librekeys/pico-fido2
0
0
Fork 0
mirror of https://github.com/librekeys/pico-fido2.git synced 2026-07-28 08:01:47 -07:00
Code Issues Packages Projects Releases Wiki Activity

update licensing info for this fork of the community edition (#2)

Browse Source 
* cleanup licensing info for this fork of the community edition

* add licensing info of the project dependencies

* add missing add licensing info

* typo

* update license

* restore source files headers

* Use the new VID:PID allocated to Librekeys by OpenMoko

* doc cleanup

* doc cleanup
This commit is contained in:
Fabrice Bellamy
2026-02-27 19:36:35 +05:30
committed by GitHub
parent 75f5021399
commit f21d3198c2
7 changed files with 48 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/FUNDING.yml
-4
View File
@@ -1,4 +0,0 @@
# These are supported funding model platforms
github: polhenarejos
custom: ["https://www.paypal.me/polhenarejos"]
.github/PULL_REQUEST_TEMPLATE.md
+1 -4
View File
@@ -33,10 +33,7 @@ By checking the box below, you confirm ALL of the following:
- You are the author of this contribution, or you have the right to contribute it.
- You have read `CONTRIBUTING.md`.
- You agree that this contribution may be merged, used, modified, and redistributed:
- under the AGPLv3 Community Edition, **and**
- under any proprietary / commercial / Enterprise editions of this project,
now or in the future.
- You agree that this contribution may be merged, used, modified, and redistributed under the AGPLv3
- You understand that submitting this PR does not create any support obligation,
SLA, or guarantee of merge.
CMakeLists.txt
+3
View File
@@ -17,6 +17,9 @@
cmake_minimum_required(VERSION 3.13)
set(USB_VID 0x1D50)
set(USB_PID 0x619B)
if(ESP_PLATFORM)
set(DEBUG_APDU 1)
set(DENABLE_POWER_ON_RESET 0)
CONTRIBUTING.md
+4 -26
View File
@@ -2,28 +2,17 @@
Thank you for your interest in contributing to this project.
This repository is published in two forms:
- a Community Edition released under AGPLv3, and
- a proprietary / commercial / Enterprise Edition offered to organizations.
To keep that model legally clean, we need to be explicit about how contributions can be used.
This repository is published under AGPLv3
By opening a pull request, you agree to all of the following:
1. **You have the right to contribute this code.**
You are either the original author of the contribution, or you have obtained the necessary rights/permissions to contribute it under these terms.
2. **Dual licensing permission.**
2. **Licensing.**
You agree that your contribution may be:
- merged into this repository, and
- used, copied, modified, sublicensed, and redistributed
- under the AGPLv3 Community Edition, and
- under any proprietary / commercial / Enterprise editions of this project,
now or in the future.
In other words: you are granting the project maintainer(s) the right to include
your contribution in both the open-source (AGPLv3) codebase and in closed-source /
commercially licensed builds, without any additional approval or payment.
- used, copied, modified, sublicensed, and redistributed under the AGPLv3
3. **Attribution.**
The maintainers may keep or add attribution lines such as
@@ -36,14 +25,6 @@ By opening a pull request, you agree to all of the following:
service-level agreement, warranty, or guarantee that the contribution
will be reviewed, merged, or maintained.
5. **Potential rejection for business reasons.**
Features that fall under "Enterprise / Commercial" functionality
(e.g. multi-tenant provisioning at scale, centralized audit trails,
corporate policy enforcement, attestation/branding flows, key escrow / dual-control,
etc.) may be declined for the public AGPLv3 tree even if technically valid.
That is normal: some functionality is intentionally offered only
under commercial terms.
If you are not comfortable with these terms, **do not open a pull request yet.**
Instead, please open an Issue to start a discussion.
@@ -76,9 +57,6 @@ Please keep PRs focused (one logical change per PR if possible).
- impact on existing flows / security model
- any new dependencies
This helps avoid doing a bunch of work on something that won't be accepted
in the Community Edition.
### 4. Coding style / security posture
- Aim for clarity and small, auditable changes. This code runs in places
where secrets live.
@@ -91,7 +69,7 @@ in the Community Edition.
- In the PR description, please include a short summary of what was changed and why.
- At the bottom of the PR description, **copy/paste and confirm the licensing line below**:
> I confirm that I have read `CONTRIBUTING.md` and I agree that this contribution may be used under both the AGPLv3 Community Edition and any proprietary / commercial / Enterprise editions of this project, now or in the future.
> I confirm that I have read `CONTRIBUTING.md` and I agree to its terms
A PR without that confirmation may be delayed or closed without merge.
ENTERPRISE.md
-116
View File
@@ -1,116 +0,0 @@
# Enterprise / Commercial Edition
This project is offered under two editions:
