Update to trussed v0.2.0-rc.1

.github/workflows/cd-test.yml

@@ -25,5 +25,7 @@ jobs:
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-publish-check-trussed-hpke') }}
     - run: cargo publish --dry-run --package trussed-manage
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-publish-check-trussed-manage') }}
+    - run: cargo publish --dry-run --package trussed-staging
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-publish-check-trussed-staging') }}
     - run: cargo publish --dry-run --package trussed-wrap-key-to-file
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-publish-check-trussed-wrap-key-to-file') }}

CHANGELOG.md

@@ -13,7 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 [Unreleased]: https://github.com/trussed-dev/trussed-staging/compare/v0.4.0...HEAD
 
--
+- Update to `trussed` v0.2.0-rc.1
 
 ## [0.4.0][] - 2026-03-23
 

Cargo.toml

@@ -43,7 +43,8 @@ hkdf = { version = "0.12", optional = true }
 rand_core = { version = "0.6.4", default-features = false }
 sha2 = { version = "0.10", default-features = false, optional = true }
 salty = { version = "0.3.0", default-features = false }
-trussed = { version = "0.1.0", default-features = false, features = ["serde-extensions"] }
+trussed = { version = "=0.2.0-rc.1", default-features = false, features = ["serde-extensions"] }
+trussed-core = "0.2"
 digest = { version = "0.10.7", default-features = false }
 hex-literal = { version = "0.4.0", optional = true }
 aead = { version = "0.5.2", optional = true, default-features = false }
@@ -60,7 +61,7 @@ heapless-bytes = { version = "0.5.0", optional = true }
 [dev-dependencies]
 hex-literal = "0.4.0"
 hmac = "0.12.0"
-trussed = { version = "0.1.0", default-features = false, features = ["aes256-cbc", "crypto-client", "filesystem-client", "hmac-sha256", "virt", "x255"] }
+trussed = { version = "=0.2.0-rc.1", default-features = false, features = ["aes256-cbc", "crypto-client", "filesystem-client", "hmac-sha256", "virt", "x255"] }
 
 [features]
 default = ["chunked"]
@@ -85,8 +86,6 @@ log-warn = []
 log-error = []
 
 [patch.crates-io]
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0b65280d69be541b8771f7756139826332c7d674" }
-
 trussed-chunked = { path = "extensions/chunked" }
 trussed-hkdf = { path = "extensions/hkdf" }
 trussed-hpke = { path = "extensions/hpke" }

src/chunked/mod.rs

@@ -9,19 +9,23 @@ use chacha20poly1305::{
     aead::stream::{DecryptorLE31, EncryptorLE31, Nonce as StreamNonce, StreamLE31},
     ChaCha8Poly1305, KeyInit,
 };
+use littlefs2_core::{Path, PathBuf};
 use rand_core::RngCore;
 use trussed::{
     config::MAX_MESSAGE_LENGTH,
     key::{Kind, Secrecy},
     serde_extensions::ExtensionImpl,
-    service::{Filestore, Keystore, ServiceResources},
-    store::Store,
-    types::{CoreContext, Location, Message, Path, PathBuf},
-    Bytes, Error,
+    service::ServiceResources,
+    store::{Filestore, Keystore, Store},
+    types::CoreContext,
 };
 use trussed_chunked::{
     reply, ChunkedExtension, ChunkedReply, ChunkedRequest, CHACHA8_STREAM_NONCE_LEN,
 };
+use trussed_core::{
+    types::{Bytes, Location, Message},
+    Error,
+};
 
 use crate::StagingContext;
 

src/chunked/store.rs

@@ -3,11 +3,13 @@
 
 use littlefs2_core::path;
 use littlefs2_core::FileOpenFlags;
+use littlefs2_core::Path;
+use littlefs2_core::PathBuf;
 use littlefs2_core::SeekFrom;
 
 use trussed::store::{create_directories, DynFile, DynFilesystem, Store};
-use trussed::types::{Bytes, Location, Message, Path, PathBuf};
-use trussed::Error;
+use trussed_core::types::{Bytes, Location, Message};
+use trussed_core::Error;
 
 use serde::{Deserialize, Serialize};
 

