Squashed commits

examples/piv_certificate.py

@@ -26,7 +26,6 @@
     PivSession,
     SLOT,
     KEY_TYPE,
-    MANAGEMENT_KEY_TYPE,
     DEFAULT_MANAGEMENT_KEY,
 )
 from ykman.piv import sign_certificate_builder
@@ -57,7 +56,8 @@
 key = click.prompt(
     "Enter management key", default=DEFAULT_MANAGEMENT_KEY.hex(), hide_input=True
 )
-piv.authenticate(MANAGEMENT_KEY_TYPE.TDES, bytes.fromhex(key))
+
+piv.authenticate(bytes.fromhex(key))
 
 # Generate a private key on the YubiKey
 print(f"Generating {key_type.name} key in slot {slot:X}...")

tests/device/cli/conftest.py

@@ -1,34 +1,28 @@
 from yubikit.core import TRANSPORT
-from ykman._cli.__main__ import cli, _DefaultFormatter
+from ykman._cli.__main__ import cli
 from ykman._cli.aliases import apply_aliases
 from ykman._cli.util import CliFail
 from click.testing import CliRunner
 from functools import partial
-import logging
 import pytest
 
 
-@pytest.fixture(scope="module")
-def ykman_cli(device, info):
+@pytest.fixture()
+def ykman_cli(capsys, device, info):
+    def _ykman_cli(*argv, **kwargs):
+        argv = apply_aliases(["ykman"] + [str(a) for a in argv])
+        runner = CliRunner(mix_stderr=False)
+        with capsys.disabled():
+            result = runner.invoke(cli, argv[1:], obj={}, **kwargs)
+        if result.exit_code != 0:
+            if isinstance(result.exception, CliFail):
+                raise SystemExit()
+            raise result.exception
+        return result
+
     if device.transport == TRANSPORT.NFC:
         return partial(_ykman_cli, "--reader", device.reader.name)
     elif info.serial is not None:
         return partial(_ykman_cli, "--device", info.serial)
     else:
         return _ykman_cli
-
-
-def _ykman_cli(*argv, **kwargs):
-    handler = logging.StreamHandler()
-    handler.setLevel(logging.WARNING)
-    handler.setFormatter(_DefaultFormatter())
-    logging.getLogger().addHandler(handler)
-
-    argv = apply_aliases(["ykman"] + [str(a) for a in argv])
-    runner = CliRunner(mix_stderr=False)
-    result = runner.invoke(cli, argv[1:], obj={}, **kwargs)
-    if result.exit_code != 0:
-        if isinstance(result.exception, CliFail):
-            raise SystemExit()
-        raise result.exception
-    return result

tests/device/cli/piv/conftest.py

@@ -1,9 +1,53 @@
 from yubikit.management import CAPABILITY
 from ... import condition
+from .util import DEFAULT_PIN, DEFAULT_PUK, DEFAULT_MANAGEMENT_KEY
+from typing import NamedTuple
 import pytest
 
 
 @pytest.fixture(autouse=True)
 @condition.capability(CAPABILITY.PIV)
 def ensure_piv(ykman_cli):
     ykman_cli("piv", "reset", "-f")
+
+
+class Keys(NamedTuple):
+    pin: str
+    puk: str
+    mgmt: str
+
+
+@pytest.fixture
+def default_keys():
+    yield Keys(DEFAULT_PIN, DEFAULT_PUK, DEFAULT_MANAGEMENT_KEY)
+
+
+@pytest.fixture
+def keys(ykman_cli, info, default_keys):
+    if CAPABILITY.PIV in info.fips_capable:
+        new_keys = Keys(
+            "12345679",
+            "12345670",
+            "010203040506070801020304050607080102030405060709",
+        )
+
+        ykman_cli(
+            "piv", "access", "change-pin", "-P", default_keys.pin, "-n", new_keys.pin
+        )
+        ykman_cli(
+            "piv", "access", "change-puk", "-p", default_keys.puk, "-n", new_keys.puk
+        )
+        ykman_cli(
+            "piv",
+            "access",
+            "change-management-key",
+            "-m",
+            default_keys.mgmt,
+            "-n",
+            new_keys.mgmt,
+            "-f",
+        )
+
+        yield new_keys
+    else:
+        yield default_keys