Updated README to reflect maintenance status (#660)

* Updated README to reflect maintenance status

This PR is to be merged after the branches are reworked.

* FIDO -> CTAP

* Wording change to default branch

.github/actions-rs/grcov.yml

@@ -0,0 +1,9 @@
+branch: true
+ignore-not-existing: true
+llvm: true
+filter: covered
+output-type: lcov
+output-path: ./lcov.info
+ignore:
+  - "third_party/*"
+  - "/*"

.github/workflows/boards_build.yml

@@ -1,39 +0,0 @@
----
-name: Build supported boards
-on:
-  push:
-    paths:
-     - 'patches/tock/*'
-     - 'third_party/tock/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  build_boards:
-    strategy:
-      matrix:
-        os: [ubuntu-18.04, macos-10.15]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Building board nrf52840dk
-        run: ./deploy.py --board=nrf52840dk --no-app --programmer=none
-      - name: Building board nrf52840_dongle
-        run: ./deploy.py --board=nrf52840_dongle --no-app --programmer=none
-      - name: Building board nrf52840_dongle_dfu
-        run: ./deploy.py --board=nrf52840_dongle_dfu --no-app --programmer=none
-      - name: Building board nrf52840_mdk_dfu
-        run: ./deploy.py --board=nrf52840_mdk_dfu --no-app --programmer=none

.github/workflows/cargo_audit.yml

@@ -1,26 +0,0 @@
-name: Security audit
-on:
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  audit:
-    runs-on: ubuntu-18.04
-    if: github.repository == 'google/OpenSK'
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-      - uses: actions-rs/audit-check@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cargo_check.yml

@@ -1,97 +0,0 @@
-name: Cargo check
-on:
-  push:
-    paths:
-      - 'examples/*.rs'
-      - 'libraries/**/*.rs'
-      - 'src/**/*.rs'
-      - 'patches/**'
-      - '**/Cargo.toml'
-      - '.cargo/config'
-      - '!third_party/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  cargo_check:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Check OpenSK w/o features
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release
-
-      - name: Check OpenSK with_ctap1
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features with_ctap1
-
-      - name: Check OpenSK with_ctap2_1
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features with_ctap2_1
-
-      - name: Check OpenSK debug_ctap
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features debug_ctap
-
-      - name: Check OpenSK panic_console
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features panic_console
-
-      - name: Check OpenSK debug_allocations
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features debug_allocations
-
-      - name: Check OpenSK verbose
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features verbose
-
-      - name: Check OpenSK debug_ctap,with_ctap1
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features debug_ctap,with_ctap1
-
-      - name: Check OpenSK debug_ctap,with_ctap2_1
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features debug_ctap,with_ctap2_1
-
-      - name: Check OpenSK debug_ctap,with_ctap1,with_ctap2_1,panic_console,debug_allocations,verbose
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --features debug_ctap,with_ctap1,with_ctap2_1,panic_console,debug_allocations,verbose
-
-      - name: Check examples
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --target thumbv7em-none-eabi --release --examples

.github/workflows/cargo_clippy.yml

@@ -1,32 +0,0 @@
----
-name: Cargo Clippy
-on:
-  push:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  cargo_clippy:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-          components: clippy
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - uses: actions-rs/clippy-check@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-targets --features std
-      - name: Deny Clippy warnings
-        run: cargo clippy --all-targets --features std -- -A clippy::new_without_default -D warnings

.github/workflows/cargo_fmt.yml

@@ -1,75 +0,0 @@
-name: Cargo format
-on:
-  push:
-    paths:
-      - 'examples/*.rs'
-      - 'libraries/**/*.rs'
-      - 'src/**/*.rs'
-      - 'tools/**/*.rs'
-      - 'patches/**'
-      - '**/Cargo.toml'
-      - '.cargo/config'
-      - '!third_party/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  cargo_format:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-          components: rustfmt
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Cargo format src/
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
-
-      - name: Cargo format fuzz/
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path fuzz/Cargo.toml --all -- --check
-
-      - name: Cargo format libraries/cbor
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path libraries/cbor/Cargo.toml --all -- --check
-
-      - name: Cargo format libraries/cbor/fuzz
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path libraries/cbor/fuzz/Cargo.toml --all -- --check
-
-      - name: Cargo format libraries/crypto
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path libraries/crypto/Cargo.toml --all -- --check
-
-      - name: Cargo format libraries/persistent_store
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path libraries/persistent_store/Cargo.toml --all -- --check
-
-      - name: Cargo format tools/heapviz
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path tools/heapviz/Cargo.toml --all -- --check

.github/workflows/cargo_fuzz.yml

@@ -1,33 +0,0 @@
----
-name: Cargo fuzz build
-on:
-  push:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  build_fuzzing:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-      - name: Set up fuzzing
-        run: ./fuzzing_setup.sh
-
-      - name: Cargo fuzz build
-        run: cargo fuzz build
-      - name: Cargo fuzz build (libraries/cbor)
-        run: cd libraries/cbor && cargo fuzz build && cd ../..
-      - name: Cargo fuzz build (libraries/persistent_store)
-        run: cd libraries/persistent_store && cargo fuzz build && cd ../..

.github/workflows/cbor_test.yml

@@ -1,38 +0,0 @@
----
-name: CBOR tests
-on:
-  push:
-    paths:
-      - 'libraries/cbor/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  cbor_test:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Unit testing of CBOR library (release mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path libraries/cbor/Cargo.toml --release --features std
-
-      - name: Unit testing of CBOR library (debug mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path libraries/cbor/Cargo.toml --features std

.github/workflows/crypto_test.yml

@@ -1,42 +0,0 @@
----
-name: Crypto library tests
-on:
-  push:
-    paths:
-      - 'libraries/crypto/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'libraries/crypto/**'
-
-jobs:
-  crypto_test:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - run: echo "RUSTFLAGS=-C target-feature=+aes" >> $GITHUB_ENV
-
-      - name: Unit testing of crypto library (release mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path libraries/crypto/Cargo.toml --release --features std,derive_debug
-
-      - name: Unit testing of crypto library (debug mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path libraries/crypto/Cargo.toml --features std,derive_debug

.github/workflows/heapviz_test.yml

@@ -1,34 +0,0 @@
----
-name: Heapviz tool tests
-on:
-  push:
-    paths:
-      - 'tools/heapviz/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  heapviz_test:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-      - name: Install ncurses
-        run: sudo apt-get install libncurses-dev
-
-      - name: Check heapviz tool
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --manifest-path tools/heapviz/Cargo.toml
-
-      - name: Unit testing of heapviz tool (debug mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path tools/heapviz/Cargo.toml
-
-      - name: Unit testing of heapviz tool (release mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path tools/heapviz/Cargo.toml --release

.github/workflows/mdlint.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   mdlint:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - name: markdownlint-cli

.github/workflows/opensk_build.yml

@@ -1,41 +0,0 @@
----
-name: OpenSK build
-on:
-  push:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  build_ctap2:
-    strategy:
-      matrix:
-        os: [ubuntu-18.04, macos-10.15]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Building sha256sum tool
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --manifest-path third_party/tock/tools/sha256sum/Cargo.toml
-
-      - name: Building OpenSK
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --release --target=thumbv7em-none-eabi --features with_ctap1
-      - name: Compute SHA-256 sum
-        run: ./third_party/tock/tools/sha256sum/target/debug/sha256sum target/thumbv7em-none-eabi/release/ctap2

.github/workflows/opensk_test.yml

@@ -1,77 +0,0 @@
----
-name: OpenSK tests
-on:
-  push:
-    paths:
-      - 'src/**/*.rs'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  ctap2_test:
-    name: CTAP2 unit tests
-    runs-on: ubuntu-18.04
-
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Unit testing of CTAP2 (release mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --release --features std
-
-      - name: Unit testing of CTAP2 (debug mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --features std
-
-      - name: Unit testing of CTAP2 (release mode + CTAP1)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --release --features std,with_ctap1
-
-      - name: Unit testing of CTAP2 (debug mode + CTAP1)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --features std,with_ctap1
-
-      - name: Unit testing of CTAP2 (release mode + CTAP2.1)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --release --features std,with_ctap2_1
-
-      - name: Unit testing of CTAP2 (debug mode + CTAP2.1)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --features std,with_ctap2_1
-
-      - name: Unit testing of CTAP2 (release mode + CTAP1 + CTAP2.1)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --release --features std,with_ctap1,with_ctap2_1
-
-      - name: Unit testing of CTAP2 (debug mode + CTAP1 + CTAP2.1)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --features std,with_ctap1,with_ctap2_1
-

.github/workflows/persistent_store_test.yml

@@ -1,26 +0,0 @@
----
-name: Persistent store tests
-on:
-  push:
-    paths:
-      - 'libraries/peristent_store/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  persistent_store_test:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Unit testing of Persistent store library (release mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path libraries/persistent_store/Cargo.toml --release --features std
-
-      - name: Unit testing of Persistent store library (debug mode)
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path libraries/persistent_store/Cargo.toml --features std

.github/workflows/python.yml

@@ -1,46 +0,0 @@
-name: pylint
-on:
-  push:
-    paths:
-      - '**/*.py'
-      - '.pylintrc'
-      - '!third_party/**'
-  pull_request:
-    types: [opened, synchronize, reopened]
-jobs:
-  pylint:
-    runs-on: ubuntu-18.04
-    strategy:
-      matrix:
-        python-version: [3.6, 3.7, 3.8]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v1
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip setuptools wheel
-          pip install 'tockloader==1.5' pylint
-      - name: Register matcher
-        run: echo ::add-matcher::./.github/python_matcher.json
-      - name: Test code with pylint
-        run: ./tools/run_pylint.sh
-
-  yapf:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-      - name: Set up Python 3.7
-        uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip setuptools wheel
-          pip install 'yapf>=0.30.0' tockloader
-      - name: Test code formatting with yapf
-        run: |
-          echo ::add-matcher::./.github/python_matcher.json
-          yapf --style=yapf --recursive --exclude third_party --diff .

.github/workflows/reproducible.yml

@@ -1,46 +0,0 @@
----
-name: Check that binaries are reproducible
-on:
-  push:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  check_hashes:
-    strategy:
-      matrix:
-        os: [ubuntu-18.04, macos-10.15]
-      fail-fast: false
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: "true"
-      - uses: actions-rs/toolchain@v1
-        with:
-          target: thumbv7em-none-eabi
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.7
-      - name: Install Python dependencies
-        run: python -m pip install --upgrade pip setuptools wheel
-      - name: Set up OpenSK
-        run: ./setup.sh
-
-      - name: Use sample cryptographic material
-        run: rm -R crypto_data/ && cp -r reproducible/sample_crypto_data crypto_data
-      - name: Computing cryptographic hashes
-        run: ./reproduce_hashes.sh
-
-      - name: Upload reproduced binaries
-        uses: actions/upload-artifact@v1
-        with:
-          name: reproduced-${{ matrix.os }}
-          path: reproducible/reproduced.tar
-
-      - name: Comparing binary sizes
-        if: always()
-        run: git diff --no-index reproducible/reference_elf2tab_${{ matrix.os }}.txt reproducible/elf2tab.txt || true
-      - name: Comparing cryptographic hashes
-        if: always()
-        run: git diff --no-index reproducible/reference_binaries_${{ matrix.os }}.sha256sum reproducible/binaries.sha256sum || true

.gitignore

@@ -1,5 +1,4 @@
 target/
-Cargo.lock
 
 # Local installation of elf2tab.
 /elf2tab/

Cargo.lock

@@ -0,0 +1,574 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "aho-corasick"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "arrayref"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
+
+[[package]]
+name = "autocfg"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dde43e75fd43e8a1bf86103336bc699aa8d17ad1be60c76c0bdfd4828e19b78"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bumpalo"
+version = "3.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1e260c3a9040a7c19a12468758f4c16f31a81a1fe087482be9570ec864bb6c"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cbor"
+version = "0.1.0"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cloudabi"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "crypto"
+version = "0.1.0"
+dependencies = [
+ "arrayref",
+ "byteorder",
+ "cbor",
+ "hex",
+ "libtock_drivers",
+ "rand",
+ "regex",
+ "ring",
+ "serde",
+ "serde_json",
+ "subtle",
+ "untrusted",
+]
+
+[[package]]
+name = "ctap2"
+version = "1.0.0"
+dependencies = [
+ "arrayref",
+ "byteorder",
+ "cbor",
+ "crypto",
+ "enum-iterator",
+ "lang_items",
+ "libtock_core",
+ "libtock_drivers",
+ "persistent_store",
+ "subtle",
+ "uuid",
+]
+
+[[package]]
+name = "enum-iterator"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c79a6321a1197d7730510c7e3f6cb80432dfefecb32426de8cea0aa19b4bb8d7"
+dependencies = [
+ "enum-iterator-derive",
+]
+
+[[package]]
+name = "enum-iterator-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e94aa31f7c0dc764f57896dc615ddd76fc13b0d5dca7eb6cc5e018a5a09ec06"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "getrandom"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "805026a5d0141ffc30abb3be3173848ad46a1b1664fe632428479619a3644d77"
+
+[[package]]
+name = "itoa"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lang_items"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+ "libtock_drivers",
+ "linked_list_allocator",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.134"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
+
+[[package]]
+name = "libtock_codegen"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libtock_core"
+version = "0.1.0"
+dependencies = [
+ "libtock_codegen",
+]
+
+[[package]]
+name = "libtock_drivers"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+]
+
+[[package]]
+name = "linked_list_allocator"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "822add9edb1860698b79522510da17bef885171f75aa395cff099d770c609c24"
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "once_cell"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f7254b99e31cad77da24b08ebf628882739a608578bb1bcdfc1f9c21260d7c0"
+
+[[package]]
+name = "persistent_store"
+version = "0.1.0"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
+dependencies = [
+ "autocfg 0.1.8",
+ "libc",
+ "rand_chacha",
+ "rand_core 0.4.2",
+ "rand_hc",
+ "rand_isaac",
+ "rand_jitter",
+ "rand_os",
+ "rand_pcg",
+ "rand_xorshift",
+ "winapi",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556d3a1ca6600bfcbab7c7c91ccb085ac7fbbcd70e008a98742e7847f4f7bcef"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_hc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b40677c7be09ae76218dc623efbf7b18e34bced3f38883af07bb75630a21bc4"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_isaac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded997c9d5f13925be2a6fd7e66bf1872597f759fd9dd93513dd7e92e5a5ee08"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_jitter"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1166d5c91dc97b88d1decc3285bb0a99ed84b05cfd0bc2341bdf2d43fc41e39b"
+dependencies = [
+ "libc",
+ "rand_core 0.4.2",
+ "winapi",
+]
+
+[[package]]
+name = "rand_os"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b75f676a1e053fc562eafbb47838d67c84801e38fc1ba459e8f180deabd5071"
+dependencies = [
+ "cloudabi",
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.4.2",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abf9b09b01790cfe0364f52bf32995ea3c39f4d2dd011eac241d2914146d0b44"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbf7e9e623549b0e21f6e97cf8ecf247c1a8fd2e8a992ae265314300b2455d5c"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"
+
+[[package]]
+name = "serde"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728eb6351430bccb993660dfffc5a72f91ccc1295abaa8ce19b27ebe4f75568b"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81fa1584d3d1bcacd84c277a0dfe21f5b0f6accf4a23d04d4c6d61f1af522b4c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41feea4228a6f1cd09ec7a3593a682276702cd67b5273544757dae23c096f074"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "subtle"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+
+[[package]]
+name = "syn"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e90cde112c4b9690b8cbe810cba9ddd8bc1d7472e2cae317b69e9438c1cba7d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "web-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

Cargo.toml

@@ -31,7 +31,6 @@ with_ctap2_1 = []
 with_nfc = ["libtock_drivers/with_nfc"]
 
 [dev-dependencies]
-elf2tab = "0.6.0"
 enum-iterator = "0.6.0"
 
 [build-dependencies]

README.md

@@ -1,202 +1,75 @@
 # <img alt="OpenSK logo" src="docs/img/OpenSK.svg" width="200px">
 
-![markdownlint](https://github.com/google/OpenSK/workflows/markdownlint/badge.svg?branch=master)
-![pylint](https://github.com/google/OpenSK/workflows/pylint/badge.svg?branch=master)
-![Cargo check](https://github.com/google/OpenSK/workflows/Cargo%20check/badge.svg?branch=master)
-![Cargo format](https://github.com/google/OpenSK/workflows/Cargo%20format/badge.svg?branch=master)
+This branch is unmaintained. It implements the CTAP 2.0 version of OpenSK.
+Please check out the default branch for maintained code.
+If you are a developer, go to the
+[develop branch](https://github.com/google/OpenSK/tree/develop).
 
 ## OpenSK
 
 This repository contains a Rust implementation of a
 [FIDO2](https://fidoalliance.org/fido2/) authenticator.
+We developed OpenSK as a [Tock OS](https://tockos.org) application.
 
-We developed this as a [Tock OS](https://tockos.org) application and it has been
-successfully tested on the following boards:
-
-*   [Nordic nRF52840-DK](https://www.nordicsemi.com/Software-and-Tools/Development-Kits/nRF52840-DK)
-*   [Nordic nRF52840-dongle](https://www.nordicsemi.com/Software-and-Tools/Development-Kits/nRF52840-Dongle)
-
-## Disclaimer
-
-This project is **proof-of-concept and a research platform**. It is **NOT**
-meant for a daily usage. It's still under development and as such comes with a
-few limitations:
+We intend to bring a full open source experience to security keys, from
+application to operating system. You can even 3D print your own open source
+enclosure!
+You can see OpenSK in action in this
+[video on YouTube](https://www.youtube.com/watch?v=klEozvpw0xg)!
 
