cryptnox-id-cli 1.0.2__tar.gz

cryptnox_id_cli-1.0.2/LICENSE

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

cryptnox_id_cli-1.0.2/PKG-INFO

@@ -0,0 +1,227 @@
+Metadata-Version: 2.4
+Name: cryptnox-id-cli
+Version: 1.0.2
+Summary: Polished CLI for the Cryptnox multi-applet smartcard (PIV / FIDO2 / MIFARE DESFire EV2)
+Author: Cryptnox
+License: LGPL-3.0-or-later
+Project-URL: Homepage, https://cryptnox.com/
+Project-URL: Documentation, https://docs.cryptnox.com/cryptnox-id-cli/
+Project-URL: Repository, https://github.com/cryptnox/cryptnox-id-cli
+Project-URL: Issues, https://github.com/cryptnox/cryptnox-id-cli/issues
+Project-URL: Changelog, https://github.com/cryptnox/cryptnox-id-cli/blob/main/CHANGELOG.md
+Keywords: smartcard,pcsc,piv,fido2,ctap,desfire,openfips201
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: System :: Hardware
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyscard>=2.0
+Requires-Dist: click>=8.1
+Requires-Dist: rich>=13.0
+Requires-Dist: cryptography>=41.0
+Requires-Dist: cbor2<6,>=5.4
+Requires-Dist: asn1crypto>=1.5
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Requires-Dist: mypy>=1.8; extra == "dev"
+Requires-Dist: pyinstaller>=6.0; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=5.0; extra == "dev"
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://github.com/user-attachments/assets/6ce54a27-8fb6-48e6-9d1f-da144f43425a"/>
+</p>
+
+<h3 align="center">cryptnox-id-cli</h3>
+<p align="center">CLI for managing Cryptnox multi-applet ID smart cards</p>
+
+<br/>
+<br/>
+
+[![PyPI](https://img.shields.io/pypi/v/cryptnox-id-cli.svg)](https://pypi.org/project/cryptnox-id-cli/)
+[![Python versions](https://img.shields.io/pypi/pyversions/cryptnox-id-cli.svg)](https://pypi.org/project/cryptnox-id-cli/)
+[![docs](https://github.com/cryptnox/cryptnox-id-cli/actions/workflows/docs.yml/badge.svg)](https://github.com/cryptnox/cryptnox-id-cli/actions/workflows/docs.yml)
+[![License: LGPL v3](https://img.shields.io/badge/License-LGPL%20v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
+
+`cryptnox-id-cli` is a command-line interface for managing the **Cryptnox ID**
+multi-applet smart card: **PIV** identity credentials, **FIDO2** passkeys, and
+**MIFARE DESFire** contactless applications — three independent functions on
+one physical card, driven by one tool.
+
+---
+
+## Supported hardware
+
+### Cryptnox ID smart cards
+
+One card, four applets, reachable over two interfaces:
+
+| Function | Interface | Notes |
+|----------|-----------|-------|
+| **PIV** (SP 800-73 keys + X.509 certificates) | Contact (admin), contact/contactless (use) | All personalization is contact-only |
+| **FIDO2 / CTAP 2.1** (passkeys / WebAuthn) | Contactless (NFC) | Windows requires an Administrator terminal |
+| **MIFARE DESFire** (incl. EV3 Secure Dynamic Messaging) | Contactless (NFC) | Needs a DESFire-capable reader |
+| **Genuineness** (factory attestation) | Contact | Read-only; proves the card is genuine Cryptnox hardware |
+
+### Smart card readers
+
+Works with Cryptnox readers and any other standard PC/SC smart card reader:
+
+| Reader | Type | Interface |
+|--------|------|-----------|
+| [Cryptnox® Smartcard Reader](https://shop.cryptnox.com/product/cryptnox-smartcard-reader/) | Contact (ID-1 + SIM) | USB-A |
+| [Compact USB Mini Smartcard Reader](https://shop.cryptnox.com/product/mini-smartcard-reader/) | Contact (ID-1) | USB-A |
+| [Cryptnox NFC Contactless Reader](https://shop.cryptnox.com/product/cryptnox-contactless-reader/) | Contactless (NFC/ISO 14443) | USB-C |
+
+Verified third-party readers: ACS ACR39U (contact), ACS ACR1252 (contactless,
+native DESFire OK). The HID OMNIKEY 5422CL does **not** support DESFire.
+
+> [!IMPORTANT]
+> MIFARE DESFire requires a contactless reader that passes *native* DESFire
+> commands — not all contactless readers do.
+
+---
+
+## Installation
+
+> [!IMPORTANT]