src/fs_info.rs

@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: CC0-1.0
 
 use trussed::{
-    platform::Store, serde_extensions::ExtensionImpl, service::ServiceResources,
-    types::CoreContext, Error, Platform,
+    serde_extensions::ExtensionImpl, service::ServiceResources, store::Store, types::CoreContext,
+    Platform,
 };
+use trussed_core::Error;
 use trussed_fs_info::{
     BlockInfo, FsInfoExtension, FsInfoExtensionReply, FsInfoExtensionRequest, FsInfoReply,
 };

src/hkdf.rs

@@ -7,10 +7,14 @@ use trussed::{
     config::MAX_MEDIUM_DATA_LENGTH,
     key::{Kind, Secrecy},
     serde_extensions::ExtensionImpl,
-    service::{ClientKeystore, Keystore, ServiceResources},
-    store::Store,
-    types::{Bytes, CoreContext, MediumData, ShortData},
-    Error, Platform,
+    service::ServiceResources,
+    store::{ClientKeystore, Keystore, Store},
+    types::CoreContext,
+    Platform,
+};
+use trussed_core::{
+    types::{Bytes, MediumData, ShortData},
+    Error,
 };
 use trussed_hkdf::{
     HkdfExpandReply, HkdfExpandRequest, HkdfExtension, HkdfExtractReply, HkdfExtractRequest,

src/hpke.rs

@@ -7,11 +7,9 @@ use trussed::{
     config::MAX_SERIALIZED_KEY_LENGTH,
     key,
     serde_extensions::ExtensionImpl,
-    service::Filestore,
-    store::keystore::Keystore,
-    types::{KeyId, Message},
-    Bytes,
+    store::{Filestore, Keystore},
 };
+use trussed_core::types::{Bytes, KeyId, Message};
 use trussed_hpke::*;
 
 type HkdfSha256 = hkdf::Hkdf<sha2::Sha256>;
@@ -309,13 +307,13 @@ fn open8(
 fn load_public_key(
     key_id: &KeyId,
     keystore: &mut impl Keystore,
-) -> Result<x25519::PublicKey, trussed::Error> {
+) -> Result<x25519::PublicKey, trussed_core::Error> {
     let public_bytes: [u8; 32] = keystore
         .load_key(key::Secrecy::Public, Some(key::Kind::X255), key_id)?
         .material
         .as_slice()
         .try_into()
-        .map_err(|_| trussed::Error::InternalError)?;
+        .map_err(|_| trussed_core::Error::InternalError)?;
     let public_key = x25519::PublicKey::from(public_bytes);
     Ok(public_key)
 }
@@ -323,13 +321,13 @@ fn load_public_key(
 fn load_secret_key(
     key_id: &KeyId,
     keystore: &mut impl Keystore,
-) -> Result<x25519::SecretKey, trussed::Error> {
+) -> Result<x25519::SecretKey, trussed_core::Error> {
     let secret_bytes: [u8; 32] = keystore
         .load_key(key::Secrecy::Secret, Some(key::Kind::X255), key_id)?
         .material
         .as_slice()
         .try_into()
-        .map_err(|_| trussed::Error::InternalError)?;
+        .map_err(|_| trussed_core::Error::InternalError)?;
     let secret_key = x25519::SecretKey::from_seed(&secret_bytes);
     Ok(secret_key)
 }
@@ -339,10 +337,12 @@ impl ExtensionImpl<HpkeExtension> for StagingBackend {
         &mut self,
         core_ctx: &mut trussed::types::CoreContext,
         _backend_ctx: &mut Self::Context,
-        request: &<HpkeExtension as trussed::serde_extensions::Extension>::Request,
+        request: &<HpkeExtension as trussed_core::serde_extensions::Extension>::Request,
         resources: &mut trussed::service::ServiceResources<P>,
-    ) -> Result<<HpkeExtension as trussed::serde_extensions::Extension>::Reply, trussed::Error>
-    {
+    ) -> Result<
+        <HpkeExtension as trussed_core::serde_extensions::Extension>::Reply,
+        trussed_core::Error,
+    > {
         let filestore = &mut resources.filestore(core_ctx.path.clone());
         let keystore = &mut resources.keystore(core_ctx.path.clone())?;
 
