.trussed.nrfutils: Add support for NRF52 package signing and upload
• Add vid and pid properties to Model enum.
• nitrokey.nk3.secrets_app: Add register_uri function
• Enable communication with Nitrokey 3 and Nitrokey Passkeys over CCID instead of CTAPHID
  • Add recommended_transport function that indicates when CCID should be prefered. CCID is more limited than CTAPHID, so this functions only recommends CCID on Windows when not an administrator, as CTAPHID is not available in this case.
  • There is a known issue with the model identification over CCID, see issue #147

Bugfixes

• nitrokey.nk3.secrets_app: Fix discarded authentication when using SecretsApp over CCID
• Fix SDK version check during firmware update to correctly handle release candidates

Other Changes

• Remove RPM specification file, associated Makefile target, and CI jobs.
• nitrokey.trussed.TrussedBase: Fix type annotations for __exit__ arguments so that all derived classes implement the contextlib.AbstractContextManager protocol.

All Changes

Release v1.25.16

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Add support for revision R2 of the NK3xN using the FM11NT082C NFC chip.
• admin-app:
  • Add model and board revision to status
  • Disable destructive reboot to bootloader
• Update applications (maintenance only):
  • admin-app v0.4.0
  • fido-authenticator v0.3.0
  • opcard v1.10.0
  • piv-authenticator v0.7.0
  • secrets-app v0.16.0

• nitrokey.trussed.admin_app: Add model and revision to AdminStatus