+> This is only a minimal setup. Additional packages may be required depending
+> on your operating system. See
+> [Installation](https://docs.cryptnox.com/cryptnox-id-cli/installation.html)
+> in the documentation.
+
+Requirements: Python 3.10+ and a PC/SC stack (built into Windows and macOS; on
+Linux install `pcscd` + `libccid`).
+
+### From PyPI
+
+Recommended: [pipx](https://pipx.pypa.io/) — makes `cryptnox-id` available
+globally while keeping its dependencies isolated, and works on current Linux
+distributions where installing into the system Python is blocked (PEP 668):
+
+```bash
+pipx install cryptnox-id-cli
+```
+
+Plain pip also works where the environment allows it (e.g. Windows):
+
+```bash
+pip install cryptnox-id-cli
+```
+
+A virtual environment works too, but the command is then only available while
+the venv is activated — fine for development, not for day-to-day use.
+
+Three interchangeable console commands are installed: `cryptnox-id`, the short
+`cnx-id`, and `cryptnox-id-card`.
+
+### From source
+
+```bash
+git clone https://github.com/cryptnox/cryptnox-id-cli.git
+cd cryptnox-id-cli
+pip install .
+```
+
+---
+
+## Quick usage examples
+
+> [!TIP]
+> The examples below are only a subset of available commands. The complete list
+> of commands and detailed usage instructions is described in the
+> [official documentation](https://docs.cryptnox.com/cryptnox-id-cli/).
+
+### 1. Inspect the card
+
+```bash
+cryptnox-id readers     # list readers, card presence, ATR
+cryptnox-id info        # detect the card + all functions on one screen
+cryptnox-id doctor      # PC/SC service, reader, per-function reachability
+```
+
+`info` and `doctor` are read-only and safe to run any time.
+
+### 2. Provision a PIV credential
+
+1. Run `cryptnox-id piv quickstart` on a contact reader.
+2. The card gets a key, a certificate, a CHUID and a CCC — usable by standard
+   PIV tooling (`yubico-piv-tool`, OpenSC, OS smart-card stacks).
+
+### 3. Create a passkey and prove the whole loop
+
+1. Run `cryptnox-id fido credential self-test` — registers a credential,
+   requests an assertion, and verifies the returned signature: the full
+   WebAuthn round trip against the real authenticator.
+2. For a resident, PIN-verified credential: `cryptnox-id fido pin set`, then
+   re-run the self-test with `--rk`. On Windows, run from an Administrator
+   terminal.
+
+### 4. Prove the card is genuine
+
+1. Run `cryptnox-id genuine verify` on a contact reader.
+2. The card signs a fresh nonce and the on-card certificate is chained to the
+   pinned Cryptnox root — the verdict is **GENUINE** only when both checks pass.
+
+### 5. Work interactively
+
+```bash
+cryptnox-id shell       # run subcommands without re-typing the prefix
+```
+
+---
+
+## Documentation
+
+The full **User & Developer documentation** is available at the
+[Cryptnox ID CLI Documentation](https://docs.cryptnox.com/cryptnox-id-cli/). It
+covers installation and setup, quick starts and usage guides for every card
+function (PIV, FIDO2, MIFARE DESFire, genuineness), the complete CLI command
+reference, JSON output and exit codes, and factory/provisioning notes.
+
+---
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+ruff check src tests && ruff format --check src tests
+mypy
+pytest -q -m "not real_card"
+```
+
+Unit tests use a mock transport — no reader or card required. Real-card tests
+are opt-in (`-m real_card`) and never run in CI.
+
+---
+
+## License
+
+`cryptnox-id-cli` is dual-licensed:
+
+- **LGPL-3.0** for open-source projects and proprietary projects that comply
+  with LGPL requirements (see [`LICENSE`](LICENSE))
+- **Commercial license** for projects that require a proprietary license
+  without LGPL obligations (see [`COMMERCIAL.md`](COMMERCIAL.md) for details)
+
+The documentation is licensed CC BY-NC-ND 4.0.
+
+For commercial inquiries, contact: contact@cryptnox.com

