[emostov]

Summary

A profile can now sign Turnkey requests with a P256 key generated in any signing PIV slot of a YubiKey, so each API request needs a physical touch. tk refuses keys that were imported, need the PIN, or sign without a touch.

Public API changes

• profile create gains --yubikey-slot SLOT and --yubikey-serial SERIAL.
• A profile record holds either api_key_file or a yubikey table (serial, slot, public_key).
• session request refuses YubiKey profiles.
• New yubikey Cargo feature, off by default. Only the macOS release binary enables it, because the static musl builds can't link PC/SC.

Review focus

• Touch-only, no PIN: an agent can't type a PIN, so PIN policy must be never.
• With touch policy always, polling commands such as activity wait need one touch per request. The docs recommend cached.
• Stamp only returns string errors, so device errors are flattened into StamperError.

Testing

Added unit and CLI parsing tests.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	yubikey@​0.8.0

View full report