The GUI for everything the new HAL exposes, plus a reorganised
configuration surface:
- Applet screens: Accounts (OATH, live TOTP), Slots (OTP), PIV and OpenPGP
— ykman / Yubico-Authenticator-parity management, each gated by an
`AppletGate` (CCID off / applet disabled / not supported).
- Management screens: Audit (journal, checkpoint verify, on/off toggle),
Backup, Lock, Attestation and Offboard.
- Sidebar grouped into Device / Credentials / Protection / System sections,
with Offboard moved down to just above About.
- Configuration: an editable Manufacturer field; the effective LED pin /
driver and touch timeout shown as placeholders instead of a bare
"firmware default"; a single Apply that writes every changed domain in
one ceremony; Hardware Endpoints trimmed to the interfaces the firmware
actually builds (CCID/HID/KB); the LED-driver list without ESP32 on
RS-Key.
- Home surfaces the real firmware version, manufacturer, storage and the
effective LED / timeout values.
Host-side protocol layer for the full RS-Key applet and management
surface, each codec written against the current firmware's wire contract:
- CCID foundation: ISO-7816 APDU + BER-TLV codecs (`apdu/`), a persistent
`CcidSession` with 61xx/6Cxx assembly and CLA-chaining
(`transport/ccid.rs`), and a firmware-agnostic `AppletProfile`
(`firmwares/applets.rs`) so support gating is per-firmware, not baked in.
- Applet clients (`applets/`): OATH (YKOATH), OTP (YubiKey slots), PIV,
OpenPGP. OATH LIST / CALCULATE ALL page via SEND REMAINING (0xA5), not
ISO GET RESPONSE; PIV CHANGE REFERENCE sends the 8-byte-padded block and
supports the ykman `--protect` PIN-fetched management key (`MgmAuth`);
OTP pads the HMAC challenge to a 64-byte frame and threads a slot access
code through delete/swap.
- FIDO vendor management (`fido/{audit,backup}.rs`, `offboard.rs`): the
tamper-evident audit journal (read / verify / enable-disable via
`VENDOR_AUDIT_CONFIG`), seed backup, soft-lock, enterprise attestation
and offboard, over the CTAPHID 0x41 channel.
- Config over FIDO/rescue: the runtime manufacturer string (phy tag 0x0F),
the boot-effective LED pin/driver + touch timeout the device reports in
CONFIG_READ key 2, a single write orchestrator (`write_all_config`), and
treating an absent USB_ENABLED mask as all-enabled.
- Update nixpkgs channel from nixos-25.11 to nixos-26.05
- Bump actions/checkout from v6 to v7
- Bump cachix/cachix-action from v16 to v17
- Bump gepbird/nix-update-action from v2.1.1 to v3.1.0
- Remove schedule trigger from binary-cache workflow to avoid redundant builds (push to main already triggers the same cache)
Suyog Tandel
Maxim Muravev
jetcookies