## 1. Community Edition (FOSS)
The Community Edition is released under the GNU Affero General Public License v3 (AGPLv3).
Intended for:
- individual users and researchers
- evaluation / prototyping
- internal lab / security testing
You are allowed to:
- read and study the source code
- modify it
- run it internally
Obligations under AGPLv3:
- If you distribute modified firmware/binaries/libraries to third parties, you must provide the corresponding source code of your modifications.
- If you run a modified version of this project as a network-accessible service (internal or external), you must offer the source code of those modifications to the users of that service.
- No warranty, no support, no SLA.
- Enterprise features (bulk provisioning, multi-user policy enforcement, device inventory / revocation, corporate PIN rules, custom attestation/identity, etc.) are NOT included.
The Community Edition will continue to exist.
## 2. Enterprise / Commercial Edition
The Enterprise / Commercial Edition is a proprietary license for organizations that need to:
- deploy this in production at scale (multiple devices / multiple users / multiple teams)
- integrate it into their own physical product or appliance
- run it as an internal service (VM / container / private cloud "HSM / auth backend") for multiple internal teams or tenants
- enforce internal security policy (admin vs user roles, mandatory PIN rules, secure offboarding / revocation)
- avoid any AGPLv3 disclosure obligations for their own modifications and integration code
### What the Enterprise Edition provides
**Base license package (always included):**
- **Commercial license (proprietary).**
You may run and integrate the software/firmware in production — including virtualized / internal-cloud style deployments — without being required to disclose derivative source code under AGPLv3.
- **Official signed builds.**
You receive signed builds from the original developer so you can prove integrity and provenance.
- **Onboarding call (up to 1 hour).**
A live remote session to get you from "we have it" to "it’s actually running in our environment" with minimal guesswork.
**Optional enterprise components (available on demand, scoped and priced per customer):**
- **Production / multi-user readiness.**
Permission to operate the system with multiple users, multiple devices and multiple teams in real environments.
- **Bulk / fleet provisioning.**
Automated enrollment for many tokens/devices/users at once (CSV / directory import), scripted onboarding of new users, initial PIN assignment / reset workflows, and role-based access (admin vs user).
- **Policy & lifecycle tooling.**
Corporate PIN policy enforcement, per-user / per-team access control, device inventory / traceability, and secure revocation / retirement when someone leaves.
- **Custom attestation / per-organization identity.**
Per-company certificate chains and attestation keys so devices can prove "this token/HSM is officially ours," including anti-cloning / unique device identity for OEM and fleet use.
- **Virtualization / internal cloud deployment support.**
Guidance and components to run this as an internal service (VM, container, private-cloud HSM/auth backend) serving multiple internal teams or tenants under your brand.
- **Post-quantum (PQC) key material handling.**
Integration/roadmap support for PQC algorithms (auth / signing) and secure PQC key storage inside the device or service.
- **Hierarchical deterministic key derivation (HD).**
Wallet-style hierarchical key trees (BIP32-like concepts adapted to this platform) for issuing per-user / per-tenant / per-purpose subkeys without exporting the root secret — e.g. embedded wallet logic, tenant isolation, firmware signing trees, large fleets.
- **Cryptographically signed audit trail / tamper-evident event logging.**
High-assurance logging of sensitive actions (key use, provisioning, PIN resets, revocations) with integrity protection for forensic / compliance needs.
- **Dual-control / two-person approval ("four-eyes").**
Require multi-party authorization for high-risk actions such as firmware signing, key export, or critical configuration changes — standard in high-assurance / regulated environments.
- **Secure key escrow / disaster recovery design.**
Split-secret or escrowed backup strategies so you don’t lose critical signing keys if a single admin disappears or hardware is lost.
- **Release-signing / supply-chain hardening pipeline.**
Reference tooling and process so every production firmware/binary is signed with hardware-backed keys, proving origin and preventing tampering in transit or at manufacturing.
- **Policy-locked hardened mode ("FIPS-style profile").**
Restricted algorithms, debug disabled, no raw key export, tamper-evident configuration for regulated / high-assurance deployments.
- **Priority support / security response SLA.**
A direct line and guaranteed response window for production-impacting security issues.
- **White-label demo / pre-sales bundle.**
Branded demo firmware + safe onboarding script so you can show "your product" to your own customers without exposing real production secrets.