 ### FIDO2
 
-Although we tested and implemented our firmware based on the published
-[CTAP2.0 specifications](https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html),
-our implementation was not reviewed nor officially tested and doesn't claim to
-be FIDO Certified.
-We started adding features of the upcoming next version of the
-[CTAP2.1 specifications](https://fidoalliance.org/specs/fido2/fido-client-to-authenticator-protocol-v2.1-rd-20191217.html).
-The development is currently between 2.0 and 2.1, with updates hidden behind
-a feature flag.
-Please add the flag `--ctap2.1` to the deploy command to include them.
+This branch implements the
+[CTAP2.0 specification](https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html)
+and is FIDO certified. OpenSK supports U2F, and non-discoverable credentials
+created with either protocol are compatible with the other.
 
-### Cryptography
+### :warning: Disclaimer
 
-We're currently still in the process on making the
+This project is **proof-of-concept and a research platform**. It is **NOT**
+meant for a daily usage. The cryptography implementations are not resistent
+against side-channel attacks.
+
+We're still in the process of integrating the
 [ARM&reg; CryptoCell-310](https://developer.arm.com/ip-products/security-ip/cryptocell-300-family)
 embedded in the
 [Nordic nRF52840 chip](https://infocenter.nordicsemi.com/index.jsp?topic=%2Fps_nrf52840%2Fcryptocell.html)
-work to get hardware-accelerated cryptography. In the meantime we implemented
-the required cryptography algorithms (ECDSA, ECC secp256r1, HMAC-SHA256 and
-AES256) in Rust as a placeholder. Those implementations are research-quality
-code and haven't been reviewed. They don't provide constant-time guarantees and
-are not designed to be resistant against side-channel attacks.
+to enable hardware-accelerated cryptography. Our placeholder implementations of required
+cryptography algorithms (ECDSA, ECC secp256r1, HMAC-SHA256 and AES256) in Rust are research-quality
+code. They haven't been reviewed and don't provide constant-time guarantees.
+
+## Hardware
+
+You will need one the following supported boards:
+
+*   [Nordic nRF52840-DK](https://www.nordicsemi.com/Software-and-Tools/Development-Kits/nRF52840-DK)
+    development kit. This board is more convenient for development and debug
+    scenarios as the JTAG probe is already on the board.
+*   [Nordic nRF52840 Dongle](https://www.nordicsemi.com/Software-and-tools/Development-Kits/nRF52840-Dongle)
+    to have a more practical form factor.
+*   [Makerdiary nRF52840-MDK USB dongle](https://wiki.makerdiary.com/nrf52840-mdk/).
+*   [Feitian OpenSK dongle](https://feitiantech.github.io/OpenSK_USB/).
 
 ## Installation
 
-For a more detailed guide, please refer to our
-[installation guide](docs/install.md).
+To install OpenSK,
+1.  follow the [general setup steps](docs/install.md),
+1.  then continue with the instructions for your specific hardware:
+	* [Nordic nRF52840-DK](docs/boards/nrf52840dk.md)
+	* [Nordic nRF52840 Dongle](docs/boards/nrf52840_dongle.md)
+	* [Makerdiary nRF52840-MDK USB dongle](docs/boards/nrf52840_mdk.md)
+	* [Feitian OpenSK dongle](docs/boards/nrf52840_feitian.md)
 
-1.  If you just cloned this repository, run the following script (**Note**: you
-    only need to do this once):
-
-    ```shell
-    ./setup.sh
-    ```
-
-1.  Next step is to install Tock OS as well as the OpenSK application on your
-    board. Run:
-
-    ```shell
-    # Nordic nRF52840-DK board
-    ./deploy.py --board=nrf52840dk --opensk
-    # Nordic nRF52840-Dongle
-    ./deploy.py --board=nrf52840_dongle --opensk
-    ```
-
-1.  Finally you need to inject the cryptographic material if you enabled
-    batch attestation or CTAP1/U2F compatibility (which is the case by
-    default):
-
-    ```shell
-    ./tools/configure.py \
-        --certificate=crypto_data/opensk_cert.pem \
-        --private-key=crypto_data/opensk.key
-    ```
-
-1.  On Linux, you may want to avoid the need for `root` privileges to interact
-    with the key. For that purpose we provide a udev rule file that can be
-    installed with the following command:
-
-    ```shell
-    sudo cp rules.d/55-opensk.rules /etc/udev/rules.d/ &&
-    sudo udevadm control --reload
-    ```
-
-### Customization
-
-If you build your own security key, depending on the hardware you use, there are
-a few things you can personalize:
-
-1.  If you have multiple buttons, choose the buttons responsible for user
-    presence in `main.rs`.
-2.  Decide whether you want to use batch attestation. There is a boolean flag in
-    `ctap/mod.rs`. It is mandatory for U2F, and you can create your own
-    self-signed certificate. The flag is used for FIDO2 and has some privacy
-    implications. Please check
-    [WebAuthn](https://www.w3.org/TR/webauthn/#attestation) for more
-    information.
-3.  Decide whether you want to use signature counters. Currently, only global
-    signature counters are implemented, as they are the default option for U2F.
-    The flag in `ctap/mod.rs` only turns them off for FIDO2. The most privacy
-    preserving solution is individual or no signature counters. Again, please
-    check [WebAuthn](https://www.w3.org/TR/webauthn/#signature-counter) for
-    documentation.
-4.  Depending on your available flash storage, choose an appropriate maximum
-    number of supported residential keys and number of pages in
-    `ctap/storage.rs`.
-5.  Change the default level for the credProtect extension in `ctap/mod.rs`.
-    When changing the default, resident credentials become undiscoverable without
-    user verification. This helps privacy, but can make usage less comfortable
-    for credentials that need less protection.
-6.  Increase the default minimum length for PINs in `ctap/storage.rs`.
-    The current minimum is 4. Values from 4 to 63 are allowed. Requiring longer
-    PINs can help establish trust between users and relying parties. It makes
-    user verification harder to break, but less convenient.
-    NIST recommends at least 6-digit PINs in section 5.1.9.1:
-    https://pages.nist.gov/800-63-3/sp800-63b.html
-    You can add relying parties to the list of readers of the minimum PIN length.
-
-### 3D printed enclosure
-
-To protect and carry your key, we partnered with a professional designer and we
-are providing a custom enclosure that can be printed on both professional 3D
-printers and hobbyist models.
-
-All the required files can be downloaded from
-[Thingiverse](https://www.thingiverse.com/thing:4132768) including the STEP
-file, allowing you to easily make the modifications you need to further
-customize it.
-
-## Development and testing
-
-### Printing panic messages to the console
-
-By default, libtock-rs blinks some LEDs when the userspace application panicks.
-This is not always convenient as the panic message is lost. In order to enable
-a custom panic handler that first writes the panic message via Tock's console
-driver, before faulting the app, you can use the `--panic-console` flag of the
-`deploy.py` script.
-
-```shell
-# Example on Nordic nRF52840-DK board
-./deploy.py --board=nrf52840dk --opensk --panic-console
-```
-
-### Debugging memory allocations
-
-You may want to track memory allocations to understand the heap usage of
-OpenSK. This can be useful if you plan to port it to a board with fewer
-available RAM for example. To do so, you can enable the `--debug-allocations`
-flag of the `deploy.py` script. This enables a custom (userspace) allocator
-that prints a message to the console for each allocation and deallocation
-operation.
-
-The additional output looks like the following.
-
-```text
-# Allocation of 256 byte(s), aligned on 1 byte(s). The allocated address is
-# 0x2002401c. After this operation, 2 pointers have been allocated, totalling
-# 384 bytes (the total heap usage may be larger, due to alignment and
-# fragmentation of allocations within the heap).
-alloc[256, 1] = 0x2002401c (2 ptrs, 384 bytes)
-# Deallocation of 64 byte(s), aligned on 1 byte(s), from address 0x2002410c.
-# After this operation, 1 pointers are allocated, totalling 512 bytes.
-dealloc[64, 1] = 0x2002410c (1 ptrs, 512 bytes)
-```
-
-A tool is provided to analyze such reports, in `tools/heapviz`. This tool
-parses the console output, identifies the lines corresponding to (de)allocation
-operations, and first computes some statistics:
-
-*   Address range used by the heap over this run of the program,
-*   Peak heap usage (how many useful bytes are allocated),
-*   Peak heap consumption (how many bytes are used by the heap, including
-    unavailable bytes between allocated blocks, due to alignment constraints and
-    memory fragmentation),
-*   Fragmentation overhead (difference between heap consumption and usage).
-
-Then, the `heapviz` tool displays an animated "movie" of the allocated bytes in
-heap memory. Each frame in this "movie" shows bytes that are currently
-allocated, that were allocated but are now freed, and that have never been
-allocated. A new frame is generated for each (de)allocation operation. This tool
-uses the `ncurses` library, that you may have to install beforehand.
-
-You can control the tool with the following parameters:
-
-*   `--logfile` (required) to provide the file which contains the console output
-    to parse,
-*   `--fps` (optional) to customize the number of frames per second in the movie
-    animation.
-
-```shell
-cargo run --manifest-path tools/heapviz/Cargo.toml -- --logfile console.log --fps 50
-```
+To test whether the installation was successful, visit a
+[demo website](https://webauthn.io/) and try to register and login.
+Please check our [Troubleshooting and Debugging](docs/debugging.md) section if you
+have problems with the installation process or during development. To find out what
+else you can do with your OpenSK, see [Customization](docs/customization.md).
 
 ## Contributing
 
 See [Contributing.md](docs/contributing.md).
+
+## Reporting a Vulnerability
+
+See [SECURITY.md](SECURITY.md).

SECURITY.md

@@ -0,0 +1,4 @@
+To report a security issue, please use http://g.co/vulnz. We use
+http://g.co/vulnz for our intake, and do coordination and disclosure here on
+GitHub (including using GitHub Security Advisory). The Google Security Team will
+respond within 5 working days of your report on g.co/vulnz.

deploy.py

@@ -182,39 +182,32 @@ def get_supported_boards():
 
 
 def fatal(msg):
-  print("{style_begin}fatal:{style_end} {message}".format(
-      style_begin=colorama.Fore.RED + colorama.Style.BRIGHT,
-      style_end=colorama.Style.RESET_ALL,
-      message=msg))
+  print(f"{colorama.Fore.RED + colorama.Style.BRIGHT}fatal:"
+        f"{colorama.Style.RESET_ALL} {msg}")
   sys.exit(1)
 
 
 def error(msg):
-  print("{style_begin}error:{style_end} {message}".format(
-      style_begin=colorama.Fore.RED,
-      style_end=colorama.Style.RESET_ALL,
-      message=msg))
+  print(f"{colorama.Fore.RED}error:{colorama.Style.RESET_ALL} {msg}")
 
 
 def info(msg):
-  print("{style_begin}info:{style_end} {message}".format(
-      style_begin=colorama.Fore.GREEN + colorama.Style.BRIGHT,
-      style_end=colorama.Style.RESET_ALL,
-      message=msg))
+  print(f"{colorama.Fore.GREEN + colorama.Style.BRIGHT}info:"
+        f"{colorama.Style.RESET_ALL} {msg}")
 
 
 def assert_mandatory_binary(binary):
   if not shutil.which(binary):
-    fatal(("Couldn't find {} binary. Make sure it is installed and "
-           "that your PATH is set correctly.").format(binary))
+    fatal((f"Couldn't find {binary} binary. Make sure it is installed and "
+           "that your PATH is set correctly."))
 
 
 def assert_python_library(module):
   try:
     __import__(module)
   except ModuleNotFoundError:
-    fatal(("Couldn't load python3 module {name}. "
-           "Try to run: pip3 install {name}").format(name=module))
+    fatal((f"Couldn't load python3 module {module}. "
+           f"Try to run: pip3 install {module}"))
 
 
 class RemoveConstAction(argparse.Action):
@@ -243,6 +236,8 @@ class RemoveConstAction(argparse.Action):
     # https://github.com/python/cpython/blob/master/Lib/argparse.py#L138-L147
     # https://github.com/python/cpython/blob/master/Lib/argparse.py#L1028-L1052
     items = getattr(namespace, self.dest, [])
+    if items is None:
+      items = []
     if isinstance(items, list):
       items = items[:]
     else:
@@ -287,7 +282,7 @@ class OpenSKInstaller:
       subprocess.run(
           cmd, stdout=stdout, timeout=None, check=True, env=env, cwd=cwd)
     except subprocess.CalledProcessError as e:
-      fatal("Failed to execute {}: {}".format(cmd[0], str(e)))
+      fatal(f"Failed to execute {cmd[0]}: {str(e)}")
 
   def checked_command_output(self, cmd, env=None, cwd=None):
     cmd_output = ""
@@ -300,14 +295,23 @@ class OpenSKInstaller:
           env=env,
           cwd=cwd).stdout
     except subprocess.CalledProcessError as e:
-      fatal("Failed to execute {}: {}".format(cmd[0], str(e)))
+      fatal(f"Failed to execute {cmd[0]}: {str(e)}")
       # Unreachable because fatal() will exit
     return cmd_output.decode()
 
   def update_rustc_if_needed(self):
     target_toolchain_fullstring = "stable"
-    with open("rust-toolchain", "r") as f:
-      target_toolchain_fullstring = f.readline().strip()
+    with open("rust-toolchain", "r", encoding="utf-8") as f:
+      content = f.readlines()
+      if len(content) == 1:
+        # Old format, only the build is stored
+        target_toolchain_fullstring = content[0].strip()
+      else:
+        # New format
+        for line in content:
+          if line.startswith("channel"):
+            channel = line.strip().split("=", maxsplit=1)[1].strip()
+            target_toolchain_fullstring = channel.strip('"')
     target_toolchain = target_toolchain_fullstring.split("-", maxsplit=1)
     if len(target_toolchain) == 1:
       # If we target the stable version of rust, we won't have a date
@@ -318,7 +322,7 @@ class OpenSKInstaller:
     current_version = self.checked_command_output(["rustc", "--version"])
     if not (target_toolchain[0] in current_version and
             target_toolchain[1] in current_version):
-      info("Updating rust toolchain to {}".format("-".join(target_toolchain)))
+      info(f"Updating rust toolchain to {'-'.join(target_toolchain)}")
       # Need to update
       rustup_install = ["rustup"]
       if self.args.verbose_build:
@@ -335,7 +339,7 @@ class OpenSKInstaller:
     info("Rust toolchain up-to-date")
 
   def build_tockos(self):
-    info("Building Tock OS for board {}".format(self.args.board))
+    info(f"Building Tock OS for board {self.args.board}")
     props = SUPPORTED_BOARDS[self.args.board]
     out_directory = os.path.join("third_party", "tock", "target", props.arch,
                                  "release")
@@ -347,7 +351,7 @@ class OpenSKInstaller:
     self.checked_command(["make"], cwd=props.path, env=env)
 
   def build_example(self):
-    info("Building example {}".format(self.args.application))
+    info(f"Building example {self.args.application}")
     self._build_app_or_example(is_example=True)
 
   def build_opensk(self):
@@ -363,20 +367,20 @@ class OpenSKInstaller:
     props = SUPPORTED_BOARDS[self.args.board]
     rust_flags = [
         "-C",
-        "link-arg=-T{}".format(props.app_ldscript),
+        f"link-arg=-T{props.app_ldscript}",
         "-C",
         "relocation-model=static",
         "-D",
         "warnings",
-        "--remap-path-prefix={}=".format(os.getcwd()),
+        f"--remap-path-prefix={os.getcwd()}=",
     ]
     env = os.environ.copy()
     env["RUSTFLAGS"] = " ".join(rust_flags)
     env["APP_HEAP_SIZE"] = str(APP_HEAP_SIZE)
 
     command = [
-        "cargo", "build", "--release", "--target={}".format(props.arch),
-        "--features={}".format(",".join(self.args.features))
+        "cargo", "build", "--release", f"--target={props.arch}",
+        f"--features={','.join(self.args.features)}"
     ]
     if is_example:
       command.extend(["--example", self.args.application])
@@ -402,18 +406,16 @@ class OpenSKInstaller:
   def create_tab_file(self, binaries):
     assert binaries
     assert self.args.application
-    info("Generating Tock TAB file for application/example {}".format(
-        self.args.application))
+    info("Generating Tock TAB file for application/example "
+         f"{self.args.application}")
     elf2tab_ver = self.checked_command_output(
         ["elf2tab/bin/elf2tab", "--version"]).split(
             "\n", maxsplit=1)[0]
     if elf2tab_ver != "elf2tab 0.6.0":
-      error(
-          ("Detected unsupported elf2tab version {!a}. The following "
-           "commands may fail. Please use 0.6.0 instead.").format(elf2tab_ver))
+      error(("Detected unsupported elf2tab version {elf2tab_ver!a}. The "
+             "following commands may fail. Please use 0.6.0 instead."))
     os.makedirs(self.tab_folder, exist_ok=True)
-    tab_filename = os.path.join(self.tab_folder,
-                                "{}.tab".format(self.args.application))
+    tab_filename = os.path.join(self.tab_folder, f"{self.args.application}.tab")
     elf2tab_args = [
         "elf2tab/bin/elf2tab", "--deterministic", "--package-name",
         self.args.application, "-o", tab_filename
@@ -421,12 +423,12 @@ class OpenSKInstaller:
     if self.args.verbose_build:
       elf2tab_args.append("--verbose")
     for arch, app_file in binaries.items():
-      dest_file = os.path.join(self.tab_folder, "{}.elf".format(arch))
+      dest_file = os.path.join(self.tab_folder, f"{arch}.elf")
       shutil.copyfile(app_file, dest_file)
       elf2tab_args.append(dest_file)
 
     elf2tab_args.extend([
-        "--stack={}".format(STACK_SIZE), "--app-heap={}".format(APP_HEAP_SIZE),
+        f"--stack={STACK_SIZE}", f"--app-heap={APP_HEAP_SIZE}",
         "--kernel-heap=1024", "--protected-region-size=64"
     ])
     if self.args.elf2tab_output:
@@ -437,7 +439,7 @@ class OpenSKInstaller:
 
