Bump tkeyclient

.github/workflows/ci.yaml

@@ -26,9 +26,6 @@ jobs:
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-      - name: check for SPDX tags
-        run: ./tools/spdx-ensure
-
       # Ubuntu has stopped publishing packages we use in
       # tkey-builder:4 so we can't do this right now. Kept for a later
       # update.

README.md

@@ -21,6 +21,8 @@ real hardware.
 
 [Current list of known projects](https://dev.tillitis.se/projects/).
 
+See [Release notes](RELEASE.md).
+
 ## Building
 
 You have two options, either our OCI image

RELEASE.md

@@ -0,0 +1,12 @@
+# Release notes
+
+## v0.0.2
+
+- Update tkeyclient version because of a vulnerability leaving some
+  USSs unused. Keys might have changed since earlier versions! Read
+  more here:
+
+  https://github.com/tillitis/tkeyclient/security/advisories/GHSA-4w7r-3222-8h6v
+
+- Add a new option flag to `tkey-runapp`: `--force-full-uss` to force
+  full use of the 32 byte USS digest.

REUSE.toml

@@ -16,6 +16,7 @@ path = [
      ".goreleaser.yaml",
      "Makefile",
      "README.md",
+     "RELEASE.md",
      "cmd/hidread/go.mod",
      "cmd/hidread/go.sum",
      "cmd/tkey-runapp/go.mod",

cmd/tkey-runapp/go.mod

@@ -4,12 +4,13 @@ go 1.23.0
 
 require (
 	github.com/spf13/pflag v1.0.5
-	github.com/tillitis/tkeyclient v1.2.0
+	github.com/tillitis/tkeyclient v1.3.0
 	github.com/tillitis/tkeyutil v0.0.9
 )
 
 require (
 	github.com/ccoveille/go-safecast v1.5.0 // indirect
+	github.com/ccoveille/go-safecast/v2 v2.0.0 // indirect
 	github.com/creack/goselect v0.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/gen2brain/beeep v0.0.0-20240516210008-9c006672e7f4 // indirect

cmd/tkey-runapp/go.sum

@@ -1,5 +1,7 @@
 github.com/ccoveille/go-safecast v1.5.0 h1:cT/3uVQ/i5PTiJvhvkSU81HeKNurtyQtBndXEH3hDg4=
 github.com/ccoveille/go-safecast v1.5.0/go.mod h1:QqwNjxQ7DAqY0C721OIO9InMk9zCwcsO7tnRuHytad8=
+github.com/ccoveille/go-safecast/v2 v2.0.0 h1:+5eyITXAUj3wMjad6cRVJKGnC7vDS55zk0INzJagub0=
+github.com/ccoveille/go-safecast/v2 v2.0.0/go.mod h1:JIYA4CAR33blIDuE6fSwCp2sz1oOBahXnvmdBhOAABs=
 github.com/creack/goselect v0.1.2 h1:2DNy14+JPjRBgPzAd1thbQp4BSIihxcBf0IXhQXDRa0=
 github.com/creack/goselect v0.1.2/go.mod h1:a/NhLweNvqIYMuxcMOuWY516Cimucms3DglDzQP3hKY=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -22,6 +24,8 @@ github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af h1:6yITBqGTE2lEeTPG0
 github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af/go.mod h1:4F09kP5F+am0jAwlQLddpoMDM+iewkxxt6nxUQ5nq5o=
 github.com/tillitis/tkeyclient v1.2.0 h1:X/PjUPK061EFNmf3V4knb20wTfcIuUH13VSC/0VFaYo=
 github.com/tillitis/tkeyclient v1.2.0/go.mod h1:4TiEj0qUwaffmOODPZro6cUBaw+Gb6F5EFd6tcH7UXE=
+github.com/tillitis/tkeyclient v1.3.0 h1:fUlghD+xvtL+qoajgrsetCC7KPwSfpjDDgqxMOBA2VU=
+github.com/tillitis/tkeyclient v1.3.0/go.mod h1:7VtzyEjm08Wf+1zdrs20HsvM+WzhyztinvGG2/HY+Is=
 github.com/tillitis/tkeyutil v0.0.9 h1:WWF4Emxch32TczYjjYwl45GMtxsD9l8432mZaX6u8mw=
 github.com/tillitis/tkeyutil v0.0.9/go.mod h1:+vxU9HmwR2pdPRYg1YlmWW46h2XADdSAhCGUQCryzJg=
 go.bug.st/serial v1.6.2 h1:kn9LRX3sdm+WxWKufMlIRndwGfPWsH1/9lCWXQCasq8=

