v0.3.0

This release is a big milestone toward our goal of providing a Credential portal. To that end, we have changed the structure of credentialsd to fit the patterns from credentialsd portal. We also now have a dependency on xdg-desktop-portal to use credentialsd.

linux-credentials/xdg-desktop-portal contains the patches needed to run xdg-desktop-portal while we work on upstreaming the changes.

Known Issues

UI service does not start automatically

The xyz.iinuwa.credentialsd.UiControl service should be D-Bus activatable, but it does not start properly. To use credentialsd, you will have to manually run systemctl --user start xyz.iinuwa.credentialsd.UiControl.service. We will fix this in a subsequent patch release.

USB requests spam logs

The logging level for polling USB was accidentally set to INFO instead of trace, so many logs will be shown while a passkey request is active. This will be fixed in the next patch release.

Firefox Flatpak depends on Freedesktop Beta SDK

The Firefox Flatpak requires a newer version of Glibc than is available on the released versions of the Freedesktop SDK for Flatpak. It is built with the 26.08 beta SDK, which means to install it, you must enable the beta repository with the command below. We will update the Flatpak as soon as the 26.08 SDK is released.

flatpak remote-add --user --if-not-exists flathub-beta https://flathub.org/beta-repo/flathub-beta.flatpakrepo

Alternatively, you can use the credentialsd-helper@iinuwa.xyz-0.2.0.xpi Firefox extension and the associated credentialsd-webextension package included in the release artifacts below.

Breaking Changes

• daemon: Removed FlowControl service in favor of portal handler.
• daemon: Added a dependency on a patched xdg-desktop-portal to run credentialsd.
• daemon: Send CTAP2 hybrid QR code data to UI over a file descriptor.
• daemon: Require origin parameter to be set on CreateCredential and GetCredential.
• daemon: Flatten request inputs to remove request_json field, making construction more straightforward.
• ui: Reordered parameters in RequestingApplication, and made app name optional.
• ui: Send client PIN to daemon over a file descriptor.
• ui: Move discovery from UI service to daemon.
• ui: Lookup app display name from UI instead of daemon.

Improvements

• ci: Move build directory to take better advantage of caching. (Thank you, @norepro!)
• daemon: Added a handler service to handle Credential portal requests on behalf of xdg-desktop-portal.
• daemon: Accept top_origin as an optional parameter to CreateCredential and GetCredential.
• daemon: Expand list of trusted callers to paths where distros commonly place xdg-desktop-portal.
• daemon: Remove busy loop on USB polling taking up a bunch of CPU.
• daemon: Validate related origins requests.
• daemon: Add support for CTAP2 hybrid over BLE behind a feature flag.
• daemon: Deduplicate USB state events emitted over D-Bus.
• daemon: Don't use hybrid when not available
• daemon: Cancel other transports, if one succeeded/failed
• daemon: Return InvalidStateError to caller when credential is excluded.
• ui: Add Georgian translations. (Thank you, @EkaterinePapava!)
• ui: Add a portal backend API to credentialsd-ui.
• ui: Allow setting client PIN during the flow when required.
• ui: Send initial list of devices on UI initialization.
• ui: Reorganize credential selection screen to promote hybrid QR code.
• ui: Convert UI templates to Blueprint.
• webext: Ignore conditional mediation requests.
• webext: Fix request routing issues when multiple tabs are active.
• webext: Only start extension during WebAuthn calls for performance.
• webext: Propagate gateway errors to JavaScript correctly.
• webext: Load Firefox extension on all sites

PRs merged

• Stricter origin parsing and validation by @iinuwa in #133
• docs: fix spelling by @vladdoster in #142
• Make app name optional by @iinuwa in #141
• Clean up a few things by @iinuwa in #144
• Refactor gateway service by @iinuwa in #146
• po: Add Georgian language support by @EkaterinePapava in #147
• Include devices in initial request by @iinuwa in #149
• feat: add Edge/Chromium browser extension support by @phelix001 in #138
• Add Portal handler D-Bus interface by @iinuwa in #148
• Demo tweaks by @iinuwa in #153
• Trusted caller improvements by @iinuwa in #155
• Simplify BackgroundEvent by @iinuwa in #154
• webext: Update extension to use portal frontend API by @iinuwa in #156
• Finish migrating web extension to portal by @iinuwa in #157
• Use libwebauthn for JSON request parsing by @AlfioEmanueleFresta in #116
• Use libwebauthn for JSON response serialization by @AlfioEmanueleFresta in #117
• Portal backend api by @iinuwa in #151
• Rename Flow to Ceremony by @iinuwa in #158
• Rename BackendRequest to UserInteractedEvent by @iinuwa in #159
• Remove old dbus by @iinuwa in #160
• daemon: Send activation token to UI by @iinuwa in #161
• daemon,ui: Send PIN over fd by @iinuwa in #162
• chore(deps): bump libwebauthn to 0.5.0 by @AlfioEmanueleFresta in #166
• chore(deps): bump libwebauthn to 0.5.1 by @AlfioEmanueleFresta in #167
• Cleanup UI resources by @iinuwa in #168
• daemon: Don't busy loop on USB polling by @iinuwa in #170
• Revamp discovery by @iinuwa in #163
• ui: Consistently build Blueprint file by @iinuwa in #171
• Redo credential selection screen by @iinuwa in #175
• chore(deps): bump libwebauthn to 0.8.0 by @AlfioEmanueleFresta in #173
• webext: Don't answer conditional mediation requests by @iinuwa in #176
• feat: validate related origins for cross-domain passkeys by @AlfioEmanueleFresta in #174
• Portal backend request by @iinuwa in #177
• daemon,ui: Lookup app display name on backend by @iinuwa in #178
• daemon: Disable hybrid BLE transport by default, opt in with env var by @iinuwa in #180
• Use memfd for hybrid QR code by @iinuwa in #179
• daemon: Fix locations of xdg-desktop-portal by @iinuwa in #181
• docs: Update install docs by @iinuwa in #182
• Remove a bunch of unused stuff by @iinuwa in #186
• Cleanup origin display by @iinuwa in #187
• common: Remove split between model and server types by @iinuwa in #189
• ci: Fix all clippy warnings and force check in CI by @iinuwa in #190
• Update CI by @iinuwa in #195
• daemon: Deduplicate UsbStateInternal events by @iinuwa in #196
• Update VS Code launch settings by @iinuwa in #197
• Portal session pattern by @iinuwa in #194
• Cargo.toml maintenance by @iinuwa in #198
• Always trust system-paths, and only extend the list with debug env-variable by @msirringhaus in #205
• Implement a dialog for setting new device PIN by @msirringhaus in #135
• Don't use hybrid, if it is not available by @msirringhaus in #203
• build: Remove FlowControlService service activation files by @iinuwa in #207
• doc: Update CHANGELOG by @iinuwa in #208
• Web extension updates by @iinuwa in #210
• Implement first step of cancellation: Stop all handler when one completes/fails by @msirringhaus in #204
• Propagate exclude credential by @iinuwa in #213
• Cleanup docs by @iinuwa in #215

New Contributors

• @vladdoster made their first contribution in #142
• @EkaterinePapava made their first contribution in #147
• @phelix001 made their first contribution in #138

Full Changelog: v0.2.0...v0.3.0