   def install_tab_file(self, tab_filename):
     assert self.args.application
-    info("Installing Tock application {}".format(self.args.application))
+    info(f"Installing Tock application {self.args.application}")
     board_props = SUPPORTED_BOARDS[self.args.board]
     args = copy.copy(self.tockloader_default_args)
     setattr(args, "app_address", board_props.app_address)
@@ -450,8 +452,8 @@ class OpenSKInstaller:
     try:
       tock.install(tabs, replace="yes", erase=args.erase)
     except TockLoaderException as e:
-      fatal("Couldn't install Tock application {}: {}".format(
-          self.args.application, str(e)))
+      fatal("Couldn't install Tock application "
+            f"{self.args.application}: {str(e)}")
 
   def get_padding(self):
     padding = tbfh.TBFHeaderPadding(
@@ -463,8 +465,8 @@ class OpenSKInstaller:
     board_props = SUPPORTED_BOARDS[self.args.board]
     kernel_file = os.path.join("third_party", "tock", "target",
                                board_props.arch, "release",
-                               "{}.bin".format(self.args.board))
-    info("Flashing file {}.".format(kernel_file))
+                               f"{self.args.board}.bin")
+    info(f"Flashing file {kernel_file}.")
     with open(kernel_file, "rb") as f:
       kernel = f.read()
     args = copy.copy(self.tockloader_default_args)
@@ -474,7 +476,7 @@ class OpenSKInstaller:
     try:
       tock.flash_binary(kernel, board_props.kernel_address)
     except TockLoaderException as e:
-      fatal("Couldn't install Tock OS: {}".format(str(e)))
+      fatal(f"Couldn't install Tock OS: {str(e)}")
 
   def install_padding(self):
     padding = self.get_padding()
@@ -487,7 +489,7 @@ class OpenSKInstaller:
     try:
       tock.flash_binary(padding, args.address)
     except TockLoaderException as e:
-      fatal("Couldn't install padding: {}".format(str(e)))
+      fatal(f"Couldn't install padding: {str(e)}")
 
   def clear_apps(self):
     args = copy.copy(self.tockloader_default_args)
@@ -503,8 +505,7 @@ class OpenSKInstaller:
       tock.erase_apps()
     except TockLoaderException as e:
       # Erasing apps is not critical
-      info(("A non-critical error occurred while erasing "
-            "apps: {}".format(str(e))))
+      info(f"A non-critical error occurred while erasing apps: {str(e)}")
 
   def clear_storage(self):
     if self.args.programmer == "none":
@@ -519,16 +520,15 @@ class OpenSKInstaller:
       try:
         tock.flash_binary(storage, board_props.storage_address)
       except TockLoaderException as e:
-        fatal("Couldn't erase the persistent storage: {}".format(str(e)))
+        fatal(f"Couldn't erase the persistent storage: {str(e)}")
       return 0
     if self.args.programmer == "pyocd":
       self.checked_command([
-          "pyocd", "erase", "--target={}".format(board_props.pyocd_target),
-          "--sector", "{}+{}".format(board_props.storage_address,
-                                     board_props.storage_size)
+          "pyocd", "erase", f"--target={board_props.pyocd_target}", "--sector",
+          f"{board_props.storage_address}+{board_props.storage_size}"
       ])
       return 0
-    fatal("Programmer {} is not supported.".format(self.args.programmer))
+    fatal(f"Programmer {self.args.programmer} is not supported.")
 
   # pylint: disable=protected-access
   def verify_flashed_app(self, expected_app):
@@ -555,7 +555,7 @@ class OpenSKInstaller:
       # Process kernel
       kernel_path = os.path.join("third_party", "tock", "target",
                                  board_props.arch, "release",
-                                 "{}.bin".format(self.args.board))
+                                 f"{self.args.board}.bin")
       with open(kernel_path, "rb") as kernel:
         kern_hex = intelhex.IntelHex()
         kern_hex.frombytes(kernel.read(), offset=board_props.kernel_address)
@@ -570,25 +570,25 @@ class OpenSKInstaller:
         final_hex.merge(padding_hex, overlap="error")
 
       # Now we can add the application from the TAB file
-      app_tab_path = "target/tab/{}.tab".format(self.args.application)
+      app_tab_path = f"target/tab/{self.args.application}.tab"
       assert os.path.exists(app_tab_path)
       app_tab = tab.TAB(app_tab_path)
       if board_props.arch not in app_tab.get_supported_architectures():
         fatal(("It seems that the TAB file was not produced for the "
-               "architecture {}".format(board_props.arch)))
+               "architecture {board_props.arch}"))
       app_hex = intelhex.IntelHex()
       app_hex.frombytes(
           app_tab.extract_app(board_props.arch).get_binary(
               board_props.app_address),
           offset=board_props.app_address)
       final_hex.merge(app_hex)
-    info("Generating all-merged HEX file: {}".format(dest_file))
+    info(f"Generating all-merged HEX file: {dest_file}")
     final_hex.tofile(dest_file, format="hex")
 
   def check_prerequisites(self):
     if not tockloader.__version__.startswith("1.5."):
-      fatal(("Your version of tockloader seems incompatible: found {}, "
-             "expected 1.5.x.".format(tockloader.__version__)))
+      fatal(("Your version of tockloader seems incompatible: found "
+             f"{tockloader.__version__}, expected 1.5.x."))
 
     if self.args.programmer == "jlink":
       assert_mandatory_binary("JLinkExe")
@@ -609,7 +609,7 @@ class OpenSKInstaller:
       nrfutil_version = __import__("nordicsemi.version").version.NRFUTIL_VERSION
       if not nrfutil_version.startswith("6."):
         fatal(("You need to install nrfutil python3 package v6.0 or above. "
-               "Found: {}".format(nrfutil_version)))
+               "Found: {nrfutil_version}"))
       if not SUPPORTED_BOARDS[self.args.board].nordic_dfu:
         fatal("This board doesn't support flashing over DFU.")
 
@@ -653,7 +653,7 @@ class OpenSKInstaller:
       # Install padding and application if needed
       if self.args.application:
         self.install_padding()
-        self.install_tab_file("target/tab/{}.tab".format(self.args.application))
+        self.install_tab_file(f"target/tab/{self.args.application}.tab")
         if self.verify_flashed_app(self.args.application):
           info("You're all set!")
           return 0
@@ -665,22 +665,22 @@ class OpenSKInstaller:
       return 0
 
     if self.args.programmer in ("pyocd", "nordicdfu", "none"):
-      dest_file = "target/{}_merged.hex".format(self.args.board)
+      dest_file = f"target/{self.args.board}_merged.hex"
       os.makedirs("target", exist_ok=True)
       self.create_hex_file(dest_file)
 
       if self.args.programmer == "pyocd":
         info("Flashing HEX file")
         self.checked_command([
-            "pyocd", "flash", "--target={}".format(board_props.pyocd_target),
+            "pyocd", "flash", f"--target={board_props.pyocd_target}",
             "--format=hex", "--erase=auto", dest_file
         ])
       if self.args.programmer == "nordicdfu":
         info("Creating DFU package")
-        dfu_pkg_file = "target/{}_dfu.zip".format(self.args.board)
+        dfu_pkg_file = f"target/{self.args.board}_dfu.zip"
         self.checked_command([
             "nrfutil", "pkg", "generate", "--hw-version=52", "--sd-req=0",
-            "--application-version=1", "--application={}".format(dest_file),
+            "--application-version=1", f"--application={dest_file}",
             dfu_pkg_file
         ])
         info(
@@ -703,9 +703,8 @@ class OpenSKInstaller:
         info("Flashing device using DFU...")
         return subprocess.run(
             [
-                "nrfutil", "dfu", "usb-serial",
-                "--package={}".format(dfu_pkg_file),
-                "--serial-number={}".format(serial_number[0])
+                "nrfutil", "dfu", "usb-serial", f"--package={dfu_pkg_file}",
+                f"--serial-number={serial_number[0]}"
             ],
             check=False,
             timeout=None,
@@ -745,7 +744,7 @@ def main(args):
 
   if args.listing:
     # Missing check?
-    fatal("Listing {} is not implemented.".format(args.listing))
+    fatal(f"Listing {args.listing} is not implemented.")
 
   OpenSKInstaller(args).run()
 
@@ -916,6 +915,8 @@ if __name__ == "__main__":
       help=("When set, the output of elf2tab is appended to this file."),
   )
 
+  main_parser.set_defaults(features=["with_ctap1"])
+
   # Start parsing to know if we're going to list things or not.
   partial_args, _ = main_parser.parse_known_args()
 
@@ -947,7 +948,16 @@ if __name__ == "__main__":
       dest="application",
       action="store_const",
       const="store_latency",
-      help=("Compiles and installs the store_latency example."))
+      help=("Compiles and installs the store_latency example which print "
+            "latency statistics of the persistent store library."))
+  apps_group.add_argument(
+      "--erase_storage",
+      dest="application",
+      action="store_const",
+      const="erase_storage",
+      help=("Compiles and installs the erase_storage example which erases "
+            "the storage. During operation the dongle red light is on. Once "
+            "the operation is completed the dongle green light is on."))
   apps_group.add_argument(
       "--panic_test",
       dest="application",
@@ -977,6 +987,4 @@ if __name__ == "__main__":
       help=("Compiles and installs the nfct_test example that tests the "
             "NFC driver."))
 
-  main_parser.set_defaults(features=["with_ctap1"])
-
   main(main_parser.parse_args())

docs/boards/nrf52840_dongle.md

@@ -0,0 +1,85 @@
+# <img alt="OpenSK logo" src="../img/OpenSK.svg" width="200px">
+
+## Nordic nRF52840 Dongle
+
+![Nordic dongle](../img/dongle_front.jpg)
+
+### 3D printed enclosure
+
+To protect and carry your key, we partnered with a professional designer and we
+are providing a custom enclosure that can be printed on both professional 3D
+printers and hobbyist models.
+
+![OpenSK Enclosure](../img/enclosure.jpg)
+
+All the required files can be downloaded from
+[Thingiverse](https://www.thingiverse.com/thing:4132768) including the STEP
+file, allowing you to easily make the modifications you need to further
+customize it.
+
+### Flashing using DFU (preferred method)
+
+To flash the firmware, run:
+
+```shell
+./deploy.py --board=nrf52840_dongle_dfu --opensk --programmer=nordicdfu
+```
+
+The script will ask you to switch to DFU mode. To activate that on your dongle,
+keep the button pressed while inserting the device into your USB port. You may
+additionally need to press the tiny, sideways facing reset button. The device
+indicates DFU mode with a slowly blinking red LED.
+
+### Flashing with an external programmer (JLink, OpenOCD, etc.)
+
+If you want to use JTAG with the dongle, you need additional hardware.
+
+*   a [Segger J-Link](https://www.segger.com/products/debug-probes/j-link/) JTAG
+    probe.
+*   a
+    [TC2050 Tag-Connect programming cable](https://www.tag-connect.com/product/tc2050-idc-nl-10-pin-no-legs-cable-with-ribbon-connector).
+*   a [Tag-Connect TC2050 ARM2010](http://www.tag-connect.com/TC2050-ARM2010)
+    adaptor
+*   optionally a
+    [Tag-Connect TC2050 retainer clip](http://www.tag-connect.com/TC2050-CLIP)
+    to keep the spring loaded connector pressed to the PCB.
+
+Follow these steps:
+
+1.  The JTAG probe used for programming won't provide power to the board.
+    Therefore you will need to use a USB-A extension cable to power the dongle
+    through its USB port.
+
+1.  Connect the TC2050 cable to the pads below the PCB:
+
+    ![Nordic dongle pads](../img/dongle_pads.jpg)
+
+1.  You can use the retainer clip if you have one to avoid maintaining pressure
+    between the board and the cable:
+
+    ![Nordic dongle retainer clip](../img/dongle_clip.jpg)
+
+1.  Depending on the programmer you're using, you may have to adapt the next
+    command line. Run our script for compiling/flashing Tock OS on your device:
+
+    ```shell
+    $ ./deploy.py --board=nrf52840_dongle --programmer=jlink
+    ```
+
+1.  Remove the programming cable and the USB-A extension cable.
+
+### Buttons and LEDs
+
+The bigger, white button conveys user presence to the application. Some actions
+like register and login will make the dongle blink, asking you to confirm the
+transaction with a button press. The small, sideways pointing buttong next to it
+restarts the dongle.
+
+The 2 LEDs show the state of the app. There are different patterns:
+
+| Pattern                            | Cause                  |
+|------------------------------------|------------------------|
+| all LEDs and colors                | app panic              |
+| green and blue blinking            | asking for touch       |
+| all LEDs and colors for 5s         | wink (just saying Hi!) |
+| red slow blink                     | DFU mode               |

docs/boards/nrf52840_feitian.md

@@ -0,0 +1,23 @@
+# <img alt="OpenSK logo" src="../img/OpenSK.svg" width="200px">
+
+## Feitian OpenSK USB Dongle
+
+### Flashing using DFU
+
+This board is similar in hardware to the Nordic nRF52840 Dongle. You can use DFU
+to flash it, instructions to enter DFU mode depend on the version of your
+hardware. See
+[Feitian's instructions](https://feitiantech.github.io/OpenSK_USB/). In short:
+
+*   In V1, use a paperclip to press the Reset button through the tiny hole.
+*   In V2, push and hold the user button for more than 10 seconds after
+    connecting your device.
+
+Afterwards, you can flash your Feitian OpenSK using DFU following the
+[instructions for the Nordic nRF52840 Dongle](nrf52840_dongle.md#Flashing-using-DFU).
+
+### Buttons and LEDs
+
+For both hardware versions, the buttons and LEDs are described in detail in the
+[hardware section](https://feitiantech.github.io/OpenSK_USB/hardware/) of
+Feitian's website.

docs/boards/nrf52840_mdk.md

@@ -0,0 +1,47 @@
+# <img alt="OpenSK logo" src="../img/OpenSK.svg" width="200px">
+
+## Nordic nRF52840 MDK
+
+Makerdiary has instructions on their [website](https://wiki.makerdiary.com/nrf52840-mdk-usb-dongle/opensk/). They use a custom script to deploy via DFU.
+
+After general setup, you still need these steps:
+
+1.  Create the hexfile with the firmware.
+
+    ```shell
+    ./deploy.py --board=nrf52840_mdk_dfu --opensk --programmer=none
+    ```
+
+1.  Download the
+    [script](https://github.com/makerdiary/nrf52840-mdk-usb-dongle/blob/master/tools/uf2conv.py)
+    from Makerdiary's GitHub into the OpenSK repository.
+
+1.  Run the script:
+
+    ```shell
+    python3 uf2conv.py -c -f 0xada52840 -o target/opensk.uf2 target/nrf52840_mdk_dfu_merged.hex
+    ```
+
+1.  Boot into DFU mode. Keep the user button pressed on your hardware while
+    inserting it into a USB slot. You should see a bit of red blinking, and then
+    a constant green light.
+
+1.  Your dongle should appear in your normal file browser like other USB sticks.
+    Copy the file `target/opensk.uf2` over.
+
+1.  Replug to reboot.
+
+### Buttons and LEDs
+
+The big, white button conveys user presence to the application. Some actions
+like register and login will make the device blink, asking you to confirm the
+transaction with a button press.
+
+The LED shows the state of the app. There are different patterns:
+
+| Pattern                            | Cause                  |
+|------------------------------------|------------------------|
+| red glow                           | busy                   |
+| red and blue blinking              | asking for touch       |
+| red, green, white pattern for 5s   | wink (just saying Hi!) |
+| constant green                     | DFU mode               |

docs/boards/nrf52840dk.md

@@ -0,0 +1,50 @@
+# <img alt="OpenSK logo" src="../img/OpenSK.svg" width="200px">
+
+## Nordic nRF52840-DK board
+
+![Nordic development kit](../img/devkit_annotated.jpg)
+
+### Flashing using JTAG
+
+The development board comes with its own JTAG port, so the default programmer
+is the easiest and most convenient. You can flash OpenSK with these steps:
+
+1.  Connect a micro USB cable to the JTAG USB port.
+
+1.  Run our script for compiling/flashing Tock OS and OpenSK on your device:
+
+    ```shell
+    ./deploy.py --board=nrf52840dk --opensk
+    ```
+
+1.  Connect a micro USB cable to the device USB port.
+
+**Note**: Due to current limitations of our implementation and Tock, you may
+have to press the `BOOT/RESET` button, located next to the device USB port on
+the board in order to see your OpenSK device on your system.
+
+### Buttons and LEDs
+
+Out of the 5 buttons, the group of 4 behaves identically. They all convey user
+presence to the application. Some actions like register and login will make the
+board blink, asking you to confirm the transaction with a button press. The
+remaining fifth button restarts the board.
+
+The group of 4 LEDs on the right show the state of the app. There are different
+patterns:
+
+| Pattern                            | Cause                  |
+|------------------------------------|------------------------|
+| LED1 slow blink                    | kernel panic           |
+| all LEDs blinking together         | app panic              |
+| LED1+4 and LED2+3 fast alternating | asking for touch       |
+| fast swirling                      | wink (just saying Hi!) |
+| circle                             | allocator panic        |
+
+The LEDs closer to the JTAG port indicates the power and debugging state.
+
+There are 3 switches that need to be in the correct position:
+
+*   Power (bottom left): On
+*   nRF power source (center left): VDD
+*   SW6 (top right): DEFAULT

