Changelog

Folded a per-session anti-replay counter into the secure channel MAC in both directions (gated on applet version >= 2.0.0). A replayed wrapped command now carries a stale counter and is rejected by the card before decryption. The counter is never transmitted, so there is no wire-format change
Verified the card’s mutual-authentication proof, SHA-256(Kenc || challenge), at channel open (gated on applet version >= 2.0.0; applet 1.6.x replies with raw random and is skipped)

Added Ed25519 (EdDSA) signing support for applet v2.0 (KeyType.ED25519)
Added examples/solana_transaction/ demonstrating Solana signing and transaction building
Added auto-generated PDF documentation (pdflatex), with the cover logo generated from SVG at build time

Renamed BasicG1 card class to Basic (BasicG1 kept as a backwards-compatible alias)
Padded the SIGN PIN to the spec’s fixed 9-byte field and replaced SIGN magic numbers with named constants
Replaced hardcoded PINs in examples with a named PIN variable
Set the initial secure channel encryption IV to the first 16 bytes of Kenc to match the card
Gated sign_public on the applet version and dropped EOS support

Guarded Ed25519 key handling against silently falling through to the ECDSA path — key types are normalized and allowlisted, and an unknown type now raises instead of being signed with ECDSA

Raise on missing cairosvg/Pillow in the docs build instead of silently passing
Don’t fail the Semgrep workflow when SARIF upload is unavailable
Guarded the docs deploy and pinned GitHub Actions to commit SHAs
Fixed the nosemgrep suppression for AES-CBC crypto findings

Block change_puk() when PIN is locked (FINDING-009)
Pinned vulnerable transitive dev dependencies to safe minimum versions:
- protobuf >= 5.29.6 (GHSA-7gcm-g887-7qv7, CVSS 8.2)
- python-multipart >= 0.0.22 (GHSA-59g5-xgcq-4qw3 / GHSA-wp53-j4wj-2cfg, CVSS 8.7/8.6)
- zipp >= 3.19.1 (GHSA-jfmj-5v4g-7637, CVSS 6.9)

Fixed verify_pin(None) to return 0 when PIN is blocked instead of raising an exception
Resolved PIN exception handling in BasicG1 card

Updated PinBlockedException message for clarity
Updated python_requires to >=3.11 (removed upper bound, Python 3.14 now supported)
Updated README with supported hardware details
Updated docs configuration with SEO meta tags, favicon, and project details

Added examples/README.md with overview of available examples and run instructions

Added get_manufacturer_certificate() method to Base card class with hexed parameter for flexible certificate retrieval

Updated get_manufacturer_certificate() in BasicG1 with multi-page APDU support for full certificate retrieval
Updated manufacturer_certificate() function in authenticity module to use the new card-specific method

Fixed AttributeError: module 'cryptnox_sdk_py.cryptos.py2specials' has no attribute 'is_python2' error
Fixed TypeError: can't concat str to bytes error in encode_pubkey() function
Resolved info command issue that prevented retrieving card information
Fixed Python 3.12 compatibility issues in py2specials.py module - Added proper Python 3 implementation for base 256 encoding/decoding - Fixed bytes/string handling in cryptographic operations

Package renamed from cryptnoxpy to cryptnox_sdk_py - All imports must be updated from import cryptnoxpy to import cryptnox_sdk_py - Install using: pip install cryptnox-sdk-py
Updated README.md with new package name and improved examples
Updated valid PUK validation logic
Updated GitHub Actions workflows for documentation and CI/CD
Modified setup configuration (setup.cfg) for better package management

Added flake8 code quality checks to CI/CD workflow
Added Sphinx documentation framework
Implemented disconnect() method for Connection class to properly close connections
Added comprehensive exception handling improvements