These components are NOT automatically bundled. They are available case-by-case depending on your use case and are priced separately.
### Licensing models
- **Internal Use License**
Internal production use within one legal entity (your company), including internal private cloud / virtualized deployments for multiple internal teams.
Optional enterprise components can be added as needed.
- **OEM / Redistribution / Service License**
Integration into a product/appliance you ship to customers, OR operating this as a managed service / hosted feature for external clients or third parties.
Optional enterprise components (attestation branding, PQC support, HD key derivation, multi-tenant service hardening, audit trail, etc.) can be added as required.
Pricing depends on scope, fleet size, number of users/tenants, regulatory requirements, and which optional components you select.
### Request a quote
Email: pol@henarejos.me
Subject: `ENTERPRISE LICENSE <your company name>`
Please include:
- Company name and country
- Intended use:
- Internal private deployment
- OEM / external service to third parties
- Approximate scale (number of devices/tokens, number of users/tenants)
- Which optional components you are interested in (bulk provisioning, policy & lifecycle tooling, attestation branding / anti-cloning, virtualization/cloud, PQC, HD key derivation, audit trail, dual-control, key escrow, supply-chain signing, hardened mode, SLA, white-label demo)
You will receive:
1. A short commercial license agreement naming your company.
2. Access to the base package (and any optional components agreed).
3. Scheduling of the onboarding call.
## Why Enterprise exists
- Companies often need hardware-backed security (HSM, FIDO2, OpenPGP, etc.) under their own control, but cannot or will not open-source their internal security workflows.
- They also need multi-user / fleet-management features that hobby users do not.
- The commercial license funds continued development, maintenance and new hardware support.
The Community Edition remains AGPLv3.
The Enterprise Edition is for production, scale, and legal clarity.
LICENSE
+24 -1
View File
@@ -1,3 +1,26 @@
This project is licensed under the GNU Affero General Public License v3
(AGPLv3). The full text of this license is reproduced at the bottom of
this document.
The copyright holders are indicated at the top of each file.
The project is using the following libraries, sdk or portions of code:
- mdebtls, licensed under Apache-2.0 and GPL-2.0-or-later licenses,
https://github.com/Mbed-TLS/mbedtls
- tinyUSB, licensed under the MIT License,
https://github.com/hathach/tinyusb
- tinycbor, licensed under the MIT license,
https://github.com/intel/tinycbor
- mlkem-native, the Apache-2.0 license OR the ISC license OR the MIT
license, https://github.com/pq-code-package/mlkem-native
- USB CCID from Raspberry Pi (Trading) Ltd, licensed under the
BSD-3-Clause license,
- Raspberry Pi Pico SDK, licensed under BSD 3-Clause "New" or "Revised"
License, https://github.com/raspberrypi/pico-sdk
- Espressif IoT Development Framework (ESP-IDF), licensed under Apache
License Version 2.0, https://github.com/espressif/esp-idf
________________________________________________________________________
GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
@@ -658,4 +681,4 @@ specific requirements.
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU AGPL, see
<https://www.gnu.org/licenses/>.
<https://www.gnu.org/licenses/>.
README.md
+16 -62
View File
@@ -1,6 +1,8 @@
# Pico FIDO2
This project transforms your Raspberry Pi Pico or ESP32 microcontroller into an integrated FIDO Passkey **and** OpenPGP smartcard, functioning like a standard USB Passkey for authentication and as a smartcard for cryptographic operations.
This project transforms your Raspberry RP235x or ESP32 microcontroller into an integrated FIDO Passkey **and** OpenPGP smartcard, functioning like a standard USB Passkey for authentication and as a smartcard for cryptographic operations.
This is a fork of the last community edition version of the pico-fido2 firmware, from December 9th 2025, that was available on https://github.com/polhenarejos/pico-fido2 before that repository was deleted and replaced by something else.
---
@@ -72,20 +74,6 @@ Microcontrollers RP2350 and ESP32-S3 are designed to support secure environments
---
## Download
**If you own an ESP32-S3 board, go to ESP32 Flasher for flashing your Pico FIDO2.**
If you own a Raspberry Pico (RP2040 or RP2350), go to the Download page, select your vendor and model and download the proper firmware; or go to the Release page and download the UF2 file for your board.
Note that UF2 files are shipped with a dummy VID/PID to avoid license issues (FEFF:FCFD). If you plan to use it with other proprietary tools, you should modify Info.plist of CCID driver to add these VID/PID or use the Pico Commissioner.
You can use whatever VID/PID (i.e., 234b:0000 from FISJ), but remember that you are not authorized to distribute the binary with a VID/PID that you do not own.