cryptnox_id_cli-1.0.2/README.md

@@ -0,0 +1,179 @@
+<p align="center">
+  <img src="https://github.com/user-attachments/assets/6ce54a27-8fb6-48e6-9d1f-da144f43425a"/>
+</p>
+
+<h3 align="center">cryptnox-id-cli</h3>
+<p align="center">CLI for managing Cryptnox multi-applet ID smart cards</p>
+
+<br/>
+<br/>
+
+[![PyPI](https://img.shields.io/pypi/v/cryptnox-id-cli.svg)](https://pypi.org/project/cryptnox-id-cli/)
+[![Python versions](https://img.shields.io/pypi/pyversions/cryptnox-id-cli.svg)](https://pypi.org/project/cryptnox-id-cli/)
+[![docs](https://github.com/cryptnox/cryptnox-id-cli/actions/workflows/docs.yml/badge.svg)](https://github.com/cryptnox/cryptnox-id-cli/actions/workflows/docs.yml)
+[![License: LGPL v3](https://img.shields.io/badge/License-LGPL%20v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
+
+`cryptnox-id-cli` is a command-line interface for managing the **Cryptnox ID**
+multi-applet smart card: **PIV** identity credentials, **FIDO2** passkeys, and
+**MIFARE DESFire** contactless applications — three independent functions on
+one physical card, driven by one tool.
+
+---
+
+## Supported hardware
+
+### Cryptnox ID smart cards
+
+One card, four applets, reachable over two interfaces:
+
+| Function | Interface | Notes |
+|----------|-----------|-------|
+| **PIV** (SP 800-73 keys + X.509 certificates) | Contact (admin), contact/contactless (use) | All personalization is contact-only |
+| **FIDO2 / CTAP 2.1** (passkeys / WebAuthn) | Contactless (NFC) | Windows requires an Administrator terminal |
+| **MIFARE DESFire** (incl. EV3 Secure Dynamic Messaging) | Contactless (NFC) | Needs a DESFire-capable reader |
+| **Genuineness** (factory attestation) | Contact | Read-only; proves the card is genuine Cryptnox hardware |
+
+### Smart card readers
+
+Works with Cryptnox readers and any other standard PC/SC smart card reader:
+
+| Reader | Type | Interface |
+|--------|------|-----------|
+| [Cryptnox® Smartcard Reader](https://shop.cryptnox.com/product/cryptnox-smartcard-reader/) | Contact (ID-1 + SIM) | USB-A |
+| [Compact USB Mini Smartcard Reader](https://shop.cryptnox.com/product/mini-smartcard-reader/) | Contact (ID-1) | USB-A |
+| [Cryptnox NFC Contactless Reader](https://shop.cryptnox.com/product/cryptnox-contactless-reader/) | Contactless (NFC/ISO 14443) | USB-C |
+
+Verified third-party readers: ACS ACR39U (contact), ACS ACR1252 (contactless,
+native DESFire OK). The HID OMNIKEY 5422CL does **not** support DESFire.
+
+> [!IMPORTANT]
+> MIFARE DESFire requires a contactless reader that passes *native* DESFire
+> commands — not all contactless readers do.
+
+---
+
+## Installation
+
+> [!IMPORTANT]
+> This is only a minimal setup. Additional packages may be required depending
+> on your operating system. See
+> [Installation](https://docs.cryptnox.com/cryptnox-id-cli/installation.html)
+> in the documentation.
+
+Requirements: Python 3.10+ and a PC/SC stack (built into Windows and macOS; on
+Linux install `pcscd` + `libccid`).
+
+### From PyPI
+
+Recommended: [pipx](https://pipx.pypa.io/) — makes `cryptnox-id` available
+globally while keeping its dependencies isolated, and works on current Linux
+distributions where installing into the system Python is blocked (PEP 668):
+
+```bash
+pipx install cryptnox-id-cli
+```
+
+Plain pip also works where the environment allows it (e.g. Windows):
+
+```bash
+pip install cryptnox-id-cli
+```
+
+A virtual environment works too, but the command is then only available while
+the venv is activated — fine for development, not for day-to-day use.
+
+Three interchangeable console commands are installed: `cryptnox-id`, the short
+`cnx-id`, and `cryptnox-id-card`.
+
+### From source
+
+```bash
+git clone https://github.com/cryptnox/cryptnox-id-cli.git
+cd cryptnox-id-cli
+pip install .
+```
+
+---
+
+## Quick usage examples
+
+> [!TIP]
+> The examples below are only a subset of available commands. The complete list
+> of commands and detailed usage instructions is described in the
+> [official documentation](https://docs.cryptnox.com/cryptnox-id-cli/).
+
+### 1. Inspect the card
+
+```bash
+cryptnox-id readers     # list readers, card presence, ATR
+cryptnox-id info        # detect the card + all functions on one screen
+cryptnox-id doctor      # PC/SC service, reader, per-function reachability
+```
+
+`info` and `doctor` are read-only and safe to run any time.
+
+### 2. Provision a PIV credential
+
+1. Run `cryptnox-id piv quickstart` on a contact reader.
+2. The card gets a key, a certificate, a CHUID and a CCC — usable by standard
+   PIV tooling (`yubico-piv-tool`, OpenSC, OS smart-card stacks).
+
+### 3. Create a passkey and prove the whole loop
+
+1. Run `cryptnox-id fido credential self-test` — registers a credential,
+   requests an assertion, and verifies the returned signature: the full
+   WebAuthn round trip against the real authenticator.
+2. For a resident, PIN-verified credential: `cryptnox-id fido pin set`, then
+   re-run the self-test with `--rk`. On Windows, run from an Administrator
+   terminal.
+
+### 4. Prove the card is genuine
+
+1. Run `cryptnox-id genuine verify` on a contact reader.
+2. The card signs a fresh nonce and the on-card certificate is chained to the
+   pinned Cryptnox root — the verdict is **GENUINE** only when both checks pass.
+
+### 5. Work interactively
+
+```bash
+cryptnox-id shell       # run subcommands without re-typing the prefix
+```
+
+---
+
+## Documentation
+
+The full **User & Developer documentation** is available at the
+[Cryptnox ID CLI Documentation](https://docs.cryptnox.com/cryptnox-id-cli/). It
+covers installation and setup, quick starts and usage guides for every card
+function (PIV, FIDO2, MIFARE DESFire, genuineness), the complete CLI command
+reference, JSON output and exit codes, and factory/provisioning notes.
+
+---
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+ruff check src tests && ruff format --check src tests
+mypy
+pytest -q -m "not real_card"
+```
+
+Unit tests use a mock transport — no reader or card required. Real-card tests
+are opt-in (`-m real_card`) and never run in CI.
+
+---
+
+## License
+
+`cryptnox-id-cli` is dual-licensed:
+
+- **LGPL-3.0** for open-source projects and proprietary projects that comply
+  with LGPL requirements (see [`LICENSE`](LICENSE))
+- **Commercial license** for projects that require a proprietary license
+  without LGPL obligations (see [`COMMERCIAL.md`](COMMERCIAL.md) for details)
+
+The documentation is licensed CC BY-NC-ND 4.0.
+
+For commercial inquiries, contact: contact@cryptnox.com

