Open
Conversation
- Deletes all Tock related code. - Uses uv instead of manual venv setup. - Moves Wasefire env into src. - Fixes errors and lints.
- Adepts the Customization to untie batch attestation from CTAP1 - Prevents privacy issues by removing per device attestation - For now, removes batch certificate injection - The binary size workflow is disabled until fixed
This was referenced Apr 24, 2026
Closed
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenSK is now based on Wasefire as the main supported OS instead of TockOS. See Future Work for the problems we want to solve. We also reduce maintenance cost since platforms are now only kept in Wasefire.
Initial commits
0a2a34a
e167421
a6158ef
Planned coming PRs
Future work
Replace #767 with dependency bump
Move
rand_coreto 0.10.1, and other dependabot alerts. Requires some changes to the crypto implementations in Env.We are not stuck with an old compiler version anymore. Before, we would have needed to keep up with TockOS versions.
Fix #649
Since we have to redo our batch attestation, I implemented it so that we fake batch attestation until then. This incidentally let's users login to Apple when they use
use_batch_attestationto activate the random fake batch key. They expect batch attestation without actually checking it. It does mean that you see error messages on webauthn.io in that case.Fix #685 and solve #758
We can have an async Env now, which was impossible with TockOS. Sending busy messages is easier in an async Env.
Fingerprint support
Experimental in Wasefire with one sensor, will eventually be tested more
NFC
The experimental code was TockOS based, so this will likely not happen soon. Would need to land in Wasefire first.