docs/customization.md

@@ -0,0 +1,78 @@
+# <img alt="OpenSK logo" src="img/OpenSK.svg" width="200px">
+
+## Customization
+
+### Cryptographic material
+
+All the generated certificates and private keys are stored in the directory
+`crypto_data/`. The expected content after running our `setup.sh` script is:
+
+File                     | Purpose
+------------------------ | --------------------------------------------------------
+`aaguid.txt`             | Text file containaing the AAGUID value
+`opensk_ca.csr`          | Certificate sign request for the Root CA
+`opensk_ca.key`          | ECC secp256r1 private key used for the Root CA
+`opensk_ca.pem`          | PEM encoded certificate of the Root CA
+`opensk_ca.srl`          | File generated by OpenSSL
+`opensk_cert.csr`        | Certificate sign request for the attestation certificate
+`opensk_cert.pem`        | PEM encoded certificate used for the authenticator
+`opensk.key`             | ECC secp256r1 private key used for the autenticator
+
+If you want to use your own attestation certificate and private key,
+replace the `opensk_cert.pem` and `opensk.key` files. The script at
+`tools/configure.py` customizes an OpenSK device with the correct certificate
+and private key.
+
+Our build script `build.rs` is responsible for converting the `aaguid.txt` file
+into raw data that is then used by the Rust file `src/ctap/key_material.rs`.
+
+Please make sure to safely store all private key material before calling
+`reset.sh`, or the files will be lost.
+
+#### Certificate considerations
+
+The certificate on OpenSK is used for attestation. That means, whenever you
+register OpenSK on a website, you attest the legitimacy of your hardware. For
+self-generated certificates, this claim is rather trivial. Still, it is required
+by some websites and to use U2F.
+
+Usually, the attestation private key is shared between a batch of at least
+100,000 security keys of the same model. If you build your own OpenSK, your
+private key is unique to you. This makes you identifiable across registrations:
+Two websites could collaborate to track if registrations were attested with the
+same key material. If you use OpenSK beyond experimentation, please consider
+carefully if you want to take this privacy risk.
+
+### Software personalization
+
+If you build your own security key, depending on the hardware you use, there are
+a few things you can personalize:
+
+1.  If you have multiple buttons, choose the buttons responsible for user
+    presence in `main.rs`.
+2.  Decide whether you want to use batch attestation. There is a boolean flag in
+    `ctap/mod.rs`. It is mandatory for U2F, and you can create your own
+    self-signed certificate. The flag is used for FIDO2 and has some privacy
+    implications. Please check
+    [WebAuthn](https://www.w3.org/TR/webauthn/#attestation) for more
+    information.
+3.  Decide whether you want to use signature counters. Currently, only global
+    signature counters are implemented, as they are the default option for U2F.
+    The flag in `ctap/mod.rs` only turns them off for FIDO2. The most privacy
+    preserving solution is individual or no signature counters. Again, please
+    check [WebAuthn](https://www.w3.org/TR/webauthn/#signature-counter) for
+    documentation.
+4.  Depending on your available flash storage, choose an appropriate maximum
+    number of supported resident keys and number of pages in
+    `ctap/storage.rs`.
+5.  Change the default level for the credProtect extension in `ctap/mod.rs`.
+    When changing the default, resident credentials become undiscoverable without
+    user verification. This helps privacy, but can make usage less comfortable
+    for credentials that need less protection.
+6.  Increase the default minimum length for PINs in `ctap/storage.rs`.
+    The current minimum is 4. Values from 4 to 63 are allowed. Requiring longer
+    PINs can help establish trust between users and relying parties. It makes
+    user verification harder to break, but less convenient.
+    NIST recommends at least 6-digit PINs in section 5.1.9.1 of their
+    [Digital Identity Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html).
+    You can add relying parties to the list of readers of the minimum PIN length.

docs/debugging.md

@@ -0,0 +1,137 @@
+# <img alt="OpenSK logo" src="img/OpenSK.svg" width="200px">
+
+## Troubleshooting and Debugging
+
+### Inspecting USB
+
+The following commands should help you identify whether your operating system
+identifies OpenSK over USB.
+
+#### Linux
+
+When plugging in the USB key, the following line should appear in `lsusb`.
+
+```shell
+$ lsusb
+...
+Bus XXX Device YYY: ID 1915:521f Nordic Semiconductor ASA OpenSK
+```
+
+You should also see lines similar to the following in `dmesg`.
+
+```shell
+$ dmesg
+...
+[XXX] usb A-BB: new full-speed USB device number 00 using xhci_hcd
+[XXX] usb A-BB: New USB device found, idVendor=1915, idProduct=521f, bcdDevice= 0.01
+[XXX] usb A-BB: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+[XXX] usb A-BB: Product: OpenSK
+[XXX] usb A-BB: Manufacturer: Nordic Semiconductor ASA
+[XXX] usb A-BB: SerialNumber: v0.1
+[XXX] hid-generic 0000:0000:0000.0000: hiddev0,hidraw0: USB HID v1.10 Device [Nordic Semiconductor ASA OpenSK] on usb-0000:00:00.0-00/input0
+```
+
+#### Mac OS X
+
+When plugging in the USB key, you should see a similar line by using the `ioreg`
+tool:
+
+```shell
+$ ioreg -p IOUSB
++-o Root  <class IORegistryEntry, id 0x100000100, retain 21>
+...
+  +-o AppleUSBXHCI Root Hub Simulation@14000000  <class AppleUSBRootHubDevice, id 0x100000a00, registered, matched, active, busy 0 (0 ms), retain 9>
+    +-o OpenSK@14400000  <class AppleUSBDevice, id 0x100003c04, registered, matched, active, busy 0 (0 ms), retain 13>
+```
+
+### Debug console
+
+On the dev board, you can read the debug messages using JLink. Use one terminal
+for the server and one for the client:
+
+```shell
+# Terminal 1
+JLinkExe -device nrf52 -if swd -speed 1000 -autoconnect 1
+# Terminal 2
+JLinkRTTClient
+```
+
+You can enhance the debug output by adding flags to the deploy command (see
+below for details):
+
+*   `--debug`: more debug messages
+*   `--panic-console`: add panic messages
+*   `--debug-allocations`: print information about the used heap
+
+Adding debugging to your firmware increases resource usage, including
+
+*   USB communication speed
+*   RAM usage
+*   binary size
+
+Depending on your choice of board, you may have to increase the available stack
+for kernel or app, or disable features so that the binary fits the flash. Also
+expect more packet loss.
+
+### App panic messages
+
+By default, libtock-rs blinks some LEDs when the userspace application panics.
+This is not always convenient as the panic message is lost. In order to enable
+a custom panic handler that first writes the panic message via Tock's console
+driver, before faulting the app, you can use the `--panic-console` flag of the
+`deploy.py` script.
+
+```shell
+# Example on Nordic nRF52840-DK board
+./deploy.py --board=nrf52840dk --opensk --panic-console
+```
+
+### Memory allocations
+
+You may want to track memory allocations to understand the heap usage of
+OpenSK. This can be useful if you plan to port it to a board with fewer
+available RAM for example. To do so, you can enable the `--debug-allocations`
+flag of the `deploy.py` script. This enables a custom (userspace) allocator
+that prints a message to the console for each allocation and deallocation
+operation.
+
+The additional output looks like the following.
+
+```text
+# Allocation of 256 byte(s), aligned on 1 byte(s). The allocated address is
+# 0x2002401c. After this operation, 2 pointers have been allocated, totalling
+# 384 bytes (the total heap usage may be larger, due to alignment and
+# fragmentation of allocations within the heap).
+alloc[256, 1] = 0x2002401c (2 ptrs, 384 bytes)
+# Deallocation of 64 byte(s), aligned on 1 byte(s), from address 0x2002410c.
+# After this operation, 1 pointers are allocated, totalling 512 bytes.
+dealloc[64, 1] = 0x2002410c (1 ptrs, 512 bytes)
+```
+
+A tool is provided to analyze such reports, in `tools/heapviz`. This tool
+parses the console output, identifies the lines corresponding to (de)allocation
+operations, and first computes some statistics:
+
+*   Address range used by the heap over this run of the program,
+*   Peak heap usage (how many useful bytes are allocated),
+*   Peak heap consumption (how many bytes are used by the heap, including
+    unavailable bytes between allocated blocks, due to alignment constraints and
+    memory fragmentation),
+*   Fragmentation overhead (difference between heap consumption and usage).
+
+Then, the `heapviz` tool displays an animated "movie" of the allocated bytes in
+heap memory. Each frame in this "movie" shows bytes that are currently
+allocated, that were allocated but are now freed, and that have never been
+allocated. A new frame is generated for each (de)allocation operation. This tool
+uses the `ncurses` library, that you may have to install beforehand.
+
+You can control the tool with the following parameters:
+
+*   `--logfile` (required) to provide the file which contains the console output
+    to parse,
+*   `--fps` (optional) to customize the number of frames per second in the movie
+    animation.
+
+```shell
+cargo run --manifest-path tools/heapviz/Cargo.toml -- --logfile console.log --fps 50
+```

docs/install.md

@@ -1,271 +1,113 @@
-<img alt="OpenSK logo" src="img/OpenSK.svg" width="200px">
+# <img alt="OpenSK logo" src="img/OpenSK.svg" width="200px">
 
-# Installation guide
+## Installation guide
 
-This document describes in details how to turn a Nordic nRF52840 board into a
-working FIDO2 security key.
+This document lists required steps to start build your own OpenSK.
 
-## Pre-requisite
+### Programmers
 
-### Hardware
+OpenSK supports different ways to flash your board:
 
-You will need one the following supported boards:
-
-*   [Nordic nRF52840-DK](https://www.nordicsemi.com/Software-and-Tools/Development-Kits/nRF52840-DK)
-    development kit. This board is more convenient for development and debug
-    scenarios as the JTAG probe is already on the board.
-*   [Nordic nRF52840 Dongle](https://www.nordicsemi.com/Software-and-tools/Development-Kits/nRF52840-Dongle)
-    to have a more practical form factor.
-*   [Makerdiary nRF52840-MDK USB dongle](https://wiki.makerdiary.com/nrf52840-mdk/).
-
-In the case of the Nordic USB dongle, you may also need the following extra
-hardware:
-
-*   a [Segger J-Link](https://www.segger.com/products/debug-probes/j-link/) JTAG
-    probe.
-*   a
-    [TC2050 Tag-Connect programming cable](https://www.tag-connect.com/product/tc2050-idc-nl-10-pin-no-legs-cable-with-ribbon-connector).
-*   a [Tag-Connect TC2050 ARM2010](http://www.tag-connect.com/TC2050-ARM2010)
-    adaptor
-*   optionally a
-    [Tag-Connect TC2050 retainer clip](http://www.tag-connect.com/TC2050-CLIP)
-    to keep the spring loaded connector pressed to the PCB.
-
-Additionnaly, OpenSK supports other ways to flash your board:
-
-*   [OpenOCD](http://openocd.org/).
 *   [Segger J-Link](https://www.segger.com/products/debug-probes/j-link/)
     (default method).
+*   [OpenOCD](http://openocd.org/).
 *   [pyOCD](https://pypi.org/project/pyocd/).
 *   [nrfutil](https://pypi.org/project/nrfutil/) for the USB dongle boards that
-    supports it, which allows you to directly flash a working board over USB
+    support it, which allows you to directly flash a working board over USB
     without additional hardware.
 
-This guide **does not** cover how to setup the JTAG probe and their related
-tools on your system.
-
-### Software
+### Software requirements
 
 In order to compile and flash a working OpenSK firmware, you will need the
 following:
 
 *   rustup (can be installed with [Rustup](https://rustup.rs/))
 *   python3 and pip (can be installed with the `python3-pip` package on Debian)
-*   the OpenSSL command line tool (can be installed with the `libssl-dev`
-    package on Debian)
+*   the OpenSSL command line tool (can be installed and configured with the
+    `libssl-dev` and `pkg-config` packages on Debian)
+*   `nrfutil` (can be installed using `pip3 install nrfutil`) if you want to flash
+    a device with DFU
+*   `uuid-runtime` if you are missing the `uuidgen` command.
+
+The proprietary software to use the default programmer can be found on the
+[Segger website](https://www.segger.com/downloads/jlink). Please follow their
+instructions to appropriate binaries for your system.
 
 The scripts provided in this project have been tested under Linux and OS X. We
 haven't tested them on Windows and other platforms.
 
-## Compiling the firmware
+### Compiling the firmware
 
-### Initial setup
+If you are switching branches or used an old version of OpenSK before, we have
+tools to help you migrate to our develop branch. You find more information on
+how to update your setup or reset your storage in its
+[install instructions](https://github.com/google/OpenSK/blob/develop/docs/install.md).
 
-If you just cloned this repository, you need to run the following script
-(_output may differ_):
+To clone and setup the repository for the stable branch, run the following
+commands:
 
 ```shell
-$ ./setup.sh
-[-] Applying patch "01-persistent-storage.patch"... DONE.
-[-] Applying patch "02-usb.patch"... DONE.
-[-] Applying patch "03-app-memory.patch"... DONE.
-[-] Applying patch "04-rtt.patch"... DONE.
-[-] Applying patch "01-linked_list_allocator.patch"... DONE.
-[-] Applying patch "02-panic_console.patch"... DONE.
-[-] Applying patch "03-timer.patch"... DONE.
-[-] Applying patch "04-public_syscalls.patch"... DONE.
-[-] Applying patch "05-bigger_heap.patch"... DONE.
-[-] Applying patch "06-no_spin_allocator.patch"... DONE.
-Signature ok
-subject=CN = Google OpenSK CA
-Getting Private key
-Signature ok
-subject=CN = Google OpenSK Hacker Edition
-Getting CA Private Key
-info: syncing channel updates for 'nightly-2020-02-03-x86_64-unknown-linux-gnu'
-
-  nightly-2020-02-03-x86_64-unknown-linux-gnu unchanged - rustc 1.42.0-nightly (f43c34a13 2020-02-02)
-
-Requirement already up-to-date: tockloader in /usr/lib/python3/dist-packages/tockloader-1.4.0.dev0-py3.7.egg (1.4.0.dev0)
-Requirement already satisfied, skipping upgrade: argcomplete>=1.8.2 in /usr/lib/python3/dist-packages (from tockloader) (1.10.0)
-Requirement already satisfied, skipping upgrade: colorama>=0.3.7 in /usr/lib/python3/dist-packages (from tockloader) (0.3.7)
-Requirement already satisfied, skipping upgrade: crcmod>=1.7 in /usr/lib/python3/dist-packages (from tockloader) (1.7)
-Requirement already satisfied, skipping upgrade: pyserial>=3.0.1 in /usr/lib/python3/dist-packages (from tockloader) (3.4)
-Requirement already satisfied, skipping upgrade: pytoml>=0.1.11 in /usr/lib/python3/dist-packages (from tockloader) (0.1.21)
-info: component 'rust-std' for target 'thumbv7em-none-eabi' is up to date
-    Updating crates.io index
-     Ignored package `elf2tab v0.4.0` is already installed, use --force to override
+git clone https://github.com/google/OpenSK.git
+cd OpenSK
+./setup.sh
 ```
 
-The script performs the following steps:
+The setup script performs the following steps:
 
-1.  Make sure that the git submodules are checked out
+1.  Make sure that the git submodules are checked out.
 
 1.  Apply our patches that haven't yet been merged upstream to both
     [Tock](https://github.com/tock/tock) and
-    [libtock-rs](https://github.com/tock/libtock-rs)
+    [libtock-rs](https://github.com/tock/libtock-rs).
 
-1.  Generate a self-signed certificate authority as well as a private key and a
-    corresponding certificate for your OpenSK key signed by this CA. You will be
-    able to replace them with your own certificate and private key.
+1.  Generate crypto material, see [Customization](customization.md) for details.
 
-1.  Ensure that your Rust toolchain is using the same version that we tested
-    OpenSK with.
+1.  Install the correct Rust toolchain for ARM devices.
 
 1.  Install [tockloader](https://github.com/tock/tockloader).
 
-1.  Ensure that the Rust toolchain can compile code for ARM devices.
+Additionally on Linux, you need to install a `udev` rule file to allow non-root
+users to interact with OpenSK devices. To install it, execute:
 
-### Replacing the certificates
+```shell
+sudo cp rules.d/55-opensk.rules /etc/udev/rules.d/
+sudo udevadm control --reload
+```
 
-All the generated certificates and private keys are stored in the directory
-`crypto_data/`.
+Then, you need and replug the device for the rule to trigger.
 
-This is the expected content after running our `setup.sh` script:
+Last, if you want to use U2F or attestation, configure the certificate. If your
+client does not support FIDO2 yet, this step is mandatory for your OpenSK to
+work. OpenSK is incompatible with some browsers without a certificate. Please
+read the
+[certificate section in Customization](customization.md#Certificate-considerations)
+for understand privacy tradeoffs.
 