cryptnox_id_cli-1.0.2/pyproject.toml

@@ -0,0 +1,106 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cryptnox-id-cli"
+version = "1.0.2"
+description = "Polished CLI for the Cryptnox multi-applet smartcard (PIV / FIDO2 / MIFARE DESFire EV2)"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "LGPL-3.0-or-later" }
+authors = [{ name = "Cryptnox" }]
+keywords = ["smartcard", "pcsc", "piv", "fido2", "ctap", "desfire", "openfips201"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: System Administrators",
+    "License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)",
+    "Operating System :: Microsoft :: Windows",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS :: MacOS X",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security :: Cryptography",
+    "Topic :: System :: Hardware",
+    "Typing :: Typed",
+]
+dependencies = [
+    "pyscard>=2.0",
+    "click>=8.1",
+    "rich>=13.0",
+    "cryptography>=41.0",
+    # Cap below 6: cbor2 6.x is a Rust build with no Intel-macOS wheel, so a plain
+    # `pip install` fails there without a Rust toolchain. Our CBOR use is trivial
+    # (CTAP dumps/loads) and 5.x ships wheels everywhere.
+    "cbor2>=5.4,<6",
+    "asn1crypto>=1.5",
+    "pyyaml>=6.0",
+]
+
+[project.urls]
+Homepage = "https://cryptnox.com/"
+Documentation = "https://docs.cryptnox.com/cryptnox-id-cli/"
+Repository = "https://github.com/cryptnox/cryptnox-id-cli"
+Issues = "https://github.com/cryptnox/cryptnox-id-cli/issues"
+Changelog = "https://github.com/cryptnox/cryptnox-id-cli/blob/main/CHANGELOG.md"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.4",
+    "ruff>=0.4",
+    "mypy>=1.8",
+    "pyinstaller>=6.0",
+    # Release tooling: `python -m build` produces the wheel/sdist, twine uploads them.
+    "build>=1.0",
+    "twine>=5.0",
+]
+
+[project.scripts]
+cryptnox-id = "cryptnox_id_cli.cli.main:main"
+cnx-id = "cryptnox_id_cli.cli.main:main"
+cryptnox-id-card = "cryptnox_id_cli.cli.main:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+# Bundle pinned attestation trust anchors (PEM) into the wheel: the Cryptnox root plus
+# the intermediates. See src/cryptnox_id_cli/trust/genuine/README.md.
+[tool.setuptools.package-data]
+cryptnox_id_cli = ["trust/genuine/*.pem"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "UP", "B", "C4", "SIM"]
+ignore = ["B008"]  # click uses callables as defaults
+
+[tool.mypy]
+python_version = "3.10"
+packages = ["cryptnox_id_cli"]
+mypy_path = "src"
+warn_unused_ignores = true
+no_implicit_optional = true
+check_untyped_defs = true
+
+# pyscard ships no type stubs; yaml stubs are an optional dev extra.
+[[tool.mypy.overrides]]
+module = ["smartcard.*", "yaml", "asn1crypto.*"]
+ignore_missing_imports = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+markers = [
+    "real_card: test requires a physical card on the ACS reader (opt-in)",
+    "destructive: test mutates the card; requires CRYPTNOX_ALLOW_DESTRUCTIVE_TESTS=1",
+]
+addopts = "-ra"

cryptnox_id_cli-1.0.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+