# Changelog All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Versions stay at 0.x until milestone M8; each milestone raises the minor version. ## [Unreleased] ## [0.2.0] - 2026-10-18 Milestones M1 (prepared; your phone test pending) and M2: crypto and OTP core. Nothing user-visible yet; the home screen still shows only name and version. ### Added - Crypto (`source/crypto/`): SHA-512 in Monkey C (FIPS 180-4), generic HMAC (RFC 2104) for SHA-1/SHA-256/SHA-512 plus native HMAC-SHA256, resumable PBKDF2-HMAC-SHA256 with calibration, HKDF-SHA256, AES-CBC with PKCS#7 (AES-256 chosen), SealedBox encrypt-then-MAC records, and a start-up self-test. - OTP (`source/otp/`): Base32 decoding with exact error positions, HOTP, TOTP (64-bit time, correct after 2038) and Steam Guard codes. - Utilities: constant-time comparison and wiping (`Bytes`), the 2038-safe clock and trusted-clock check (`Clock`), resumable jobs with a timer runner (`Jobs`). - `tools/gen_vectors.py` and `make vectors`: official RFC/FIPS/NIST vectors, each recomputed with Python's standard library or openssl before use, plus seeded cases (SHA padding boundaries, 2038, 2100, all digit counts). - 31 Monkey C unit tests and a benchmark, passing on all four test devices. - M1 settings spike: a separate test app (`spike/settings/`), `make spike`, `make spike-sim`, test strings and `docs/SETTINGS_SPIKE.md`. ### Changed - Screenshot checks are now strict: at most 0.01 % of pixels may differ (one changed character used to pass under the old 0.5 % tolerance). - SHA-512 and PBKDF2 inner loops optimised (37 % and 42 % faster in the simulator) without changing results. ## [0.1.0] - 2026-10-18 Milestone M0: scaffolding. Not useful on a watch yet; the app shows only its name and version. ### Added - Project plan (`README.md`), Phase 0 feasibility findings with what M0 verified (`docs/FEASIBILITY.md`), developer guide, testing and performance documents. - Docker images with pinned versions: `garmin-otp/dev` (Ubuntu 22.04 snapshot, Java 17, headless simulator stack, hash-locked Python tools, checksum-verified SDK manager CLI) and `garmin-otp/docs` (Markdown lint and Mermaid rendering). - `Makefile` running every step in hardened containers: no capabilities, read-only root filesystem, only the project folder mounted, no network outside image builds and `make sdk`, serial even under `make -j`. - `make sdk` (agreements, login, SDK 9.2.0, device files for 72 watches, token deleted afterwards) and `make key` (RSA-4096 developer key). - Build pipeline with strict type checking and warnings as errors, per-size launcher icons for all 72 products, unit tests in the headless simulator on four devices, golden-image screenshot tests, start-up and memory budgets, and the signed `.iq` package. - Python tools with 44 tests: test-log judge, screenshot checker, budget checker, product rule checker, Markdown link checker, project linter (code rules and the Author/Summary header rule) and icon generator. - A minimal watch app (home screen with name and version) and a smoke test.