-File              | Purpose
------------------ | --------------------------------------------------------
-`aaguid.txt`      | Text file containaing the AAGUID value
-`opensk_ca.csr`   | Certificate sign request for the Root CA
-`opensk_ca.key`   | ECC secp256r1 private key used for the Root CA
-`opensk_ca.pem`   | PEM encoded certificate of the Root CA
-`opensk_ca.srl`   | File generated by OpenSSL
-`opensk_cert.csr` | Certificate sign request for the attestation certificate
-`opensk_cert.pem` | PEM encoded certificate used for the authenticator
-`opensk.key`      | ECC secp256r1 private key used for the autenticator
-
-If you want to use your own attestation certificate and private key, simply
-replace `opensk_cert.pem` and `opensk.key` files.
-
-Our build script `build.rs` is responsible for converting the `aaguid.txt` file
-into raw data that is then used by the Rust file `src/ctap/key_material.rs`.
-
-Our configuration script `tools/configure.py` is responsible for configuring
-an OpenSK device with the correct certificate and private key.
+```shell
+./tools/configure.py \
+    --certificate=crypto_data/opensk_cert.pem \
+    --private-key=crypto_data/opensk.key
+```
 
 ### Flashing a firmware
 
-#### Nordic nRF52840-DK board
+From here on, please follow the instructions for your hardware:
 
-![Nordic development kit](img/devkit_annotated.jpg)
-
-1.  Connect a micro USB cable to the JTAG USB port.
-
-1.  Run our script for compiling/flashing Tock OS and OpenSK on your device
-    (_output may differ_):
-
-    ```shell
-    $ ./deploy.py --board=nrf52840dk --opensk
-        info: Updating rust toolchain to nightly-2020-02-03
-        info: syncing channel updates for 'nightly-2020-02-03-x86_64-unknown-linux-gnu'
-        info: checking for self-updates
-        info: component 'rust-std' for target 'thumbv7em-none-eabi' is up to date
-        info: Rust toolchain up-to-date
-        info: Building Tock OS for board nrf52840dk
-            Compiling tock-registers v0.5.0 (./third_party/tock/libraries/tock-register-interface)
-            Compiling tock-cells v0.1.0 (./third_party/tock/libraries/tock-cells)
-            Compiling enum_primitive v0.1.0 (./third_party/tock/libraries/enum_primitive)
-            Compiling tock_rt0 v0.1.0 (./third_party/tock/libraries/tock-rt0)
-            Compiling nrf52840dk v0.1.0 (./third_party/tock/boards/nordic/nrf52840dk)
-            Compiling kernel v0.1.0 (./third_party/tock/kernel)
-            Compiling cortexm v0.1.0 (./third_party/tock/arch/cortex-m)
-            Compiling nrf5x v0.1.0 (./third_party/tock/chips/nrf5x)
-            Compiling capsules v0.1.0 (./third_party/tock/capsules)
-            Compiling cortexm4 v0.1.0 (./third_party/tock/arch/cortex-m4)
-            Compiling nrf52 v0.1.0 (./third_party/tock/chips/nrf52)
-            Compiling nrf52840 v0.1.0 (./third_party/tock/chips/nrf52840)
-            Compiling components v0.1.0 (./third_party/tock/boards/components)
-            Compiling nrf52dk_base v0.1.0 (./third_party/tock/boards/nordic/nrf52dk_base)
-                Finished release [optimized + debuginfo] target(s) in 13.15s
-        info: Converting Tock OS file into a binary
-        info: Building OpenSK application
-            Finished release [optimized] target(s) in 0.02s
-        info: Generating Tock TAB file for application/example ctap2
-        info: Erasing all installed applications
-        All apps have been erased.
-        info: Flashing file third_party/tock/boards/nordic/nrf52840dk/target/thumbv7em-none-eabi/release/nrf52840dk.bin.
-        info: Flashing padding application
-        info: Installing Tock application ctap2
-        info: You're all set!
-    ```
-
-1.  Connect a micro USB cable to the device USB port.
-
-**Note**: Due to current limitations of our implementation and Tock, you may
-have to press the `BOOT/RESET` button, located next to the device USB port on
-the board in order to see your OpenSK device on your system.
-
-#### Nordic nRF52840 Dongle
-
-##### Using external programmer (JLink, OpenOCD, etc.)
-
-![Nordic dongle](img/dongle_front.jpg)
-
-1.  The JTAG probe used for programming won't provide power to the board.
-    Therefore you will need to use a USB-A extension cable to power the dongle
-    through its USB port.
-
-1.  Connect the TC2050 cable to the pads below the PCB:
-
-    ![Nordic dongle pads](img/dongle_pads.jpg)
-
-1.  You can use the retainer clip if you have one to avoid maintaining pressure
-    between the board and the cable:
-
-    ![Nordic dongle retainer clip](img/dongle_clip.jpg)
-
-1.  Depending on the programmer you're using, you may have to adapt the next
-    command line. Run our script for compiling/flashing Tock OS on your device
-    (_output may differ_):
-
-    ```shell
-    $ ./deploy.py os --board=nrf52840_dongle --programmer=jlink
-    info: Updating rust toolchain to nightly-2020-02-03
-    info: syncing channel updates for 'nightly-2020-02-03-x86_64-unknown-linux-gnu'
-    info: checking for self-updates
-    info: component 'rust-std' for target 'thumbv7em-none-eabi' is up to date
-    info: Rust toolchain up-to-date
-    info: Building Tock OS for board nrf52840_dongle
-        Compiling tock-cells v0.1.0 (./third_party/tock/libraries/tock-cells)
-        Compiling tock-registers v0.5.0 (./third_party/tock/libraries/tock-register-interface)
-        Compiling enum_primitive v0.1.0 (./third_party/tock/libraries/enum_primitive)
-        Compiling tock_rt0 v0.1.0 (./third_party/tock/libraries/tock-rt0)
-        Compiling nrf52840_dongle v0.1.0 (./third_party/tock/boards/nordic/nrf52840_dongle)
-        Compiling kernel v0.1.0 (./third_party/tock/kernel)
-        Compiling cortexm v0.1.0 (./third_party/tock/arch/cortex-m)
-        Compiling nrf5x v0.1.0 (./third_party/tock/chips/nrf5x)
-        Compiling capsules v0.1.0 (./third_party/tock/capsules)
-        Compiling cortexm4 v0.1.0 (./third_party/tock/arch/cortex-m4)
-        Compiling nrf52 v0.1.0 (./third_party/tock/chips/nrf52)
-        Compiling nrf52840 v0.1.0 (./third_party/tock/chips/nrf52840)
-        Compiling components v0.1.0 (./third_party/tock/boards/components)
-        Compiling nrf52dk_base v0.1.0 (./third_party/tock/boards/nordic/nrf52dk_base)
-            Finished release [optimized + debuginfo] target(s) in 11.72s
-    info: Converting Tock OS file into a binary
-    info: Building OpenSK application
-        Finished release [optimized] target(s) in 0.02s
-    info: Generating Tock TAB file for application/example ctap2
-    info: Erasing all installed applications
-    All apps have been erased.
-    info: Flashing file third_party/tock/boards/nordic/nrf52840_dongle/target/thumbv7em-none-eabi/release/nrf52840_dongle.bin.
-    info: Flashing padding application
-    info: Installing Tock application ctap2
-    info: You're all set!
-    ```
-
-1.  Remove the programming cable and the USB-A extension cable.
+*   [Nordic nRF52840-DK](boards/nrf52840dk.md)
+*   [Nordic nRF52840 Dongle](boards/nrf52840_dongle.md)
+*   [Makerdiary nRF52840-MDK USB dongle](boards/nrf52840_mdk.md)
+*   [Feitian OpenSK dongle](boards/nrf52840_feitian.md)
 
 ### Advanced installation
 
-Although flashing using a Segger JLink probe is the officially supported way,
-our tool, `deploy.py` also supports other methods:
+We recommend that you flash your development board with JTAG and dongles with
+DFU, as described in the [board documentation](#Flashing-a-firmware) linked
+above. However, we support other programmers:
 
 *   OpenOCD: `./deploy.py --board=nrf52840_dongle --opensk --programmer=openocd`
 *   pyOCD: `./deploy.py --board=nrf52840_dongle --opensk --programmer=pyocd`
-*   Nordic DFU: `./deploy.py --board=nrf52840_dongle --opensk
-    --programmer=nordicdfu`
-*   Custom: `./deploy.py --board=nrf52840_dongle --opensk --programmer=none`. In
-    this case, an IntelHex file will be created and how to program a board is
+*   Custom: `./deploy.py --board=nrf52840_dongle --opensk --programmer=none`.
+    In this case, an IntelHex file will be created and how to program a board is
     left to the user.
 
 If your board is already flashed with Tock OS, you may skip installing it:
@@ -273,67 +115,3 @@ If your board is already flashed with Tock OS, you may skip installing it:
 
 For more options, we invite you to read the help of our `deploy.py` script by
 running `./deploy.py --help`.
-
-### Installing the udev rule (Linux only)
-
-By default on Linux, a USB device will require root privilege in order interact
-with it. As it is not recommended to run your web browser with such a high
-privileged account, we made a `udev` rule file to allow regular users to
-interact with OpenSK authenticators.
-
-To install it, you need to execute the following commands:
-
-```shell
-sudo cp rules.d/55-opensk.rules /etc/udev/rules.d/
-sudo udevadm control --reload
-```
-
-Then, you will need to unplug and replug the key for the rule to trigger.
-
-## Troubleshooting
-
-To test whether the installation was successful, visit a
-[demo website](https://webauthn.io/) and try to register and login.
-
-### Linux
-
-If you have issues with the demo website, the following commands should help you
-understand whether OpenSK was installed properly.
-
-When plugging in the USB key, the following line should appear in `lsusb`.
-
-```shell
-$ lsusb
-...
-Bus XXX Device YYY: ID 1915:521f Nordic Semiconductor ASA OpenSK
-```
-
-You should also see lines similar to the following in `dmesg`.
-
-```shell
-$ dmesg
-...
-[XXX] usb A-BB: new full-speed USB device number 00 using xhci_hcd
-[XXX] usb A-BB: New USB device found, idVendor=1915, idProduct=521f, bcdDevice= 0.01
-[XXX] usb A-BB: New USB device strings: Mfr=1, Product=2, SerialNumber=3
-[XXX] usb A-BB: Product: OpenSK
-[XXX] usb A-BB: Manufacturer: Nordic Semiconductor ASA
-[XXX] usb A-BB: SerialNumber: v0.1
-[XXX] hid-generic 0000:0000:0000.0000: hiddev0,hidraw0: USB HID v1.10 Device [Nordic Semiconductor ASA OpenSK] on usb-0000:00:00.0-00/input0
-```
-
-### Mac OS X
-
-If you have issues with the demo website, the following commands should help you
-understand whether OpenSK was installed properly.
-
-When plugging in the USB key, you should see a similar line by using the `ioreg`
-tool:
-
-```shell
-$ ioreg -p IOUSB
-+-o Root  <class IORegistryEntry, id 0x100000100, retain 21>
-...
-  +-o AppleUSBXHCI Root Hub Simulation@14000000  <class AppleUSBRootHubDevice, id 0x100000a00, registered, matched, active, busy 0 (0 ms), retain 9>
-    +-o OpenSK@14400000  <class AppleUSBDevice, id 0x100003c04, registered, matched, active, busy 0 (0 ms), retain 13>
-```

examples/erase_storage.rs

@@ -0,0 +1,53 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#![no_std]
+
+extern crate lang_items;
+
+use core::fmt::Write;
+use ctap2::embedded_flash::new_storage;
+use libtock_drivers::console::Console;
+use libtock_drivers::led;
+use libtock_drivers::result::FlexUnwrap;
+use persistent_store::{Storage, StorageIndex};
+
+fn is_page_erased(storage: &dyn Storage, page: usize) -> bool {
+    let index = StorageIndex { page, byte: 0 };
+    let length = storage.page_size();
+    storage
+        .read_slice(index, length)
+        .unwrap()
+        .iter()
+        .all(|&x| x == 0xff)
+}
+
+fn main() {
+    led::get(1).flex_unwrap().on().flex_unwrap(); // red on dongle
+    const NUM_PAGES: usize = 20; // should be at least ctap::storage::NUM_PAGES
+    let mut storage = new_storage(NUM_PAGES);
+    writeln!(Console::new(), "Erase {} pages of storage:", NUM_PAGES).unwrap();
+    for page in 0..NUM_PAGES {
+        write!(Console::new(), "- Page {} ", page).unwrap();
+        if is_page_erased(&storage, page) {
+            writeln!(Console::new(), "skipped (was already erased).").unwrap();
+        } else {
+            storage.erase_page(page).unwrap();
+            writeln!(Console::new(), "erased.").unwrap();
+        }
+    }
+    writeln!(Console::new(), "Done.").unwrap();
+    led::get(1).flex_unwrap().off().flex_unwrap();
+    led::get(0).flex_unwrap().on().flex_unwrap(); // green on dongle
+}

examples/nfct_test.rs

@@ -31,6 +31,8 @@ mod example {
     use libtock_drivers::timer::Timestamp;
 
     #[derive(Copy, Clone, Debug, PartialEq)]
+    // The actual lint upper_case_acronyms is not supported in all toolchains.
+    #[allow(clippy::all)]
     enum ReturnCode {
         /// Operation completed successfully
         SUCCESS,

fuzz/Cargo.lock

@@ -0,0 +1,589 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "aho-corasick"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "arbitrary"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db55d72333851e17d572bec876e390cd3b11eb1ef53ae821dd9f3b653d2b4569"
+
+[[package]]
+name = "arrayref"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
+
+[[package]]
+name = "autocfg"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dde43e75fd43e8a1bf86103336bc699aa8d17ad1be60c76c0bdfd4828e19b78"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bumpalo"
+version = "3.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1e260c3a9040a7c19a12468758f4c16f31a81a1fe087482be9570ec864bb6c"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cbor"
+version = "0.1.0"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cloudabi"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "crypto"
+version = "0.1.0"
+dependencies = [
+ "arrayref",
+ "byteorder",
+ "cbor",
+ "hex",
+ "libtock_drivers",
+ "rand",
+ "regex",
+ "ring",
+ "serde",
+ "serde_json",
+ "subtle",
+ "untrusted",
+]
+
+[[package]]
+name = "ctap2"
+version = "1.0.0"
+dependencies = [
+ "arrayref",
+ "byteorder",
+ "cbor",
+ "crypto",
+ "lang_items",
+ "libtock_core",
+ "libtock_drivers",
+ "persistent_store",
+ "subtle",
+ "uuid",
+]
+
+[[package]]
+name = "ctap2-fuzz"
+version = "0.0.0"
+dependencies = [
+ "fuzz_helper",
+ "libfuzzer-sys",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "fuzz_helper"
+version = "0.1.0"
+dependencies = [
+ "arrayref",
+ "cbor",
+ "crypto",
+ "ctap2",
+ "lang_items",
+ "libtock_drivers",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "805026a5d0141ffc30abb3be3173848ad46a1b1664fe632428479619a3644d77"
+
+[[package]]
+name = "itoa"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lang_items"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+ "libtock_drivers",
+ "linked_list_allocator",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.135"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68783febc7782c6c5cb401fbda4de5a9898be1762314da0bb2c10ced61f18b0c"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcf184a4b6b274f82a5df6b357da6055d3e82272327bba281c28bbba6f1664ef"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "libtock_codegen"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libtock_core"
+version = "0.1.0"
+dependencies = [
+ "libtock_codegen",
+]
+
+[[package]]
+name = "libtock_drivers"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+]
+
+[[package]]
+name = "linked_list_allocator"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "822add9edb1860698b79522510da17bef885171f75aa395cff099d770c609c24"
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "once_cell"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f7254b99e31cad77da24b08ebf628882739a608578bb1bcdfc1f9c21260d7c0"
+
+[[package]]
+name = "persistent_store"
+version = "0.1.0"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
+dependencies = [
+ "autocfg 0.1.8",
+ "libc",
+ "rand_chacha",
+ "rand_core 0.4.2",
+ "rand_hc",
+ "rand_isaac",
+ "rand_jitter",
+ "rand_os",
+ "rand_pcg",
+ "rand_xorshift",
+ "winapi",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556d3a1ca6600bfcbab7c7c91ccb085ac7fbbcd70e008a98742e7847f4f7bcef"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_hc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b40677c7be09ae76218dc623efbf7b18e34bced3f38883af07bb75630a21bc4"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_isaac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded997c9d5f13925be2a6fd7e66bf1872597f759fd9dd93513dd7e92e5a5ee08"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_jitter"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1166d5c91dc97b88d1decc3285bb0a99ed84b05cfd0bc2341bdf2d43fc41e39b"
+dependencies = [
+ "libc",
+ "rand_core 0.4.2",
+ "winapi",
+]
+
+[[package]]
+name = "rand_os"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b75f676a1e053fc562eafbb47838d67c84801e38fc1ba459e8f180deabd5071"
+dependencies = [
+ "cloudabi",
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.4.2",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abf9b09b01790cfe0364f52bf32995ea3c39f4d2dd011eac241d2914146d0b44"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbf7e9e623549b0e21f6e97cf8ecf247c1a8fd2e8a992ae265314300b2455d5c"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"
+
+[[package]]
+name = "serde"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728eb6351430bccb993660dfffc5a72f91ccc1295abaa8ce19b27ebe4f75568b"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81fa1584d3d1bcacd84c277a0dfe21f5b0f6accf4a23d04d4c6d61f1af522b4c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41feea4228a6f1cd09ec7a3593a682276702cd67b5273544757dae23c096f074"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "subtle"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+
+[[package]]
+name = "syn"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e90cde112c4b9690b8cbe810cba9ddd8bc1d7472e2cae317b69e9438c1cba7d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "web-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

fuzz/make_corpus.py

@@ -29,7 +29,7 @@ def make_corpus(corpus_dir, corpus_json):
 
   if os.path.isfile(corpus_json) and \
     os.path.splitext(corpus_json)[-1] == ".json":
-    with open(corpus_json) as corpus_file:
+    with open(corpus_json, encoding="utf-8") as corpus_file:
       corpus = json.load(corpus_file)
   else:
     raise TypeError

fuzzing_setup.sh

@@ -20,4 +20,4 @@ done_text="$(tput bold)DONE.$(tput sgr0)"
 set -e
 
 # Install cargo-fuzz library.
-cargo install cargo-fuzz
+cargo +stable install cargo-fuzz

libraries/cbor/Cargo.lock

@@ -0,0 +1,5 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "cbor"
+version = "0.1.0"

libraries/cbor/fuzz/Cargo.lock

@@ -0,0 +1,35 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "arbitrary"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db55d72333851e17d572bec876e390cd3b11eb1ef53ae821dd9f3b653d2b4569"
+
+[[package]]
+name = "cbor"
+version = "0.1.0"
+
+[[package]]
+name = "cbor-fuzz"
+version = "0.0.0"
+dependencies = [
+ "cbor",
+ "libfuzzer-sys",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcf184a4b6b274f82a5df6b357da6055d3e82272327bba281c28bbba6f1664ef"
+dependencies = [
+ "arbitrary",
+ "cc",
+]