@@ -382,10 +382,10 @@ impl ExtensionImpl<HpkeExtension> for StagingBackend {
 
                 message
                     .extend_from_slice(&pk.to_bytes())
-                    .map_err(|_| trussed::Error::SignDataTooLarge)?;
+                    .map_err(|_| trussed_core::Error::SignDataTooLarge)?;
                 message
                     .extend_from_slice(&tag)
-                    .map_err(|_| trussed::Error::SignDataTooLarge)?;
+                    .map_err(|_| trussed_core::Error::SignDataTooLarge)?;
 
                 Ok(HpkeSealKeyReply { data: message }.into())
             }
@@ -410,10 +410,10 @@ impl ExtensionImpl<HpkeExtension> for StagingBackend {
 
                 message
                     .extend_from_slice(&pk.to_bytes())
-                    .map_err(|_| trussed::Error::SignDataTooLarge)?;
+                    .map_err(|_| trussed_core::Error::SignDataTooLarge)?;
                 message
                     .extend_from_slice(&tag)
-                    .map_err(|_| trussed::Error::SignDataTooLarge)?;
+                    .map_err(|_| trussed_core::Error::SignDataTooLarge)?;
                 filestore.write(&req.file, req.location, &message)?;
 
                 Ok(HpkeSealKeyToFileReply {}.into())
@@ -431,19 +431,23 @@ impl ExtensionImpl<HpkeExtension> for StagingBackend {
                     &mut ct,
                     req.tag.into(),
                 )
-                .map_err(|_| trussed::Error::AeadError)?;
+                .map_err(|_| trussed_core::Error::AeadError)?;
 
                 Ok(HpkeOpenReply { plaintext: ct }.into())
             }
             HpkeRequest::OpenKey(req) => {
                 let secret_key = load_secret_key(&req.key, keystore)?;
                 let mut ct = req.sealed_key.clone();
-                let (ct, tag) = ct.split_last_chunk_mut().ok_or(trussed::Error::AeadError)?;
-                let (ct, enc_bytes) = ct.split_last_chunk_mut().ok_or(trussed::Error::AeadError)?;
+                let (ct, tag) = ct
+                    .split_last_chunk_mut()
+                    .ok_or(trussed_core::Error::AeadError)?;
+                let (ct, enc_bytes) = ct
+                    .split_last_chunk_mut()
+                    .ok_or(trussed_core::Error::AeadError)?;
                 let enc = x25519::PublicKey::from(*enc_bytes);
 
                 open8(enc, secret_key, &req.info, &req.aad, ct, *tag)
-                    .map_err(|_| trussed::Error::AeadError)?;
+                    .map_err(|_| trussed_core::Error::AeadError)?;
 
                 let key::Key {
                     flags: _,
@@ -460,12 +464,16 @@ impl ExtensionImpl<HpkeExtension> for StagingBackend {
                 let secret_key = load_secret_key(&req.key, keystore)?;
                 let mut ct: Bytes<{ MAX_SERIALIZED_KEY_LENGTH + 32 + 16 }> =
                     filestore.read(&req.sealed_key, req.sealed_location)?;
-                let (ct, tag) = ct.split_last_chunk_mut().ok_or(trussed::Error::AeadError)?;
-                let (ct, enc_bytes) = ct.split_last_chunk_mut().ok_or(trussed::Error::AeadError)?;
+                let (ct, tag) = ct
+                    .split_last_chunk_mut()
+                    .ok_or(trussed_core::Error::AeadError)?;
+                let (ct, enc_bytes) = ct
+                    .split_last_chunk_mut()
+                    .ok_or(trussed_core::Error::AeadError)?;
                 let enc = x25519::PublicKey::from(*enc_bytes);
 
                 open8(enc, secret_key, &req.info, &req.aad, ct, *tag)
-                    .map_err(|_| trussed::Error::AeadError)?;
+                    .map_err(|_| trussed_core::Error::AeadError)?;
 