cmd/tkey-runapp/main.go

@@ -26,17 +26,17 @@ var version string
 func main() {
 	var fileName, devPath, fileUSS string
 	var speed int
-	var enterUSS, verbose, helpOnly bool
+	var enterUSS, verbose, helpOnly, forceFullUss bool
 	pflag.CommandLine.SetOutput(os.Stderr)
 	pflag.CommandLine.SortFlags = false
 	pflag.StringVar(&devPath, "port", "",
 		"Set serial port device `PATH`. If this is not passed, auto-detection will be attempted.")
-	pflag.IntVar(&speed, "speed", tkeyclient.SerialSpeed,
-		"Set serial port speed in `BPS` (bits per second).")
+	pflag.IntVar(&speed, "speed", 0, "Set serial port speed in `BPS` (bits per second).")
 	pflag.BoolVar(&enterUSS, "uss", false,
 		"Enable typing of a phrase to be hashed as the User Supplied Secret. The USS is loaded onto the TKey along with the app itself and used by the firmware, together with other material, for deriving secrets for the application.")
 	pflag.StringVar(&fileUSS, "uss-file", "",
 		"Read `FILE` and hash its contents as the USS. Use '-' (dash) to read from stdin. The full contents are hashed unmodified (e.g. newlines are not stripped).")
+	pflag.BoolVar(&forceFullUss, "force-full-uss", false, "Force use of 32 byte USS digest.")
 	pflag.BoolVar(&verbose, "verbose", false, "Enable verbose output.")
 	pflag.BoolVar(&helpOnly, "help", false, "Output this help.")
 	versionOnly := pflag.BoolP("version", "v", false, "Output version information.")
@@ -58,6 +58,8 @@ running some app.`, os.Args[0])
 		version = readBuildInfo()
 	}
 
+	notice()
+
 	if pflag.NArg() > 0 {
 		if pflag.NArg() > 1 {
 			le.Printf("Unexpected argument: %s\n\n", strings.Join(pflag.Args()[1:], " "))
@@ -111,8 +113,18 @@ running some app.`, os.Args[0])
 	}
 
 	tk := tkeyclient.New()
+	options := []func(*tkeyclient.TillitisKey){}
+
+	if speed != 0 {
+		options = append(options, tkeyclient.WithSpeed(speed))
+	}
+
+	if forceFullUss {
+		options = append(options, tkeyclient.WithFullUss())
+	}
+
 	le.Printf("Connecting to device on serial port %s ...\n", devPath)
-	if err = tk.Connect(devPath, tkeyclient.WithSpeed(speed)); err != nil {
+	if err = tk.Connect(devPath, options...); err != nil {
 		le.Printf("Could not open %s: %v\n", devPath, err)
 		os.Exit(1)
 	}
@@ -168,6 +180,17 @@ running some app.`, os.Args[0])
 	exit(0)
 }
 
+func notice() {
+	fmt.Printf("--------------------------------------------------------------------------------\n")
+	fmt.Printf("tkey-runapp %v\n", version)
+	fmt.Printf(`
+NOTE: Version v0.0.1 had a vulnerability. Your keys might have
+changed! Read more in the release notes RELEASE.md at
+https://github.com/tillitis/tkey-devtools/
+`)
+	fmt.Printf("--------------------------------------------------------------------------------\n\n")
+}
+
 func handleSignals(action func(), sig ...os.Signal) {
 	ch := make(chan os.Signal, 1)
 	signal.Notify(ch, sig...)