libraries/crypto/Cargo.lock

@@ -0,0 +1,492 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "aho-corasick"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "arrayref"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
+
+[[package]]
+name = "autocfg"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dde43e75fd43e8a1bf86103336bc699aa8d17ad1be60c76c0bdfd4828e19b78"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bumpalo"
+version = "3.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1e260c3a9040a7c19a12468758f4c16f31a81a1fe087482be9570ec864bb6c"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cbor"
+version = "0.1.0"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cloudabi"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "crypto"
+version = "0.1.0"
+dependencies = [
+ "arrayref",
+ "byteorder",
+ "cbor",
+ "hex",
+ "libtock_drivers",
+ "rand",
+ "regex",
+ "ring",
+ "serde",
+ "serde_json",
+ "subtle",
+ "untrusted",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "hex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "805026a5d0141ffc30abb3be3173848ad46a1b1664fe632428479619a3644d77"
+
+[[package]]
+name = "itoa"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.134"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
+
+[[package]]
+name = "libtock_codegen"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libtock_core"
+version = "0.1.0"
+dependencies = [
+ "libtock_codegen",
+]
+
+[[package]]
+name = "libtock_drivers"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "once_cell"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f7254b99e31cad77da24b08ebf628882739a608578bb1bcdfc1f9c21260d7c0"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
+dependencies = [
+ "autocfg 0.1.8",
+ "libc",
+ "rand_chacha",
+ "rand_core 0.4.2",
+ "rand_hc",
+ "rand_isaac",
+ "rand_jitter",
+ "rand_os",
+ "rand_pcg",
+ "rand_xorshift",
+ "winapi",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556d3a1ca6600bfcbab7c7c91ccb085ac7fbbcd70e008a98742e7847f4f7bcef"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_hc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b40677c7be09ae76218dc623efbf7b18e34bced3f38883af07bb75630a21bc4"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_isaac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded997c9d5f13925be2a6fd7e66bf1872597f759fd9dd93513dd7e92e5a5ee08"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_jitter"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1166d5c91dc97b88d1decc3285bb0a99ed84b05cfd0bc2341bdf2d43fc41e39b"
+dependencies = [
+ "libc",
+ "rand_core 0.4.2",
+ "winapi",
+]
+
+[[package]]
+name = "rand_os"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b75f676a1e053fc562eafbb47838d67c84801e38fc1ba459e8f180deabd5071"
+dependencies = [
+ "cloudabi",
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.4.2",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abf9b09b01790cfe0364f52bf32995ea3c39f4d2dd011eac241d2914146d0b44"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbf7e9e623549b0e21f6e97cf8ecf247c1a8fd2e8a992ae265314300b2455d5c"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"
+
+[[package]]
+name = "serde"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728eb6351430bccb993660dfffc5a72f91ccc1295abaa8ce19b27ebe4f75568b"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.145"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81fa1584d3d1bcacd84c277a0dfe21f5b0f6accf4a23d04d4c6d61f1af522b4c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41feea4228a6f1cd09ec7a3593a682276702cd67b5273544757dae23c096f074"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "subtle"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+
+[[package]]
+name = "syn"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e90cde112c4b9690b8cbe810cba9ddd8bc1d7472e2cae317b69e9438c1cba7d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "web-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

libraries/persistent_store/Cargo.lock

@@ -0,0 +1,5 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "persistent_store"
+version = "0.1.0"

libraries/persistent_store/fuzz/.gitignore

@@ -1,4 +1,3 @@
-/Cargo.lock
 /artifacts/
 /corpus/
 /target/

libraries/persistent_store/fuzz/Cargo.lock

@@ -0,0 +1,124 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "arbitrary"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db55d72333851e17d572bec876e390cd3b11eb1ef53ae821dd9f3b653d2b4569"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "fuzz-store"
+version = "0.0.0"
+dependencies = [
+ "libfuzzer-sys",
+ "persistent_store",
+ "rand_core",
+ "rand_pcg",
+ "strum",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcf184a4b6b274f82a5df6b357da6055d3e82272327bba281c28bbba6f1664ef"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "persistent_store"
+version = "0.1.0"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+
+[[package]]
+name = "rand_pcg"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "strum"
+version = "0.19.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b89a286a7e3b5720b9a477b23253bc50debac207c8d21505f8e70b36792f11b5"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.19.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e61bb0be289045cb80bfce000512e32d09f8337e54c186725da381377ad1f8d5"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e90cde112c4b9690b8cbe810cba9ddd8bc1d7472e2cae317b69e9438c1cba7d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fdbf052a0783de01e944a6ce7a8cb939e295b1e7be835a1112c3b9a7f047a5a"

libraries/persistent_store/src/format.rs

@@ -335,12 +335,12 @@ impl Format {
     }
 
     /// Builds the storage representation of an init info.
-    pub fn build_init(&self, init: InitInfo) -> WordSlice {
+    pub fn build_init(&self, init: InitInfo) -> StoreResult<WordSlice> {
         let mut word = ERASED_WORD;
-        INIT_CYCLE.set(&mut word, init.cycle);
-        INIT_PREFIX.set(&mut word, init.prefix);
-        WORD_CHECKSUM.set(&mut word, 0);
-        word.as_slice()
+        INIT_CYCLE.set(&mut word, init.cycle)?;
+        INIT_PREFIX.set(&mut word, init.prefix)?;
+        WORD_CHECKSUM.set(&mut word, 0)?;
+        Ok(word.as_slice())
     }
 
     /// Returns the storage index of the compact info of a page.
@@ -368,36 +368,36 @@ impl Format {
     }
 
     /// Builds the storage representation of a compact info.
-    pub fn build_compact(&self, compact: CompactInfo) -> WordSlice {
+    pub fn build_compact(&self, compact: CompactInfo) -> StoreResult<WordSlice> {
         let mut word = ERASED_WORD;
-        COMPACT_TAIL.set(&mut word, compact.tail);
-        WORD_CHECKSUM.set(&mut word, 0);
-        word.as_slice()
+        COMPACT_TAIL.set(&mut word, compact.tail)?;
+        WORD_CHECKSUM.set(&mut word, 0)?;
+        Ok(word.as_slice())
     }
 
     /// Builds the storage representation of an internal entry.
-    pub fn build_internal(&self, internal: InternalEntry) -> WordSlice {
+    pub fn build_internal(&self, internal: InternalEntry) -> StoreResult<WordSlice> {
         let mut word = ERASED_WORD;
         match internal {
             InternalEntry::Erase { page } => {
-                ID_ERASE.set(&mut word);
-                ERASE_PAGE.set(&mut word, page);
+                ID_ERASE.set(&mut word)?;
+                ERASE_PAGE.set(&mut word, page)?;
             }
             InternalEntry::Clear { min_key } => {
-                ID_CLEAR.set(&mut word);
-                CLEAR_MIN_KEY.set(&mut word, min_key);
+                ID_CLEAR.set(&mut word)?;
+                CLEAR_MIN_KEY.set(&mut word, min_key)?;
             }
             InternalEntry::Marker { count } => {
-                ID_MARKER.set(&mut word);
-                MARKER_COUNT.set(&mut word, count);
+                ID_MARKER.set(&mut word)?;
+                MARKER_COUNT.set(&mut word, count)?;
             }
             InternalEntry::Remove { key } => {
-                ID_REMOVE.set(&mut word);
-                REMOVE_KEY.set(&mut word, key);
+                ID_REMOVE.set(&mut word)?;
+                REMOVE_KEY.set(&mut word, key)?;
             }
         }
-        WORD_CHECKSUM.set(&mut word, 0);
-        word.as_slice()
+        WORD_CHECKSUM.set(&mut word, 0)?;
+        Ok(word.as_slice())
     }
 
     /// Parses the first word of an entry from its storage representation.
@@ -459,31 +459,31 @@ impl Format {
     }
 
     /// Builds the storage representation of a user entry.
-    pub fn build_user(&self, key: Nat, value: &[u8]) -> Vec<u8> {
+    pub fn build_user(&self, key: Nat, value: &[u8]) -> StoreResult<Vec<u8>> {
         let length = usize_to_nat(value.len());
         let word_size = self.word_size();
         let footer = self.bytes_to_words(length);
         let mut result = vec![0xff; ((1 + footer) * word_size) as usize];
         result[word_size as usize..][..length as usize].copy_from_slice(value);
         let mut word = ERASED_WORD;
-        ID_HEADER.set(&mut word);
+        ID_HEADER.set(&mut word)?;
         if footer > 0 && is_erased(&result[(footer * word_size) as usize..]) {
             HEADER_FLIPPED.set(&mut word);
             *result.last_mut().unwrap() = 0x7f;
         }
-        HEADER_LENGTH.set(&mut word, length);
-        HEADER_KEY.set(&mut word, key);
+        HEADER_LENGTH.set(&mut word, length)?;
+        HEADER_KEY.set(&mut word, key)?;
         HEADER_CHECKSUM.set(
             &mut word,
             count_zeros(&result[(footer * word_size) as usize..]),
-        );
+        )?;
         result[..word_size as usize].copy_from_slice(&word.as_slice());
-        result
+        Ok(result)
     }
 
     /// Sets the padding bit in the first word of a user entry.
-    pub fn set_padding(&self, word: &mut Word) {
-        ID_PADDING.set(word);
+    pub fn set_padding(&self, word: &mut Word) -> StoreResult<()> {
+        ID_PADDING.set(word)
     }
 
     /// Sets the deleted bit in the first word of a user entry.

libraries/persistent_store/src/format/bitfield.rs

@@ -42,15 +42,20 @@ impl Field {
 
     /// Sets the value of a bit field.
     ///
-    /// # Preconditions
+    /// # Errors
     ///
     /// - The value must fit in the bit field: `num_bits(value) < self.len`.
     /// - The value must only change bits from 1 to 0: `self.get(*word) & value == value`.
-    pub fn set(&self, word: &mut Word, value: Nat) {
-        debug_assert_eq!(value & self.mask(), value);
+    pub fn set(&self, word: &mut Word, value: Nat) -> StoreResult<()> {
+        if value & self.mask() != value {
+            return Err(StoreError::InvalidStorage);
+        }
         let mask = !(self.mask() << self.pos);
         word.0 &= mask | (value << self.pos);
-        debug_assert_eq!(self.get(*word), value);
+        if self.get(*word) != value {
+            return Err(StoreError::InvalidStorage);
+        }
+        Ok(())
     }
 
     /// Returns a bit mask the length of the bit field.
@@ -82,8 +87,8 @@ impl ConstField {
     }
 
     /// Sets the bit field to its value.
-    pub fn set(&self, word: &mut Word) {
-        self.field.set(word, self.value);
+    pub fn set(&self, word: &mut Word) -> StoreResult<()> {
+        self.field.set(word, self.value)
     }
 }
 
@@ -135,15 +140,15 @@ impl Checksum {
 
     /// Sets the checksum to the external increment value.
     ///
-    /// # Preconditions
+    /// # Errors
     ///
     /// - The bits of the checksum bit field should be set to one: `self.field.get(*word) ==
     ///   self.field.mask()`.
     /// - The checksum value should fit in the checksum bit field: `num_bits(word.count_zeros() +
     ///   value) < self.field.len`.
-    pub fn set(&self, word: &mut Word, value: Nat) {
+    pub fn set(&self, word: &mut Word, value: Nat) -> StoreResult<()> {
         debug_assert_eq!(self.field.get(*word), self.field.mask());
-        self.field.set(word, word.0.count_zeros() + value);
+        self.field.set(word, word.0.count_zeros() + value)
     }
 }
 
@@ -290,7 +295,7 @@ mod tests {
         assert_eq!(field.get(Word(0x000000f8)), 0x1f);
         assert_eq!(field.get(Word(0x0000ff37)), 6);
         let mut word = Word(0xffffffff);
-        field.set(&mut word, 3);
+        field.set(&mut word, 3).unwrap();
         assert_eq!(word, Word(0xffffff1f));
     }
 
@@ -305,7 +310,7 @@ mod tests {
         assert!(field.check(Word(0x00000048)));
         assert!(field.check(Word(0x0000ff4f)));
         let mut word = Word(0xffffffff);
-        field.set(&mut word);
+        field.set(&mut word).unwrap();
         assert_eq!(word, Word(0xffffff4f));
     }
 
@@ -333,7 +338,7 @@ mod tests {
         assert_eq!(field.get(Word(0x00ffff67)), Ok(4));
         assert_eq!(field.get(Word(0x7fffff07)), Err(StoreError::InvalidStorage));
         let mut word = Word(0x0fffffff);
-        field.set(&mut word, 4);
+        field.set(&mut word, 4).unwrap();
         assert_eq!(word, Word(0x0fffff47));
     }
 

libraries/persistent_store/src/store.rs

@@ -270,7 +270,9 @@ impl<S: Storage> Store<S> {
         self.reserve(self.format.transaction_capacity(updates))?;
         // Write the marker entry.
         let marker = self.tail()?;
-        let entry = self.format.build_internal(InternalEntry::Marker { count });
+        let entry = self
+            .format
+            .build_internal(InternalEntry::Marker { count })?;
         self.write_slice(marker, &entry)?;
         self.init_page(marker, marker)?;
         // Write the updates.
@@ -278,7 +280,7 @@ impl<S: Storage> Store<S> {
         for update in updates {
             let length = match *update {
                 StoreUpdate::Insert { key, ref value } => {
-                    let entry = self.format.build_user(usize_to_nat(key), value);
+                    let entry = self.format.build_user(usize_to_nat(key), value)?;
                     let word_size = self.format.word_size();
                     let footer = usize_to_nat(entry.len()) / word_size - 1;
                     self.write_slice(tail, &entry[..(footer * word_size) as usize])?;
@@ -287,7 +289,7 @@ impl<S: Storage> Store<S> {
                 }
                 StoreUpdate::Remove { key } => {
                     let key = usize_to_nat(key);
-                    let remove = self.format.build_internal(InternalEntry::Remove { key });
+                    let remove = self.format.build_internal(InternalEntry::Remove { key })?;
                     self.write_slice(tail, &remove)?;
                     0
                 }
@@ -307,7 +309,9 @@ impl<S: Storage> Store<S> {
         if min_key > self.format.max_key() {
             return Err(StoreError::InvalidArgument);
         }
-        let clear = self.format.build_internal(InternalEntry::Clear { min_key });
+        let clear = self
+            .format
+            .build_internal(InternalEntry::Clear { min_key })?;
         // We always have one word available. We can't use `reserve` because this is internal
         // capacity, not user capacity.
         while self.immediate_capacity()? < 1 {
@@ -373,7 +377,7 @@ impl<S: Storage> Store<S> {
         if key > self.format.max_key() || value_len > self.format.max_value_len() {
             return Err(StoreError::InvalidArgument);
         }
-        let entry = self.format.build_user(key, value);
+        let entry = self.format.build_user(key, value)?;
         let entry_len = usize_to_nat(entry.len());
         self.reserve(entry_len / self.format.word_size())?;
         let tail = self.tail()?;
@@ -437,7 +441,7 @@ impl<S: Storage> Store<S> {
         let init_info = self.format.build_init(InitInfo {
             cycle: 0,
             prefix: 0,
-        });
+        })?;
         self.storage_write_slice(index, &init_info)
     }
 
@@ -646,7 +650,9 @@ impl<S: Storage> Store<S> {
         }
         let tail = max(self.tail()?, head.next_page(&self.format));
         let index = self.format.index_compact(head.page(&self.format));
-        let compact_info = self.format.build_compact(CompactInfo { tail: tail - head });
+        let compact_info = self
+            .format
+            .build_compact(CompactInfo { tail: tail - head })?;
         self.storage_write_slice(index, &compact_info)?;
         self.compact_copy()
     }
@@ -680,7 +686,7 @@ impl<S: Storage> Store<S> {
             self.init_page(tail, tail + (length - 1))?;
             tail += length;
         }
-        let erase = self.format.build_internal(InternalEntry::Erase { page });
+        let erase = self.format.build_internal(InternalEntry::Erase { page })?;
         self.write_slice(tail, &erase)?;
         self.init_page(tail, tail)?;
         self.compact_erase(tail)
@@ -792,7 +798,7 @@ impl<S: Storage> Store<S> {
         let init_info = self.format.build_init(InitInfo {
             cycle: new_first.cycle(&self.format),
             prefix: new_first.word(&self.format),
-        });
+        })?;
         self.storage_write_slice(index, &init_info)?;
         Ok(())
     }
@@ -800,7 +806,7 @@ impl<S: Storage> Store<S> {
     /// Sets the padding bit of a user header.
     fn set_padding(&mut self, pos: Position) -> StoreResult<()> {
         let mut word = Word::from_slice(self.read_word(pos));
-        self.format.set_padding(&mut word);
+        self.format.set_padding(&mut word)?;
         self.write_slice(pos, &word.as_slice())?;
         Ok(())
     }
@@ -1110,10 +1116,12 @@ impl Store<BufferStorage> {
         let format = Format::new(storage).unwrap();
         // Write the init info of the first page.
         let mut index = format.index_init(0);
-        let init_info = format.build_init(InitInfo {
-            cycle: usize_to_nat(cycle),
-            prefix: 0,
-        });
+        let init_info = format
+            .build_init(InitInfo {
+                cycle: usize_to_nat(cycle),
+                prefix: 0,
+            })
+            .unwrap();
         storage.write_slice(index, &init_info).unwrap();
         // Pad the first word of the page. This makes the store looks used, otherwise we may confuse
         // it with a partially initialized store.