                 let key::Key {
                     flags: _,

src/manage.rs

@@ -2,12 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0 or MIT
 
 use littlefs2_core::{path, DirEntry, Path};
-use trussed::{
-    serde_extensions::{Extension, ExtensionImpl},
-    store::Store,
-    types::Location,
-    Error,
-};
+use trussed::{serde_extensions::ExtensionImpl, store::Store};
+use trussed_core::{serde_extensions::Extension, types::Location, Error};
 use trussed_manage::{
     FactoryResetClientReply, FactoryResetClientRequest, FactoryResetDeviceReply,
     FactoryResetDeviceRequest, ManageExtension, ManageReply, ManageRequest,
@@ -22,8 +18,8 @@ pub struct State {
     ///
     /// The path start all  start with the root. Here is an example such function:
     /// ```rust
-    ///# use trussed::types::{Path, Location};
-    ///# use littlefs2_core::path;
+    ///# use trussed_core::types::Location;
+    ///# use littlefs2_core::{path, Path};
     /// fn should_preserve(path: &Path, location: Location) -> bool {
     ///     (location == Location::Internal && path == path!("/client1/dat/to_save_internal"))
     ///         || (location == Location::External && path == path!("/client1/dat/to_save_external"))

src/virt.rs

@@ -3,8 +3,12 @@
 
 //! Wrapper around [`trussed::virt`][] that provides clients with both the core backend and the [`StagingBackend`] backend.
 
+use trussed_core::api::{reply, request, Reply, Request};
+
 #[cfg(feature = "manage")]
-use trussed::types::{Location, Path};
+use littlefs2_core::Path;
+#[cfg(feature = "manage")]
+use trussed_core::types::Location;
 
 #[cfg(feature = "chunked")]
 use trussed_chunked::ChunkedExtension;
@@ -131,9 +135,9 @@ impl ExtensionDispatch for Dispatcher {
         &mut self,
         _backend: &Self::BackendId,
         ctx: &mut trussed::types::Context<Self::Context>,
-        request: &trussed::api::Request,
+        request: &Request,
         resources: &mut trussed::service::ServiceResources<P>,
-    ) -> Result<trussed::Reply, Error> {
+    ) -> Result<Reply, Error> {
         self.backend
             .request(&mut ctx.core, &mut ctx.backends, request, resources)
     }
@@ -143,9 +147,9 @@ impl ExtensionDispatch for Dispatcher {
         _backend: &Self::BackendId,
         extension: &Self::ExtensionId,
         ctx: &mut trussed::types::Context<Self::Context>,
-        request: &trussed::api::request::SerdeExtension,
+        request: &request::SerdeExtension,
         resources: &mut trussed::service::ServiceResources<P>,
-    ) -> Result<trussed::api::reply::SerdeExtension, Error> {
+    ) -> Result<reply::SerdeExtension, Error> {
         let _ = &extension;
         let _ = &ctx;
         let _ = &request;
@@ -216,8 +220,9 @@ use trussed::{
     backend::{Backend, BackendId},
     serde_extensions::*,
     virt::{self, StoreConfig},
-    Error, Platform,
+    Platform,
 };
+use trussed_core::Error;
 
 pub type Client<'a, D = Dispatcher> = virt::Client<'a, D>;
 

src/wrap_key_to_file.rs

@@ -1,12 +1,17 @@
 // Copyright (C) Nitrokey GmbH
 // SPDX-License-Identifier: Apache-2.0 or MIT
 
+use chacha20poly1305::aead::generic_array::GenericArray;
 use trussed::{
     config::MAX_SERIALIZED_KEY_LENGTH,
     key::{self, Kind, Secrecy},
     serde_extensions::ExtensionImpl,
-    service::{Filestore, Keystore, ServiceResources},
-    types::{Bytes, CoreContext, GenericArray},
+    service::ServiceResources,
+    store::{Filestore, Keystore},
+    types::CoreContext,
+};
+use trussed_core::{
+    types::{Bytes, Mechanism},
     Error,
 };
 use trussed_wrap_key_to_file::{
@@ -24,10 +29,7 @@ fn wrap_key_to_file(
     filestore: &mut impl Filestore,
     request: &request::WrapKeyToFile,
 ) -> Result<reply::WrapKeyToFile, Error> {
-    if !matches!(
-        request.mechanism,
-        trussed::types::Mechanism::Chacha8Poly1305
-    ) {
+    if !matches!(request.mechanism, Mechanism::Chacha8Poly1305) {
         return Err(Error::MechanismInvalid);
     }
 
