Add basic config mechanism for fido2

This patch adds a basic config mechanism using the admin app.  The
configuration is loaded and applied during initialization.  The admin
app now has a special role, is constructed first and can no longer be
disabled.  Other applications can receive a reference to the
configuration loaded by the admin app.

To avoid overwriting configuration values for apps that are not enabled
in the current firmware, the components of the Config struct are not
feature-gated.  It could be simplified by using a derive macro but that
seems overcomplicated for a first implementation.

The first use case for the config mechanism is enabling or disabling
skipping the FIDO2 user presence check directly after boot.

Fixes: #344

.gitlab-ci.yml

@@ -67,6 +67,18 @@ check-usbip:
   after_script:
     - wget $icon_server/checkmark/$CI_COMMIT_REF_NAME/$CI_COMMIT_SHA/$CI_JOB_NAME/$CI_JOB_STATUS/${CI_JOB_URL#*/*/*/}
 
+test:
+  image: registry.git.nitrokey.com/nitrokey/nitrokey-3-firmware/nitrokey3:latest
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push"'
+  tags:
+    - docker
+  stage: build
+  script:
+    - cd components/apps && cargo test
+  after_script:
+    - wget $icon_server/checkmark/$CI_COMMIT_REF_NAME/$CI_COMMIT_SHA/$CI_JOB_NAME/$CI_JOB_STATUS/${CI_JOB_URL#*/*/*/}
+
 lint:
   image: registry.git.nitrokey.com/nitrokey/nitrokey-3-firmware/nitrokey3:latest
   rules:

Cargo.toml

@@ -12,10 +12,11 @@ version = "1.5.0-test.20230704"
 
 [patch.crates-io]
 # forked
-admin-app = { git = "https://github.com/Nitrokey/admin-app", tag = "v0.1.0-nitrokey.3" }
+admin-app = { git = "https://github.com/Nitrokey/admin-app", tag = "v0.1.0-nitrokey.4" }
 ctap-types = { git = "https://github.com/Nitrokey/ctap-types", rev = "42751efdc3c717135e8f26ceaa6ce23fb57d0498" }
 fido-authenticator = { git = "https://github.com/Nitrokey/fido-authenticator.git", rev = "0e3e56558505f5fdc755c41ff91727c20cdd3ba6" }
 flexiber = { git = "https://github.com/Nitrokey/flexiber", tag = "0.1.1.nitrokey" }
+iso7816 = { git = "https://github.com/Nitrokey/iso7816.git", tag = "v0.1.1-nitrokey.1"}
 lpc55-hal = { git = "https://github.com/Nitrokey/lpc55-hal", tag = "v0.3.0-nitrokey.2" }
 trussed = { git = "https://github.com/Nitrokey/trussed", tag = "v0.1.0-nitrokey.12" }
 
@@ -32,8 +33,7 @@ opcard = { git = "https://github.com/Nitrokey/opcard-rs", tag = "v1.1.1" }
 piv-authenticator = { git = "https://github.com/Nitrokey/piv-authenticator", tag = "v0.3.2" }
 trussed-auth = { git = "https://github.com/Nitrokey/trussed-auth", tag = "v0.2.2-nitrokey.1" }
 trussed-rsa-alloc = { git = "https://github.com/Nitrokey/trussed-rsa-backend.git", tag = "v0.1.0"}
-trussed-staging = { git = "https://github.com/Nitrokey/trussed-staging.git", branch = "hmacsha256p256" }
-iso7816 = { git = "https://github.com/Nitrokey/iso7816.git", tag = "v0.1.1-nitrokey.1" }
+trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", branch = "hmacsha256p256" }
 trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner.git", tag = "v0.0.1-nitrokey.2" }
 
 [profile.release]
@@ -51,4 +51,4 @@ inherits = "release"
 opt-level = 2
 
 [profile.release-thin-lto.package.salty]
-opt-level = 2
+opt-level = 2

components/apps/Cargo.toml

@@ -6,6 +6,7 @@ edition = "2021"
 [dependencies]
 apdu-dispatch = "0.1"
 ctaphid-dispatch = "0.1"
+serde = { version = "1.0.180", default-features = false }
 trussed = { version = "0.1", features = ["serde-extensions"]}
 trussed-usbip = { version = "0.0.1", default-features = false, features = ["ctaphid"], optional = true }
 usbd-ctaphid = { version = "0.1", optional = true }
@@ -26,15 +27,12 @@ opcard = { version = "1.1.1", features = ["apdu-dispatch", "delog", "rsa2048-gen
 piv-authenticator = { version = "0.3.1", features = ["apdu-dispatch", "delog"], optional = true }
 provisioner-app = { path = "../provisioner-app", optional = true }
 
+[dev-dependencies]
+cbor-smol = "0.4"
+hex = "0.4"
+
 [features]
-default = [
-    "admin-app",
-    "fido-authenticator",
-    "ndef-app",
-    "secrets-app",
-    "opcard",
-    "trussed/clients-4",
-]
+default = ["admin-app", "fido-authenticator", "ndef-app", "secrets-app", "opcard", "trussed/clients-4"]
 test = ["piv-authenticator", "webcrypt", "trussed/clients-6"]
 provisioner = ["provisioner-app", "trussed/clients-5"]
 
@@ -50,14 +48,7 @@ backend-auth = ["trussed-auth"]
 backend-rsa = ["trussed-rsa-alloc"]
 backend-staging = ["trussed-staging"]
 
-log-all = [
-    "admin-app?/log-all",
-    "fido-authenticator?/log-all",
-    "secrets-app?/log-all",
-    "webcrypt?/log-all",
-    "opcard?/log-all",
-    "provisioner-app?/log-all",
-]
+log-all = ["admin-app?/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 
 trussed-usbip-ccid = ["trussed-usbip/ccid"]