Upstream Nitrokey contributions

.gitignore

@@ -1,2 +1,4 @@
 /target
 Cargo.lock
+tarpaulin-report.html
+cobertura.xml

.gitlab-ci.yml

@@ -0,0 +1,47 @@
+include: 'https://raw.githubusercontent.com/Nitrokey/common-ci-jobs/master/common_jobs.yml'
+
+stages:
+  - pull-github
+  - build
+  - deploy
+
+variables:
+  GIT_STRATEGY: clone
+  GIT_DEPTH: 0
+  GIT_SUBMODULE_STRATEGY: recursive
+  REPO_NAME: piv-authenticator
+  MAIN_BRANCH: initial-refacto
+  COMMON_PULL: "true"
+  COMMON_UPLOAD_NIGHTLY: "false"
+  COMMON_GITHUB_RELEASE: "false"
+  COMMON_UPLOAD_FILES: "false"
+
+build:
+  image: registry.git.nitrokey.com/nitrokey/piv-authenticator/piv-authenticator-build:latest
+  rules:
+    - if: '$CI_PIPELINE_SHOULD_NOT_BUILD == "true"'
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "push"'
+    - if: '$CI_PIPELINE_SOURCE == "web"'
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+  tags:
+    - docker
+  stage: build
+  before_script:
+    - cargo --version
+  script:
+    - make ci
+  after_script:
+    - wget $icon_server/checkmark/$CI_COMMIT_REF_NAME/$CI_COMMIT_SHA/$CI_JOB_NAME/$CI_JOB_STATUS/${CI_JOB_URL#*/*/*/}
+    - cp /app/.cache/scdaemon.log scdaemon.log
+  coverage: '/^\d+.\d+% coverage/'
+  artifacts:
+    when: always
+    paths:
+      - "scdaemon.log"
+      - "cobertura.xml"
+      - "tarpaulin-report.html"
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: cobertura.xml

CHANGELOG.md

@@ -0,0 +1,72 @@
+# Changelog
+
+## [v0.3.4][] (2024-01-02)
+
+- Fix error when changing the PUK ([#40][])
+
+[#40]: https://github.com/Nitrokey/piv-authenticator/pull/40
+
+[v0.3.4]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.3.4
+
+## [v0.3.3][] (2023-12-08)
+
+- Reject NFC requests ([#39][])
+- Put RSA feature behind a feature flag
+
+[#39]: https://github.com/Nitrokey/piv-authenticator/pull/39
+
+[v0.3.3]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.3.3
+
+## [v0.3.2][] (2023-06-13)
+
+- Fix P-256 signature ([#33][])
+
+[#33]: https://github.com/Nitrokey/piv-authenticator/pull/33
+
+[v0.3.2]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.3.2
+
+## [v0.3.1][] (2023-06-02)
+
+- Add setter to the options builder for the UUID ([#32][])
+
+[#32]: https://github.com/Nitrokey/piv-authenticator/pull/32
+[v0.3.1]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.3.1
+
+## [v0.3.0][] (2023-05-31)
+
+- Fix reset not checking that the key is locked ([#29][])
+- Make GUID configurable ([#30][])
+
+[#30]: https://github.com/Nitrokey/piv-authenticator/pull/30
+[#29]: https://github.com/Nitrokey/piv-authenticator/pull/29
+
+[v0.3.0]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.3.0
+
+## [v0.2.0][] (2023-04-27)
+
+- Use upstream trussed and trussed-staging ([#24][])
+
+[#24]: https://github.com/Nitrokey/piv-authenticator/pull/24
+
+[v0.2.0]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.2.0
+
+## [v0.1.2][] (2023-04-24)
+
+- Use `RsaPublicParts::deserialize` instead of `trussed::postcard_deserialize` for compatibility with recent Trussed changes.
+
+[v0.1.2]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.1.2
+
+## [v0.1.1][] (2023-04-17)
+
+- Fix dependency on trussed-rsa-alloc to use the git tag in the `[patch.crates-io]` section to avoid duplicate downstream dependencies
+
+[v0.1.1]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.1.1
+
+## [v0.1.0][] (2023-04-13)
+
+This initial release contains support for the basic PIV card functionality.
+It supports basic card administration, key generation and authentication.
+
+Supported algorithms are P-256 and RSA 2048.
+
+[v0.1.0]: https://github.com/Nitrokey/piv-authenticator/releases/tag/v0.1.0

Cargo.toml

@@ -1,38 +1,90 @@
 [package]
 name = "piv-authenticator"
-version = "0.0.0-unreleased"
-authors = ["Nicolas Stalder <[email protected]>"]
-edition = "2018"
+version = "0.3.4"
+authors = ["Nicolas Stalder <[email protected]>", "Nitrokey GmbH"]
+edition = "2021"
 license = "Apache-2.0 OR MIT"
-repository = "https://github.com/solokeys/piv-authenticator"
+repository = "https://github.com/nitrokey/piv-authenticator"
 documentation = "https://docs.rs/piv-authenticator"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[[example]]
+name = "vpicc"
+required-features = ["vpicc"]
+
+
+[[example]]
+name = "usbip"
+required-features = ["apdu-dispatch", "virt"]
 
