framefilter/keyroost v0.6.0

on GitHub

keyroost v0.6.0 — CLI maturity

This release reworks keyroost around a shared, device-centric model: one consistent way to see what's connected, target a specific key, and drive every applet. It's a pre-1.0 breaking release — the command surface is now organized into per-device groups. It also folds in a substantial Token2 PIN+ contribution and a round of GUI polish.

⚠️ Breaking changes — command restructure

Every device's commands now live under a group. The flat Molto2 and FIDO subcommands moved:

• info → molto info, set-seed → molto seed, set-title → molto title, configure → molto config, set-customer-key → molto customer-key, factory-reset → molto reset
• every fido-* → fido * (e.g. fido-info → fido info, fido-creds-list → fido creds-list)
• the customer-key flags (--key, --key-env, …) now live under molto customer-key

The full old → new mapping is in the README migration table. Update any scripts accordingly.

Added

• Device-centric overview — running keyroostctl with no subcommand prints what's connected; list gains per-device detail (applets, serials, friendly names) and a correlated-devices summary.
• --name targeting on every group — address one named key consistently across molto, fido, oath, openpgp, piv, and otp.
• Global --json output for status/query commands — list/overview, */status, */info, fido pin-retries/creds-list/creds-metadata, oath list/code, and otp list/get/serial.
• Per-group man pages — keyroostctl manpage <DIR> writes a directory of man pages, one per command group.
• OpenPGP PIN management — openpgp change-pin, change-admin-pin, and unblock-pin.
• Token2 PIN+ support (contributed by @token2, #29 / #30) — fingerprint/bio enrollment (fido fingerprint-*), FIDO Metadata Service (MDS) display in the GUI, on-device OTP improvements, and friendlier CTAP errors.
• Richer GUI PIV pane — each slot shows its certificate Subject DN + key algorithm, distinguishes a key-without-certificate from an empty slot, and auto-refreshes after a write, backed by a new in-tree, dependency-free X.509 Subject-DN reader in keyroost-piv.
• Confirm-PIN fields on the GUI PIV Change-PIN / Change-PUK dialogs, so a mistyped new PIN can't lock the card.

Fixed

• Firmware-accurate PIN guidance in the GUI — removed the inaccurate "touch the key to confirm" hint from the FIDO set/change-PIN flow (CTAP PIN changes aren't touch-gated) and corrected the per-applet PIN/PUK length text.

Install

cargo install keyroostctl keyroost

Pre-built binaries for Linux, macOS, and Windows are attached below. See the README for the Linux PC/SC prerequisite.

Thanks

Community contributions in this release from @token2 (PIN+: fingerprint, MDS, on-device OTP), plus issue reports and feedback from @My1 (PIV GUI), @errant253 (PIN dialog, install docs), and @bioscopic (serial detection).

Full changelog: CHANGELOG.md · compare v0.5.1...v0.6.0