Changes:

1.5.21 - October 2026, Ludovic Rousseau

• getMechanismList(): do not return mechanism 0x1D (debug code introduced by mistake in release 1.5.19)

• build binary wheels for Python 3.15

Why this new release?

No code change in this release.

I created a new release to ensure that the binary wheels for Python 3.14 and 3.15 were uploaded to PyPI. This is intended for systems that are difficult to use for rebuilding PySCard, particularly Windows.

Changes:

2.3.2 (October 2026)

• add builds for Python 3.14 & 3.15

• Minor changes

Changes:

2.5.3: Ludovic Rousseau

18 October 2026

• pcscd.service: preserve card sessions across polkit restarts

• correctly decode all ATRs (fix the fix suggested by AI)

• Fix authorization for uid > 65536

CCID

    $ grep -A 1 CFBundleShortVersionString /usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents/Info.plist
            <key>CFBundleShortVersionString</key>
            <string>1.5.1</string>

There has been no change since the release of macOS Sonoma in 2023. The version of my CCID driver included in macOS is still 1.5.1.

Apple CCID driver

$ defaults read /Library/Preferences/com.apple.security.smartcard.plist
{
        Logging = 0;
}

The Apple CCID driver is used by default.

If you want or need to use my CCID driver instead, simply follow follow the instructions at Apple's own CCID driver in Sonoma.

Conclusion

As I mentioned in my article about macOS Tahoe, if you encounter any issues with your smart card on macOS Golden Gate, I recommend switching from the Apple driver to my CCID driver and checking again.

Changes:

1.8.4 - 20 September 2026, Ludovic Rousseau

• Add support of

  • THALES PKI Transaction Pad

• fix some minor issues found by an AI tool

• Some other minor improvements

Changes:

2.5.2: Ludovic Rousseau 19 September 2026

• hotplug_libudev: rescan "serial" readers in HPReCheckSerialReaders()

• fix minor issues found by AI tool

Explanation

This version only fixes a problem on Windows.

In version 1.5.19, I upgraded the PKCS#11 header file pkcs11.h to version PKCS#11 3.2. Execution of automatic tests failed on Windows. I then disabled failed test. But I, in fact, disabled all the tests on Windows. And the problem went unnoticed.

Version 1.5.19 did not contain the code required to pack the structures on Windows. So the PyKCS11 wrapper and the PKCS#11 library were not alligned on the data format. And crash...

Changes:

1.5.20 - September 2026, Ludovic Rousseau

• fix C_Initialize() crash on Windows

Very low impact

The reported issues are either not exploitable because the input and output buffers used by PC/SC Lite to call the CCID driver are large enough, or the exploitation requires rogue smart card or smart card reader (i.e. sending non-compliant data).

If you would like to read the details, the issues have been fixed in the following git commits:

• Fix potential buffer overflow

• Fix possible out-of-bounds access

• Check for underflow in SecurePINModify

• Check for short CCID payload

• Fix potential issues in serial driver

• Fix potential buffer overflows

Comments

The AI tool identified real issues.

However, it would be difficult to exploit these issues unless the attacker used a custom-built reader or smart card. This is something I started doing with the Pico HSM project, which is a CCID reader in a Raspberry Pi Pico. This allows you to modify the CCID frames sent by the reader as required.

The bug reports from the AI tool are very verbose. This is useful for impressing a manager with a long, complex-looking text. However, reading the entire report is often a waste of my time. It is often much faster to read the proposed patch to understand the problem it is trying to fix.

The proposed fixes are, sometimes, incorrect. They are a good starting point, though. However, never apply an AI-generated patch without fully understanding it.

Conclusion

Thanks to Red Hat and Jakub Jelen for the bug reports.

I am very happy that the AI tool only identified issues with no or low impact.

Changes:

1.8.3 - 29 August 2026, Ludovic Rousseau

• Add support of

  • Broadcom Corp 58200 0x5884

  • Broadcom Corp 58200 0x5885

  • Broadcom Corp 58200 0x5886

  • Broadcom Corp 58200 0x5887

  • Circle CIR135 ICC

  • DigiFlow LLP. KAZTOKEN

  • HID Global Crescendo NFC Reader

  • HID Global OMNIKEY Plug

  • HID Global OMNIKEY SE Plug

  • Neowave LinkeoC-PRO

  • Swissbit iShield Key 2 Pro

• macOS: provide a sample script to build the driver with meson

• fix some minor issues found by an AI tool

• Some other minor improvements

Changes:

1.5.19 - August 2026, Ludovic Rousseau

• Add support of swig 4.5.0

• getMechanismList(): do not fail on unknown mechanisms

• Remove use of deprecated CKA_SECONDARY_AUTH

• test/reset_softHSM:

  • add support of Homebrew on arm64

  • add some output traces

• setup: Rename the project in lower case

• Move source code in src/

• minor improvements