 [dependencies]
 apdu-dispatch = { version = "0.1", optional = true }
-delog = "0.1.0"
+delog = { version = "0.1.5", optional = true }
 flexiber = { version = "0.1", features = ["derive", "heapless"] }
 heapless = "0.7"
 hex-literal = "0.3"
-interchange = "0.2.0"
 iso7816 = "0.1"
-serde = { version = "1", default-features = false }
-trussed = { git = "https://github.com/trussed-dev/trussed" }
-# trussed = { path = "../../../trussed" }
-untrusted = "0.7"
+serde = { version = "1", default-features = false, features = ["derive"] }
+trussed = { version = "0.1", features = ["serde-extensions"] }
+trussed-auth = { version = "0.2" }
+untrusted = "0.9"
+vpicc = { version = "0.1.0", optional = true }
+log = "0.4"
+heapless-bytes = "0.3.0"
+subtle = { version = "2", default-features = false }
+trussed-rsa-alloc = { version = "0.1.0", features = ["raw"], optional = true }
+trussed-staging = { version = "0.1.0", features = ["chunked", "encrypted-chunked"]}
 
 [dev-dependencies]
-littlefs2 = "0.3.1"
+littlefs2 = "0.3.2"
 rand_core = { version = "0.6", features = ["getrandom"] }
+trussed = { version = "0.1.0", features = ["virt"] }
+env_logger = "0.9"
+serde = { version = "1", features = ["derive"] }
+serde_cbor = { version = "0.11", features = ["std"] }
+hex  = "0.4"
+test-log = "0.2.11"
+ron  = "0.8"
+des = "0.8"
+aes = "0.8.2"
+stoppable_thread = "0.2.1"
+expectrl = "0.6.0"
+
+# Examples
+# usbip
+trussed-usbip = { version = "0.0.1", default-features = false, features = ["ccid"] }
+usbd-ccid = { version = "0.2.0", features = ["highspeed-usb"]}
+rand = "0.8.5"
+asn1 = "0.15.2"
 
 [features]
 default = []
 strict-pin = []
+std = []
+vpicc = ["std", "dep:vpicc", "virt"]
+virt = ["std", "trussed/virt"]
+pivy-tests = []
+opensc-tests = []
+alloc = []
+rsa = ["trussed-rsa-alloc", "alloc"]
 
 log-all = []
 log-none = []
 log-info = []
 log-debug = []
 log-warn = []
 log-error = []
+
+[patch.crates-io]
+trussed = { git = "https://github.com/nitrokey/trussed" , tag = "v0.1.0-nitrokey.11" }
+trussed-auth = { git = "https://github.com/trussed-dev/trussed-auth.git", tag = "v0.2.2"}
+trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", tag = "v0.1.0"}
+trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging", tag = "v0.1.0" }
+apdu-dispatch = { git = "https://github.com/Nitrokey/apdu-dispatch", tag = "v0.1.2-nitrokey.2" }
+trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner.git", tag = "v0.0.1-nitrokey.1" }
+usbd-ccid = { git = "https://github.com/Nitrokey/usbd-ccid", tag = "v0.2.0-nitrokey.1" }
+
+[profile.dev.package.rsa]
+opt-level = 2
+
+[profile.dev.package.num-bigint-dig]
+opt-level = 2

LICENSES/CC0-1.0.txt

@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

Makefile

@@ -1,2 +1,35 @@
+.NOTPARALLEL:
+
+export RUST_LOG ?= info,cargo_tarpaulin=off
+TEST_FEATURES ?=vpicc,pivy-tests,opensc-tests,rsa
+
+.PHONY: build-cortex-m4
 build-cortex-m4:
 	cargo build --target thumbv7em-none-eabi
+
+.PHONY: test
+test:
+	cargo test --features $(TEST_FEATURES)
+
+.PHONY: check
+check:
+	RUSTLFAGS='-Dwarnings' cargo check --all-features --all-targets
+
+.PHONY: lint
+lint:
+	cargo fmt --check
+	cargo check --all-features --all-targets
+	cargo clippy --all-targets --all-features -- -Dwarnings
+	RUSTDOCFLAGS='-Dwarnings' cargo doc --all-features
+
+.PHONY: tarpaulin
+tarpaulin:
+	cargo tarpaulin --features $(TEST_FEATURES) -o Html -o Xml
+
+.PHONY: vpicc-example
+vpicc-example:
+	cargo run --example vpicc --features vpicc
+
+.PHONY: ci
+ci: lint tarpaulin
+