metadata/metadata.json

@@ -1,46 +1,94 @@
 {
-   "assertionScheme": "FIDOV2",
-   "keyProtection": 1,
-   "attestationRootCertificates": [],
-   "aaguid": "664d9f67-84a2-412a-9ff7-b4f7d8ee6d05",
-   "publicKeyAlgAndEncoding": 260,
-   "protocolFamily": "fido2",
-   "upv": [
+  "legalHeader": "Submission of this statement and retrieval and use of this statement indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/.",
+  "aaguid": "664d9f67-84a2-412a-9ff7-b4f7d8ee6d05",
+  "description": "OpenSK authenticator",
+  "authenticatorVersion": 1,
+  "protocolFamily": "fido2",
+  "schema": 3,
+  "upv": [
+    {
+      "major": 1,
+      "minor": 0
+    }
+  ],
+  "authenticationAlgorithms": [
+    "secp256r1_ecdsa_sha256_raw"
+  ],
+  "publicKeyAlgAndEncodings": [
+    "ecc_x962_raw",
+    "cose"
+  ],
+  "attestationTypes": [
+    "basic_surrogate"
+  ],
+  "userVerificationDetails": [
+    [
       {
-         "major": 1,
-         "minor": 0
-      }
-   ],
-   "icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAQKADAAQAAAABAAAAQAAAAABGUUKwAAAIQ0lEQVR4Ae1aCVSUVRT+kGVYBBQFBYzYFJFNLdPQVksz85QnszRNbaPNzDI0OaIH27VUUnOpzAqXMJNIszKTUEQWRXBnExRiUYEUBATs3lfzJw3LDP/MMOfMPI/M++97///uve+++9797jO7TgVGXLoYsexCdJMCTBZg5BowLQEjNwCYLMBkAUauAdMSMHIDgEVnKqC8/AKOZh2Do6MDAgMGwMbaWu/s6FUBTU1NyMnNQ8bRTPqfheI/SySBzc3N4devLwaGBGFgcBBcXJylNl1WzHQdDVbX1CDr2HEcJYEz6be6ukYteVxdewtFsEL6+vqgSxfduCudKaCgsBCbt27Dmexc8MzLKba2tggOCkDYszNgZmYm51Mq7+pGrTRMcXEJTp3Oli08c1xDVpR8KBW6gC50pgAVVRsoQWcKcHd3w4jht6N7924GKvo/bGl1F+C1fu78eWH+TdebcOeIUEyfOhkHk1OwJXY7OcBqg1OG1hRwICkZ38fF48LFS82EdHLqjkmPT8DihRF4b8nH4L3fkIrsJcCO6cuvYrD+i40qwrOgly5VYNWn65GUfAjhb7wGKysrQ5Jffji8a/ev2PfH/naF2rY9jma/HA+PG9tuX312kLUErly5grj4H9XmN3b7Dix4Kxz33n2H2u+czs5B9Mo1sLS01MlhSJYC0g5noL7+WjNh+NAydsxoMnVL/ETWcamiQmrPzy9AZWUV2C+oW/hY7KTDnUSWDygoKFSRY/pTk0kBo3D/yHvwyovPq7SXlpWr0Noi/PZ7gvAtDg4ObXXrcJssBdTV16sM7O7mJtFaDmhUE1HFxX/SqfGM9J6ykpySim82bRWPHjf1UZK1+itLAT1aMOWkg4ckBhMSVZ2ju5ur1M47yO5f9iAy6l18sHQ59tJsK0vigYNYu36DdPz18vJUNmn1V5YP4Bg+fufuZgz5+nhLzzY2NlKdKwED+qOJhN7xw04h2PETJ0V4rOz0VcwWnDh1WgQ8qWmHlWTxHBIcKD1rsyJLARy/e3t5Ii//rODJx9sLgwYGS/zdessgxGz+Fo2NjWL/f2LiBPxICtuzd5/U5/+VtPQj/yfB368fujk6qtC1QZC1BJiBZ5+eBtt/Z/qxRx9pxpODvT2G3z4UFhYWCHtuBi5fvgx2apqWUaNGavqK2v21ggcUFJ4Th6FpUyapDHzh4kXU1taK7W/l6nWoratT6dMWwfNmDyxa8FZbXWS1aUUB7XGQkZmF5dGr2+um0s7gx8KIufD0vFmlTVsE2UtAHUaCAwMI1vrPOarzDvcZN3aMToXnMfSiAMbzXnj+GXTrpr4jGzwoBOMffoh51GnRiwJYgh5OTpj35utqefOgwAGE/z2tdfyvJU3qxQfcOHAZHYU/Wb2WgJOiG8lSfXjoMMx4agrtHOYSTZcVvSuAham/dg2bt8Ti94RESTYbG2tMfXISQofdJtH0UekUBSgFY+g89rs4uLn1xrgHx8DevquySW+/naoAvUnZxkB6c4Jt8NCpTSYFdKr6DWDwDltAQ0Mjjh0/ifQjGWBsUFflfFERODTOyzsrDVFRUYnsnFzpuZ6AmRMnT3UIcu9QOMwBzocfrSDBq2FHGGBlVRVeCnuGQuEQiSltVDZs/AaHUtLg4XGTSLj08/XFrJkvIjX9MIGxu7BqxVKBKzAkn5uXT3HDPI2H7ZACNm2OFZcZoiLnw5ouNTDau/7zjVi29H1crb2KSpohOzs7nKVtjpnmCxDKwtgBzyBjCV272lGIfAWlZWXo5eKCMzk56EOQWq9eLigimCwh8QDmz52Dfn19UFpahrkRC8nqTig/JX7j4nciM+s4IubNaTZOs05tPGisAAY3+FbH1MmPC+H526PvH4mdu36mVHi2SITE0CHHxbkneJn8RRjA4kUR4ij8+YavxZLp2cNJoMVRkRHIzc8X0FcfyiU2NV0nwYso/J0vhOFLEympaXB3dxVKWfdpNCyIVkLK4JKSli4s4dWXw9BRzFBjH8D5PVbCjYENAx8c8FRV/SUY4z8L5ofjnagFQpB9dOLjmU88kIRIokdRmsy1d2/8smev6N/Q0IDXX3uF6Cy4o1jP/E1GlY9kZOLV2eGIXrUGZWQpyosSdYQrfEam70hocf/+ftK4mlY0VoBC8c89ntra/4ANFoATowprhRifESCFQgGeQR8vTzLxchQSaMLx/ScEikRELhYmXkaZIjP6x4UF5sLoEjs1LgyvLXl/MebMnolGsqa3310ilg+38Zh33TEC1+lfzL/IMdM1LRovAYXCSpgbz8ywoUPEeMp16evtTevxWDMeKigRwibPCuHZmzXzBVhZWgnGrSjbc/KUKhzOH2BInBMrbEn+NMPeXl4Ie3mWBKJyAubJSRPFzZGPlq9ECF2lGXLL4GZjq/OgsQL4oxMnjMey6FVY95k5nJ17CJCT/YDyLgDf6NhEfoADHN6ewt+YJYANPuszzs+MJlHK/B5KkXUxa9kI/f38sGXrd1i6LBpBgQG07eUJ6/D29kT64QwpVOa2kffeJRK0PAFKHtQRnvuYL6KibmdlP0548OUl9sx8BuAs0AOj7xPNnC3KpT2bEWEOeR98YJTYHi1pWQy5dTBKSkpxlvoM8PcjwHSYgMl5yfAdIC41NVfhRRAYO7XQ0KGEJ9aJJcROddqUyXDuyc61ATa2Ngjw7y/eYdSYcUcubjfkHQShnT9aD4YS/tiP7TviseLjD9oZ2jCaW7Y/GbzZkzPz8NBNGksGW62+qnULaHUkA23QugUYqJytsmVSQKuqMZIGkwUYyUS3KqbJAlpVjZE0mCzASCa6VTH/Bnoy/0KF7w+OAAAAAElFTkSuQmCC",
-   "matcherProtection": 1,
-   "supportedExtensions": [
-      {
-         "id": "hmac-secret",
-         "fail_if_unknown": false
+        "userVerificationMethod": "presence_internal"
       },
       {
-         "id": "credProtect",
-         "fail_if_unknown": false
+        "userVerificationMethod": "passcode_external",
+        "caDesc": {
+          "base": 10,
+          "minLength": 4,
+          "maxRetries": 8,
+          "blockSlowdown": 0
+        }
       }
-   ],
-   "cryptoStrength": 128,
-   "description": "OpenSK authenticator",
-   "authenticatorVersion": 1,
-   "isSecondFactorOnly": false,
-   "userVerificationDetails": [
-      [
-         {
-            "userVerification": 1
-         },
-         {
-            "userVerification": 4
-         }
-      ]
-   ],
-   "attachmentHint": 6,
-   "attestationTypes": [
-      15880
-   ],
-   "authenticationAlgorithm": 1,
-   "tcDisplay": 0
+    ],
+    [
+      {
+        "userVerificationMethod": "presence_internal"
+      }
+    ],
+    [
+      {
+        "userVerificationMethod": "none"
+      }
+    ],
+    [
+      {
+        "userVerificationMethod": "passcode_external",
+        "caDesc": {
+          "base": 10,
+          "minLength": 4,
+          "maxRetries": 8,
+          "blockSlowdown": 0
+        }
+      }
+    ]
+  ],
+  "keyProtection": [
+    "hardware"
+  ],
+  "matcherProtection": [
+    "on_chip"
+  ],
+  "cryptoStrength": 128,
+  "attachmentHint": [
+    "external",
+    "wired"
+  ],
+  "tcDisplay": [],
+  "attestationRootCertificates": [],
+  "icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAQKADAAQAAAABAAAAQAAAAABGUUKwAAAIQ0lEQVR4Ae1aCVSUVRT+kGVYBBQFBYzYFJFNLdPQVksz85QnszRNbaPNzDI0OaIH27VUUnOpzAqXMJNIszKTUEQWRXBnExRiUYEUBATs3lfzJw3LDP/MMOfMPI/M++97///uve+++9797jO7TgVGXLoYsexCdJMCTBZg5BowLQEjNwCYLMBkAUauAdMSMHIDgEVnKqC8/AKOZh2Do6MDAgMGwMbaWu/s6FUBTU1NyMnNQ8bRTPqfheI/SySBzc3N4devLwaGBGFgcBBcXJylNl1WzHQdDVbX1CDr2HEcJYEz6be6ukYteVxdewtFsEL6+vqgSxfduCudKaCgsBCbt27Dmexc8MzLKba2tggOCkDYszNgZmYm51Mq7+pGrTRMcXEJTp3Oli08c1xDVpR8KBW6gC50pgAVVRsoQWcKcHd3w4jht6N7924GKvo/bGl1F+C1fu78eWH+TdebcOeIUEyfOhkHk1OwJXY7OcBqg1OG1hRwICkZ38fF48LFS82EdHLqjkmPT8DihRF4b8nH4L3fkIrsJcCO6cuvYrD+i40qwrOgly5VYNWn65GUfAjhb7wGKysrQ5Jffji8a/ev2PfH/naF2rY9jma/HA+PG9tuX312kLUErly5grj4H9XmN3b7Dix4Kxz33n2H2u+czs5B9Mo1sLS01MlhSJYC0g5noL7+WjNh+NAydsxoMnVL/ETWcamiQmrPzy9AZWUV2C+oW/hY7KTDnUSWDygoKFSRY/pTk0kBo3D/yHvwyovPq7SXlpWr0Noi/PZ7gvAtDg4ObXXrcJssBdTV16sM7O7mJtFaDmhUE1HFxX/SqfGM9J6ykpySim82bRWPHjf1UZK1+itLAT1aMOWkg4ckBhMSVZ2ju5ur1M47yO5f9iAy6l18sHQ59tJsK0vigYNYu36DdPz18vJUNmn1V5YP4Bg+fufuZgz5+nhLzzY2NlKdKwED+qOJhN7xw04h2PETJ0V4rOz0VcwWnDh1WgQ8qWmHlWTxHBIcKD1rsyJLARy/e3t5Ii//rODJx9sLgwYGS/zdessgxGz+Fo2NjWL/f2LiBPxICtuzd5/U5/+VtPQj/yfB368fujk6qtC1QZC1BJiBZ5+eBtt/Z/qxRx9pxpODvT2G3z4UFhYWCHtuBi5fvgx2apqWUaNGavqK2v21ggcUFJ4Th6FpUyapDHzh4kXU1taK7W/l6nWoratT6dMWwfNmDyxa8FZbXWS1aUUB7XGQkZmF5dGr2+um0s7gx8KIufD0vFmlTVsE2UtAHUaCAwMI1vrPOarzDvcZN3aMToXnMfSiAMbzXnj+GXTrpr4jGzwoBOMffoh51GnRiwJYgh5OTpj35utqefOgwAGE/z2tdfyvJU3qxQfcOHAZHYU/Wb2WgJOiG8lSfXjoMMx4agrtHOYSTZcVvSuAham/dg2bt8Ti94RESTYbG2tMfXISQofdJtH0UekUBSgFY+g89rs4uLn1xrgHx8DevquySW+/naoAvUnZxkB6c4Jt8NCpTSYFdKr6DWDwDltAQ0Mjjh0/ifQjGWBsUFflfFERODTOyzsrDVFRUYnsnFzpuZ6AmRMnT3UIcu9QOMwBzocfrSDBq2FHGGBlVRVeCnuGQuEQiSltVDZs/AaHUtLg4XGTSLj08/XFrJkvIjX9MIGxu7BqxVKBKzAkn5uXT3HDPI2H7ZACNm2OFZcZoiLnw5ouNTDau/7zjVi29H1crb2KSpohOzs7nKVtjpnmCxDKwtgBzyBjCV272lGIfAWlZWXo5eKCMzk56EOQWq9eLigimCwh8QDmz52Dfn19UFpahrkRC8nqTig/JX7j4nciM+s4IubNaTZOs05tPGisAAY3+FbH1MmPC+H526PvH4mdu36mVHi2SITE0CHHxbkneJn8RRjA4kUR4ij8+YavxZLp2cNJoMVRkRHIzc8X0FcfyiU2NV0nwYso/J0vhOFLEympaXB3dxVKWfdpNCyIVkLK4JKSli4s4dWXw9BRzFBjH8D5PVbCjYENAx8c8FRV/SUY4z8L5ofjnagFQpB9dOLjmU88kIRIokdRmsy1d2/8smev6N/Q0IDXX3uF6Cy4o1jP/E1GlY9kZOLV2eGIXrUGZWQpyosSdYQrfEam70hocf/+ftK4mlY0VoBC8c89ntra/4ANFoATowprhRifESCFQgGeQR8vTzLxchQSaMLx/ScEikRELhYmXkaZIjP6x4UF5sLoEjs1LgyvLXl/MebMnolGsqa3310ilg+38Zh33TEC1+lfzL/IMdM1LRovAYXCSpgbz8ywoUPEeMp16evtTevxWDMeKigRwibPCuHZmzXzBVhZWgnGrSjbc/KUKhzOH2BInBMrbEn+NMPeXl4Ie3mWBKJyAubJSRPFzZGPlq9ECF2lGXLL4GZjq/OgsQL4oxMnjMey6FVY95k5nJ17CJCT/YDyLgDf6NhEfoADHN6ewt+YJYANPuszzs+MJlHK/B5KkXUxa9kI/f38sGXrd1i6LBpBgQG07eUJ6/D29kT64QwpVOa2kffeJRK0PAFKHtQRnvuYL6KibmdlP0548OUl9sx8BuAs0AOj7xPNnC3KpT2bEWEOeR98YJTYHi1pWQy5dTBKSkpxlvoM8PcjwHSYgMl5yfAdIC41NVfhRRAYO7XQ0KGEJ9aJJcROddqUyXDuyc61ATa2Ngjw7y/eYdSYcUcubjfkHQShnT9aD4YS/tiP7TviseLjD9oZ2jCaW7Y/GbzZkzPz8NBNGksGW62+qnULaHUkA23QugUYqJytsmVSQKuqMZIGkwUYyUS3KqbJAlpVjZE0mCzASCa6VTH/Bnoy/0KF7w+OAAAAAElFTkSuQmCC",
+  "authenticatorGetInfo": {
+    "versions": [
+      "FIDO_2_0",
+      "U2F_V2"
+    ],
+    "extensions": [
+      "hmac-secret"
+    ],
+    "aaguid": "664d9f6784a2412a9ff7b4f7d8ee6d05",
+    "options": {
+      "rk": true,
+      "up": true,
+      "clientPin": false
+    },
+    "maxMsgSize": 1024,
+    "pinUvAuthProtocols": [
+      1
+    ]
+  }
 }

patches/libtock-rs/01-remove-test-runner.patch

@@ -0,0 +1,12 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index f5cb932..38119b5 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -62,6 +62,6 @@ exclude = [ "tock" ]
+ members = [
+     "codegen",
+     "core",
+-    "test_runner",
++    # "test_runner",
+     "tools/print_sizes",
+ ]

patches/tock/06-update-uicr.patch

@@ -1,5 +1,31 @@
+diff --git a/boards/nordic/nrf52_components/src/startup.rs b/boards/nordic/nrf52_components/src/startup.rs
+index 9ddb414fd..de47f10a7 100644
+--- a/boards/nordic/nrf52_components/src/startup.rs
++++ b/boards/nordic/nrf52_components/src/startup.rs
+@@ -46,6 +46,9 @@ impl Component for NrfStartupComponent {
+             erase_uicr |= !uicr.is_nfc_pins_protection_enabled();
+         }
+ 
++        // Avoid killing the DFU bootloader if present
++        let (dfu_start_addr, dfu_settings_addr) = uicr.get_dfu_params();
++
+         if erase_uicr {
+             nrf52::nvmc::NVMC.erase_uicr();
+         }
+@@ -55,6 +58,11 @@ impl Component for NrfStartupComponent {
+ 
+         let mut needs_soft_reset: bool = false;
+ 
++        // Restore DFU bootloader settings if we erased
++        if erase_uicr {
++            uicr.set_dfu_params(dfu_start_addr, dfu_settings_addr);
++        }
++
+         // Configure reset pins
+         if uicr
+             .get_psel0_reset_pin()
 diff --git a/chips/nrf52/src/uicr.rs b/chips/nrf52/src/uicr.rs
-index 6bb6c86..3bb8b5a 100644
+index 6bb6c86b7..0b388d75c 100644
 --- a/chips/nrf52/src/uicr.rs
 +++ b/chips/nrf52/src/uicr.rs
 @@ -1,38 +1,45 @@
@@ -97,4 +123,22 @@ index 6bb6c86..3bb8b5a 100644
      /// Setting of pins dedicated to NFC functionality: NFC antenna or GPIO
      NfcPins [
          /// Setting pins dedicated to NFC functionality
-
+@@ -176,6 +199,18 @@ impl Uicr {
+         self.registers.nfcpins.matches_all(NfcPins::PROTECT::NFC)
+     }
+ 
++    pub fn get_dfu_params(&self) -> (u32, u32) {
++        (
++            self.registers.nrffw[0].get(), // DFU start address
++            self.registers.nrffw[1].get(), // DFU settings address
++        )
++    }
++
++    pub fn set_dfu_params(&self, dfu_start_addr: u32, dfu_settings_addr: u32) {
++        self.registers.nrffw[0].set(dfu_start_addr);
++        self.registers.nrffw[1].set(dfu_settings_addr);
++    }
++
+     pub fn is_ap_protect_enabled(&self) -> bool {
+         // Here we compare to DISABLED value because any other value should enable the protection.
+         !self

setup-submodules.sh

@@ -56,19 +56,16 @@ echo $done_text
 )
 