@@ -64,10 +66,7 @@ fn unwrap_key_from_file(
     filestore: &mut impl Filestore,
     request: &request::UnwrapKeyFromFile,
 ) -> Result<reply::UnwrapKeyFromFile, Error> {
-    if !matches!(
-        request.mechanism,
-        trussed::types::Mechanism::Chacha8Poly1305
-    ) {
+    if !matches!(request.mechanism, Mechanism::Chacha8Poly1305) {
         return Err(Error::MechanismInvalid);
     }
 

tests/chunked.rs

@@ -4,10 +4,9 @@
 #![cfg(all(feature = "virt", feature = "chunked"))]
 
 use littlefs2_core::{path, PathBuf};
-use trussed::{
-    client::FilesystemClient, syscall, try_syscall, types::Location, virt::StoreConfig, Bytes,
-};
+use trussed::virt::StoreConfig;
 use trussed_chunked::{utils, ChunkedClient};
+use trussed_core::{syscall, try_syscall, types::Bytes, types::Location, FilesystemClient};
 use trussed_staging::virt::with_client;
 
 fn test_write_all(location: Location) {

tests/encrypted-chunked.rs

@@ -5,14 +5,14 @@
 
 use littlefs2_core::{path, PathBuf};
 use serde_byte_array::ByteArray;
-use trussed::{
-    client::CryptoClient, client::FilesystemClient, syscall, try_syscall, types::Location,
-    virt::StoreConfig, Bytes, Error,
-};
+use trussed::virt::StoreConfig;
 use trussed_chunked::{
     utils::{self, EncryptionData},
     ChunkedClient,
 };
+use trussed_core::{
+    syscall, try_syscall, types::Bytes, types::Location, CryptoClient, Error, FilesystemClient,
+};
 use trussed_staging::virt::with_client;
 
 fn test_write_all(location: Location) {

tests/hkdf.rs

@@ -7,11 +7,11 @@ use hex_literal::hex;
 use hkdf::Hkdf;
 use hmac::{Hmac, Mac};
 use sha2::Sha256;
-use trussed::{
-    client::HmacSha256,
+use trussed::virt::StoreConfig;
+use trussed_core::{
+    mechanisms::HmacSha256,
     syscall,
     types::{Bytes, Location},
-    virt::StoreConfig,
 };
 use trussed_hkdf::{HkdfClient, KeyOrData::*};
 use trussed_staging::virt;

tests/hpke.rs

@@ -4,11 +4,12 @@
 #![cfg(all(feature = "virt", feature = "hpke"))]
 
 use littlefs2_core::path;
-use trussed::client::{CryptoClient, X255};
-use trussed::{
+use trussed::virt::StoreConfig;
+use trussed_core::{
+    mechanisms::X255,
     syscall,
     types::{Bytes, KeyId, Location, Mechanism, SignatureSerialization},
-    virt::StoreConfig,
+    CryptoClient,
 };
 
 use trussed_hpke::HpkeClient;

tests/manage.rs

@@ -4,10 +4,11 @@
 #![cfg(all(feature = "virt", feature = "manage"))]
 
 use littlefs2_core::path;
-use trussed::client::FilesystemClient;
-use trussed::syscall;
-use trussed::types::{Bytes, Location, Path};
+use littlefs2_core::Path;
 use trussed::virt::StoreConfig;
+use trussed_core::syscall;
+use trussed_core::types::{Bytes, Location};
+use trussed_core::FilesystemClient;
 use trussed_manage::ManageClient;
 use trussed_staging::virt::with_clients_and_preserve;
 

tests/wrap_key_to_file.rs

@@ -4,13 +4,13 @@
 #![cfg(all(feature = "virt", feature = "wrap-key-to-file"))]
 
 use littlefs2_core::path;
-use trussed::client::CryptoClient;
-use trussed::syscall;
-use trussed::types::{
-    KeyId, KeySerialization, Location::*, Mechanism, PathBuf, SignatureSerialization,
-    StorageAttributes,
-};
+use littlefs2_core::PathBuf;
 use trussed::virt::StoreConfig;
+use trussed_core::syscall;
+use trussed_core::types::{
+    KeyId, KeySerialization, Location::*, Mechanism, SignatureSerialization, StorageAttributes,
+};
+use trussed_core::CryptoClient;
 
 use trussed_staging::virt::with_client;