What's new
Challenge-echo enrollment DTOs
Two new shared payloads in AppAttestCore for services without accounts or
sessions — the server remembers issued challenges by value, and the client
echoes the challenge back alongside the attestation:
ChallengePayload— the server → client challenge response.EnrollmentPayload— challenge + key ID + attestation in one body.
Like the existing DTOs they're optional, Codable, and re-exported by both
the client and server products.
Documentation
- New DocC landing page for
AppAttestClient: enrollment and signing flow,
key-loss recovery. - Transport variants for assertions, in the README and the Verifying
assertions article — including carrying the key ID and assertion in HTTP
headers with the raw request body as the signed client data, and the rules
that keep it safe (the challenge stays inside the signed bytes; enrollment
stays in the request body). - Expanded guides: challenge storage patterns (session-bound vs. echo), a
complete client + server (Hummingbird) example, wire-format pitfalls
(JSON isn't canonical — verify the shipped bytes).
Full Changelog: 1.0.0...1.1.0