 # Now apply patches to libtock-rs. Do that in a sub-shell.
-#
-# Commented out as there are not patches at the moment, and the pattern fails in
-# that case.
-#(
-#  cd third_party/libtock-rs/ && \
-#  for p in ../../patches/libtock-rs/[0-9][0-9]-*.patch
-#  do
-#    echo -n '[-] Applying patch "'$(basename $p)'"... '
-#    if git apply "$p"
-#    then
-#      echo $done_text
-#    else
-#      patch_conflict_detected
-#    fi
-#  done
-#)
+(
+  cd third_party/libtock-rs/ && \
+  for p in ../../patches/libtock-rs/[0-9][0-9]-*.patch
+  do
+    echo -n '[-] Applying patch "'$(basename $p)'"... '
+    if git apply "$p"
+    then
+      echo $done_text
+    else
+      patch_conflict_detected
+    fi
+  done
+)

setup.sh

@@ -37,13 +37,18 @@ check_command pip3
 source tools/gen_key_materials.sh
 generate_crypto_materials N
 
+# Install python dependencies (testresources) required by "launchpadlib",
+# which is used by one of the tockloader dependencies.
+pip3 install --user testresources
+
 rustup install $(head -n 1 rust-toolchain)
 pip3 install --user --upgrade 'tockloader==1.5' six intelhex
 rustup target add thumbv7em-none-eabi
 
 # Install dependency to create applications.
 mkdir -p elf2tab
-cargo install elf2tab --version 0.6.0 --root elf2tab/
+rustup install stable
+cargo +stable install elf2tab --version 0.6.0 --root elf2tab/
 
 # Install python dependencies to factory configure OpenSK (crypto, JTAG lockdown)
-pip3 install --user --upgrade colorama tqdm cryptography fido2
+pip3 install --user --upgrade colorama tqdm cryptography "fido2>=1.0.0"

src/ctap/apdu.rs

@@ -74,7 +74,7 @@ impl From<&[u8; APDU_HEADER_LEN]> for ApduHeader {
 
 #[cfg_attr(test, derive(Clone, Debug))]
 #[derive(PartialEq)]
-/// The APDU cases
+/// The Apdu cases
 pub enum Case {
     Le1,
     Lc1Data,
@@ -97,7 +97,7 @@ pub enum ApduType {
 #[cfg_attr(test, derive(Clone, Debug))]
 #[allow(dead_code)]
 #[derive(PartialEq)]
-pub struct APDU {
+pub struct Apdu {
     pub header: ApduHeader,
     pub lc: u16,
     pub data: Vec<u8>,
@@ -105,7 +105,7 @@ pub struct APDU {
     pub case_type: ApduType,
 }
 
-impl TryFrom<&[u8]> for APDU {
+impl TryFrom<&[u8]> for Apdu {
     type Error = ApduStatusCode;
 
     fn try_from(frame: &[u8]) -> Result<Self, ApduStatusCode> {
@@ -119,7 +119,7 @@ impl TryFrom<&[u8]> for APDU {
 
         if payload.is_empty() {
             // Lc is zero-bytes in length
-            return Ok(APDU {
+            return Ok(Apdu {
                 header: array_ref!(header, 0, APDU_HEADER_LEN).into(),
                 lc: 0x00,
                 data: Vec::new(),
@@ -132,7 +132,7 @@ impl TryFrom<&[u8]> for APDU {
         if payload.len() == 1 {
             // There is only one byte in the payload, that byte cannot be Lc because that would
             // entail at *least* one another byte in the payload (for the command data)
-            return Ok(APDU {
+            return Ok(Apdu {
                 header: array_ref!(header, 0, APDU_HEADER_LEN).into(),
                 lc: 0x00,
                 data: Vec::new(),
@@ -148,7 +148,7 @@ impl TryFrom<&[u8]> for APDU {
         if payload.len() == 1 + (byte_0 as usize) && byte_0 != 0 {
             // Lc is one-byte long and since the size specified by Lc covers the rest of the
             // payload there's no Le at the end
-            return Ok(APDU {
+            return Ok(Apdu {
                 header: array_ref!(header, 0, APDU_HEADER_LEN).into(),
                 lc: byte_0.into(),
                 data: payload[1..].to_vec(),
@@ -160,7 +160,7 @@ impl TryFrom<&[u8]> for APDU {
             // Lc is one-byte long and since the size specified by Lc covers the rest of the
             // payload with ONE additional byte that byte must be Le
             let last_byte: u32 = (*payload.last().unwrap()).into();
-            return Ok(APDU {
+            return Ok(Apdu {
                 header: array_ref!(header, 0, APDU_HEADER_LEN).into(),
                 lc: byte_0.into(),
                 data: payload[1..(payload.len() - 1)].to_vec(),
@@ -186,9 +186,9 @@ impl TryFrom<&[u8]> for APDU {
             if byte_0 == 0 && extended_apdu_le_len <= 3 {
                 // If first byte is zero AND the next two bytes can be parsed as a big-endian
                 // length that covers the rest of the block (plus few additional bytes for Le), we
-                // have an extended-length APDU
+                // have an extended-length Apdu
                 let last_byte: u32 = (*payload.last().unwrap()).into();
-                return Ok(APDU {
+                return Ok(Apdu {
                     header: array_ref!(header, 0, APDU_HEADER_LEN).into(),
                     lc: extended_apdu_lc as u16,
                     data: payload[3..(payload.len() - extended_apdu_le_len)].to_vec(),
@@ -243,8 +243,8 @@ impl TryFrom<&[u8]> for APDU {
 mod test {
     use super::*;
 
-    fn pass_frame(frame: &[u8]) -> Result<APDU, ApduStatusCode> {
-        APDU::try_from(frame)
+    fn pass_frame(frame: &[u8]) -> Result<Apdu, ApduStatusCode> {
+        Apdu::try_from(frame)
     }
 
     #[test]
@@ -252,7 +252,7 @@ mod test {
         let frame: [u8; 4] = [0x00, 0x12, 0x00, 0x80];
         let response = pass_frame(&frame);
         assert!(response.is_ok());
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0x12,
@@ -271,7 +271,7 @@ mod test {
     fn test_case_type_2_short() {
         let frame: [u8; 5] = [0x00, 0xb0, 0x00, 0x00, 0x0f];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0xb0,
@@ -290,7 +290,7 @@ mod test {
     fn test_case_type_2_short_le() {
         let frame: [u8; 5] = [0x00, 0xb0, 0x00, 0x00, 0x00];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0xb0,
@@ -310,7 +310,7 @@ mod test {
         let frame: [u8; 7] = [0x00, 0xa4, 0x00, 0x0c, 0x02, 0xe1, 0x04];
         let payload = [0xe1, 0x04];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0xa4,
@@ -332,7 +332,7 @@ mod test {
         ];
         let payload = [0xd2, 0x76, 0x00, 0x00, 0x85, 0x01, 0x01];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0xa4,
@@ -354,7 +354,7 @@ mod test {
         ];
         let payload = [0xd2, 0x76, 0x00, 0x00, 0x85, 0x01, 0x01];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0xa4,
@@ -396,7 +396,7 @@ mod test {
         ];
         let payload: &[u8] = &frame[7..frame.len() - 2];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0x02,
@@ -423,7 +423,7 @@ mod test {
         ];
         let payload: &[u8] = &frame[7..frame.len() - 2];
         let response = pass_frame(&frame);
-        let expected = APDU {
+        let expected = Apdu {
             header: ApduHeader {
                 cla: 0x00,
                 ins: 0x01,

src/ctap/ctap1.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use super::apdu::{ApduStatusCode, APDU};
+use super::apdu::{Apdu, ApduStatusCode};
 use super::hid::ChannelID;
 use super::status_code::Ctap2StatusCode;
 use super::CtapState;
@@ -82,7 +82,7 @@ impl TryFrom<&[u8]> for U2fCommand {
     type Error = Ctap1StatusCode;
 
     fn try_from(message: &[u8]) -> Result<Self, Ctap1StatusCode> {
-        let apdu: APDU = match APDU::try_from(message) {
+        let apdu: Apdu = match Apdu::try_from(message) {
             Ok(apdu) => apdu,
             Err(apdu_status_code) => {
                 return Err(Ctap1StatusCode::try_from(apdu_status_code).unwrap())
@@ -91,7 +91,7 @@ impl TryFrom<&[u8]> for U2fCommand {
 
         let lc = apdu.lc as usize;
 
-        // ISO7816 APDU Header format. Each cell is 1 byte. Note that the CTAP flavor always
+        // ISO7816 Apdu Header format. Each cell is 1 byte. Note that the CTAP flavor always
         // encodes the length on 3 bytes and doesn't use the field "Le" (Length Expected).
         // We keep the 2 byte of "Le" for the packet length in mind, but always ignore its value.
         // Lc is using big-endian encoding

src/ctap/hid/send.rs

@@ -227,6 +227,7 @@ mod test {
     }
 
     #[test]
+    #[allow(clippy::eq_op)]
     fn test_hid_packet_iterator_max_packets() {
         let mut payload = vec![0xFF; 64 - 7];
         for i in 0..128 {
@@ -244,14 +245,13 @@ mod test {
             payload,
         };
 
-        let mut expected_packets = Vec::new();
-        expected_packets.push([
+        let mut expected_packets = vec![[
             0x12, 0x34, 0x56, 0x78, 0xAB, 0x1D, 0xB9, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-        ]);
+        ]];
         for i in 0..128 {
             let mut packet: HidPacket = [0; 64];
             packet[0] = 0x12;

third_party/lang-items/Cargo.lock

@@ -0,0 +1,74 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "lang_items"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+ "libtock_drivers",
+ "linked_list_allocator",
+]
+
+[[package]]
+name = "libtock_codegen"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libtock_core"
+version = "0.1.0"
+dependencies = [
+ "libtock_codegen",
+]
+
+[[package]]
+name = "libtock_drivers"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+]
+
+[[package]]
+name = "linked_list_allocator"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "822add9edb1860698b79522510da17bef885171f75aa395cff099d770c609c24"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94e2ef8dbfc347b10c094890f778ee2e36ca9bb4262e86dc99cd217e35f3470b"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fcd952facd492f9be3ef0d0b7032a6e442ee9b361d4acc2b1d0c4aaa5f613a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"

third_party/libtock-drivers/Cargo.lock

@@ -0,0 +1,59 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "libtock_codegen"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "libtock_core"
+version = "0.1.0"
+dependencies = [
+ "libtock_codegen",
+]
+
+[[package]]
+name = "libtock_drivers"
+version = "0.1.0"
+dependencies = [
+ "libtock_core",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94e2ef8dbfc347b10c094890f778ee2e36ca9bb4262e86dc99cd217e35f3470b"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fcd952facd492f9be3ef0d0b7032a6e442ee9b361d4acc2b1d0c4aaa5f613a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"

tools/configure.py

@@ -40,37 +40,29 @@ OPENSK_VENDOR_CONFIGURE = 0x40
 
 
 def fatal(msg):
-  tqdm.write("{style_begin}fatal:{style_end} {message}".format(
-      style_begin=colorama.Fore.RED + colorama.Style.BRIGHT,
-      style_end=colorama.Style.RESET_ALL,
-      message=msg))
+  tqdm.write(f"{colorama.Fore.RED + colorama.Style.BRIGHT}fatal:"
+             f"{colorama.Style.RESET_ALL} {msg}")
   sys.exit(1)
 
 
 def error(msg):
-  tqdm.write("{style_begin}error:{style_end} {message}".format(
-      style_begin=colorama.Fore.RED,
-      style_end=colorama.Style.RESET_ALL,
-      message=msg))
+  tqdm.write(f"{colorama.Fore.RED}error:{colorama.Style.RESET_ALL} {msg}")
 
 
 def info(msg):
-  tqdm.write("{style_begin}info:{style_end} {message}".format(
-      style_begin=colorama.Fore.GREEN + colorama.Style.BRIGHT,
-      style_end=colorama.Style.RESET_ALL,
-      message=msg))
+  tqdm.write(f"{colorama.Fore.GREEN + colorama.Style.BRIGHT}info:"
+             f"{colorama.Style.RESET_ALL} {msg}")
 
 
 def get_opensk_devices(batch_mode):
   devices = []
   for dev in hid.CtapHidDevice.list_devices():
-    if (dev.descriptor["vendor_id"],
-        dev.descriptor["product_id"]) == OPENSK_VID_PID:
+    if (dev.descriptor.vid, dev.descriptor.pid) == OPENSK_VID_PID:
       if dev.capabilities & hid.CAPABILITY.CBOR:
         if batch_mode:
-          devices.append(ctap2.CTAP2(dev))
+          devices.append(ctap2.Ctap2(dev))
         else:
-          return [ctap2.CTAP2(dev)]
+          return [ctap2.Ctap2(dev)]
   return devices
 
 
@@ -108,7 +100,7 @@ def main(args):
 
     cert = x509.load_pem_x509_certificate(args.certificate.read())
     # Some sanity/validity checks
-    now = datetime.datetime.now()
+    now = datetime.datetime.utcnow()
     if cert.not_valid_before > now:
       fatal("Certificate validity starts in the future.")
     if cert.not_valid_after <= now:
@@ -138,17 +130,15 @@ def main(args):
     if authenticator.device.capabilities & hid.CAPABILITY.WINK:
       authenticator.device.wink()
     aaguid = uuid.UUID(bytes=authenticator.get_info().aaguid)
-    info(("Programming device {} AAGUID {} ({}). "
-          "Please touch the device to confirm...").format(
-              authenticator.device.descriptor.get("product_string", "Unknown"),
-              aaguid, authenticator.device))
+    info(f"Programming OpenSK device AAGUID {aaguid} ({authenticator.device}).")
+    info("Please touch the device to confirm...")
     try:
       result = authenticator.send_cbor(
           OPENSK_VENDOR_CONFIGURE,
           data=cbor_data,
       )
-      info("Certificate: {}".format("Present" if result[1] else "Missing"))
-      info("Private Key: {}".format("Present" if result[2] else "Missing"))
+      info(f"Certificate: {'Present' if result[1] else 'Missing'}")
+      info(f"Private Key: {'Present' if result[2] else 'Missing'}")
       if args.lock:
         info("Device is now locked down!")
     except ctap.CtapError as ex:
@@ -162,7 +152,7 @@ def main(args):
             ("Failed to configure OpenSK (device is partially programmed but "
              "the given cert/key don't match the ones currently programmed)."))
       else:
-        error("Failed to configure OpenSK (unknown error: {}".format(ex))
+        error(f"Failed to configure OpenSK (unknown error: {ex}")
 
 
 if __name__ == "__main__":

tools/heapviz/Cargo.lock

@@ -0,0 +1,174 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "aho-corasick"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ansi_term"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ac7c30002a5accbf7e8987d0632fa6de155b7c3d39d0067317a391e00a2ef6"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "bitflags"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4efd02e230a02e18f92fc2735f44597385ed02ad8f831e7c1c1156ee5e1ab3a5"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "clap"
+version = "2.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b8c532887f1a292d17de05ae858a8fe50a301e196f9ef0ddb7ccd0d1d00f180"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags",
+ "strsim",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
+[[package]]
+name = "heapviz"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "lazy_static",
+ "ncurses",
+ "regex",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.134"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "ncurses"
+version = "5.101.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e2c5d34d72657dc4b638a1c25d40aae81e4f1c699062f72f467237920752032"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "strsim"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4d15c810519a91cf877e7e36e63fe068815c678181439f2f29e2562147c3694"
+
+[[package]]
+name = "textwrap"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b59b6b4b44d867f1370ef1bd91bfb262bf07bf0ae65c202ea2fbc16153b693"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "unicode-width"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

tools/heapviz/Cargo.toml

@@ -8,7 +8,7 @@ license = "Apache-2.0"
 edition = "2018"
 
 [dependencies]
-clap = "2.33.1"
+clap = "~2.27.*"
 lazy_static = "1.4.0"
 ncurses = "5.99.0"
 regex = "1"