1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
<!--
Author: cirakg & claude ai
Summary: Notable changes per version, in Keep a Changelog format with semantic versioning.
-->
# Changelog
All notable changes to this project are documented here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
[Semantic Versioning](https://semver.org/spec/v2.0.0.html). Versions stay at
0.x until milestone M8; each milestone raises the minor version.
## [Unreleased]
## [0.2.0] - 2026-10-18
Milestones M1 (prepared; your phone test pending) and M2: crypto and OTP core.
Nothing user-visible yet; the home screen still shows only name and version.
### Added
- Crypto (`source/crypto/`): SHA-512 in Monkey C (FIPS 180-4), generic HMAC
(RFC 2104) for SHA-1/SHA-256/SHA-512 plus native HMAC-SHA256, resumable
PBKDF2-HMAC-SHA256 with calibration, HKDF-SHA256, AES-CBC with PKCS#7
(AES-256 chosen), SealedBox encrypt-then-MAC records, and a start-up
self-test.
- OTP (`source/otp/`): Base32 decoding with exact error positions, HOTP, TOTP
(64-bit time, correct after 2038) and Steam Guard codes.
- Utilities: constant-time comparison and wiping (`Bytes`), the 2038-safe clock
and trusted-clock check (`Clock`), resumable jobs with a timer runner (`Jobs`).
- `tools/gen_vectors.py` and `make vectors`: official RFC/FIPS/NIST vectors,
each recomputed with Python's standard library or openssl before use, plus
seeded cases (SHA padding boundaries, 2038, 2100, all digit counts).
- 31 Monkey C unit tests and a benchmark, passing on all four test devices.
- M1 settings spike: a separate test app (`spike/settings/`), `make spike`,
`make spike-sim`, test strings and `docs/SETTINGS_SPIKE.md`.
### Changed
- Screenshot checks are now strict: at most 0.01 % of pixels may differ (one
changed character used to pass under the old 0.5 % tolerance).
- SHA-512 and PBKDF2 inner loops optimised (37 % and 42 % faster in the
simulator) without changing results.
## [0.1.0] - 2026-10-18
Milestone M0: scaffolding. Not useful on a watch yet; the app shows only its
name and version.
### Added
- Project plan (`README.md`), Phase 0 feasibility findings with what M0
verified (`docs/FEASIBILITY.md`), developer guide, testing and performance
documents.
- Docker images with pinned versions: `garmin-otp/dev` (Ubuntu 22.04 snapshot,
Java 17, headless simulator stack, hash-locked Python tools,
checksum-verified SDK manager CLI) and `garmin-otp/docs` (Markdown lint and
Mermaid rendering).
- `Makefile` running every step in hardened containers: no capabilities,
read-only root filesystem, only the project folder mounted, no network
outside image builds and `make sdk`, serial even under `make -j`.
- `make sdk` (agreements, login, SDK 9.2.0, device files for 72 watches,
token deleted afterwards) and `make key` (RSA-4096 developer key).
- Build pipeline with strict type checking and warnings as errors, per-size
launcher icons for all 72 products, unit tests in the headless simulator on
four devices, golden-image screenshot tests, start-up and memory budgets, and
the signed `.iq` package.
- Python tools with 44 tests: test-log judge, screenshot checker, budget
checker, product rule checker, Markdown link checker, project linter (code
rules and the Author/Summary header rule) and icon generator.
- A minimal watch app (home screen with name and version) and a smoke test.
|