Note that the pure-browser option Pico Commissioner is the most recommended.
---
## Build for Raspberry Pico
Before building, ensure you have installed the toolchain for the Pico and that the Pico SDK is properly located on your drive.
@@ -96,11 +84,11 @@ git submodule update --init --recursive
cd pico-fido2
mkdir build
cd build
PICO_SDK_PATH=/path/to/pico-sdk cmake .. -DPICO_BOARD=board_type -DUSB_VID=0x1234 -DUSB_PID=0x5678
PICO_SDK_PATH=/path/to/pico-sdk cmake .. -DPICO_BOARD=board_type -DUSB_VID=0x1D50 -DUSB_PID=0x619B
make
```
Note that `PICO_BOARD`, `USB_VID` and `USB_PID` are optional. If not provided, `pico` board and VID/PID `FEFF:FCFD` will be used.
Note that `PICO_BOARD`, `USB_VID` and `USB_PID` are optional. If not provided, `pico` board and VID/PID `1D50:619B` will be used.
Additionally, you can pass the `VIDPID=value` parameter to build the firmware with a known VID/PID. The supported values are:
@@ -115,6 +103,9 @@ Additionally, you can pass the `VIDPID=value` parameter to build the firmware wi
- `Gnuk`
- `GnuPG`
You can use whatever VID/PID for your own personal use. **But remember that you are not authorized to distribute the binary with a VID/PID that you do not own.**
The VID/PID `1D50:619B` is provided to the project by [OpenMoko](https://wiki.openmoko.org/wiki/USB_Product_IDs). It can only be used for builds distributed under a free and open source license.
After running `make`, the binary file `pico_fido2.uf2` will be generated. To load this onto your Pico board:
1. Put the Pico board into loading mode by holding the `BOOTSEL` button while plugging it in.
@@ -122,53 +113,16 @@ After running `make`, the binary file `pico_fido2.uf2` will be generated. To loa
3. Once the file is copied, the Pico mass storage device will automatically disconnect, and the Pico board will reset with the new firmware.
4. A blinking LED will indicate that the device is ready to work.
## Driver
To configure your device you can use the [picoforge desktop application ](https://github.com/librekeys/picoforge).
## Drivers
Pico FIDO2 uses the `HID` driver for FIDO and `CCID` for OpenPGP, both present in all major operating systems. It should be detected by all OS and browser/applications just like normal USB FIDO keys and smartcards.
## License and Commercial Use
## License
This project is available under two editions:
This project is released under the GNU Affero General Public License v3 (AGPLv3).
A copy of the AGPLv3 license is available in the `LICENSE` file.
**Community Edition (FOSS)**
- Released under the GNU Affero General Public License v3 (AGPLv3).
- You are free to study, modify, and run the code, including for internal evaluation.
- If you distribute modified binaries/firmware, OR if you run a modified version of this project as a network-accessible service, you must provide the corresponding source code to the users of that binary or service, as required by AGPLv3.
- No warranty. No SLA. No guaranteed support.
**Enterprise / Commercial Edition**
- Proprietary license for organizations that want to:
- run this in production with multiple users/devices,
- integrate it into their own product/appliance,
- enforce corporate policies (PIN policy, admin/user roles, revocation),
- deploy it as an internal virtualized / cloud-style service,
- and *not* be required to publish derivative source code.
- Base package includes:
- commercial license (no AGPLv3 disclosure obligation for your modifications / integration)
- onboarding call
- access to officially signed builds
- Optional / on-demand enterprise components that can be added case-by-case:
- ability to operate in multi-user / multi-device environments
- device inventory, traceability and secure revocation/offboarding
- custom attestation, per-organization device identity / anti-cloning
- virtualization / internal "HSM or auth backend" service for multiple teams or tenants
- post-quantum (PQC) key material handling and secure PQC credential storage
- hierarchical deterministic key derivation (HD wallet–style key trees for per-user / per-tenant keys, firmware signing trees, etc.)
- cryptographically signed audit trail / tamper-evident logging
- dual-control / two-person approval for high-risk operations
- secure key escrow / disaster recovery strategy
- release-signing / supply-chain hardening toolchain
- policy-locked hardened mode ("FIPS-style profile")
- priority security-response SLA
- white-label demo / pre-sales bundle
Typical licensing models:
- Internal use (single legal entity, including internal private cloud / virtualized deployments).
- OEM / Redistribution / Service (ship in your product OR offer it as a service to third parties).
These options are scoped and priced individually depending on which components you actually need.
For commercial licensing and enterprise features, email pol@henarejos.me
Subject: `ENTERPRISE LICENSE <your company name>`
See `ENTERPRISE.md` for details.
## Credits
This project uses libraries and portion of code from other projects that are detailed in the `LICENSE` file.