Summary

GlobalPlatform is an open-source C library and command-line toolkit for managing OpenPlatform 2.0.1 and GlobalPlatform 2.1.1 and later smart cards. It includes the GlobalPlatform library, GPShell command-line tools, and a PC/SC connection plugin.

Highlights:

• Complete GPShell3 SCP11a secure-channel workflow, including certificate, CA-KLOC, and elliptic-curve key-agreement provisioning.
• DAP signing and loading through DAP-verifying Security Domains.
• Delegated-management token workflows and receipt verification with AES, DES, RSA, and ECC keys.

GPShell Manual

GPShell3 is the preferred, task-oriented command-line interface for interactive use, shell scripts, and CI workflows. The legacy GPShell1 script interpreter remains available for established .txt automation.

• GPShell3 manual
• Legacy GPShell1 manual

Script Examples

• GPShell1 scripts: gpshell/examples/gpshell (.txt)
• GPShell3 scripts: gpshell/examples/gpshell3 (.sh)

Installed examples are available under /usr/share/doc/gpshell3/examples/, /usr/local/share/doc/gpshell3/examples/, or /home/linuxbrew/.linuxbrew/share/doc/gpshell3/examples/.

A quick demo video showcasing the most useful features in action:

The current GPShell3 walkthroughs are collected in the GPShell YouTube playlist.

Support and Consulting

Consulting for GlobalPlatform integration, smart-card deployment, and secure channel workflows is available at gpshell@ik.me.

Installation

GitHub Release Packages

Signed GitHub Release packages are available for Windows (MSI, MSIX, and ZIP), Linux (DEB, RPM, and AppImage), and macOS (DMG).

vcpkg for C and CMake Projects

Use the GlobalPlatform vcpkg registry to consume the library from C and CMake projects.

Windows SDK

The release page provides signed x86 and x64 Windows shared-library SDK ZIPs. They contain headers, import libraries, CMake package files, runtime DLLs, API documentation, and a minimal CMake consumer example.

Homebrew for Linux and macOS

Install the command-line tools and library from the Homebrew tap.

Verifying the Signatures of the Signed Binaries

The PGP fingerprint for the verification is 8024 D2E1 6156 0548 7C2F 1D7B 04B6 C967 7A2F 2791

wget https://github.com/kaoh/globalplatform/raw/master/release-key.asc
gpg --import release-key.asc
gpg --fingerprint

Ensure the fingerprint matches exactly.

gpg --verify SHA256SUMS.sig SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

If the signature is BAD → do not use the files.

You should see also something like:

gpshell-3.0.0-static.deb: OK

The Library And SDK

The C API documentation is generated from the release source. The library and its PC/SC plugin are available as CMake packages for applications embedding GlobalPlatform.

Use the vcpkg registry for regular C/CMake integration. Native Windows developers can instead use the signed shared-library SDK archives described above.

Compilation

Clone the project from GitHub or download the zip file (also available under the Clone tab).

Consult the individual subprojects for further instructions and prerequisites. It is also possible to compile the sub projects individually.

Prerequisites

Use a suitable packet manager for your OS or install the programs and libraries manually if applicable.

• Compiler Suite:
  • Linux: Termed build-essential in Debian based distributions (gcc, make)
  • macOS: Xcode
  • Windows: Visual Studio and SDK
• CMake 3.10 or higher is needed
• PC/SC Lite (only for UNIXes, Windows and macOS are already including this)
• Doxygen for generating the documentation
• Graphviz for generating graphics in the documentation
• OpenSSL (Use OpenSSL 3)
• zlib (macOS should already bundle this, for Windows a pre-built version is included)
• cmocka for running the tests
• Pandoc for generating the man page the tests

Unix

Install the dependencies with brew or your distribution's package manager:

brew install openssl doxygen pandoc cmake cmocka zlib graphviz pcsc-lite

Ubuntu:

apt-get install libssl-dev doxygen cmake libcmocka0 zlib1g-dev graphviz pcscd libpcsclite-dev pkg-config

Compile

NOTE: If using Homebrew in parallel and having not used Homebrew for installing the dependencies but the distribution's package manager then several tools and libraries can be hidden by Homebrew or are not installed in Homebrew (pkgconfig, PC/SC Lite, cmocka, ...). One option is to install these tools and libraries with brew or remove the Homebrew path from the PATH variable temporarily (which should be ./home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin).

cd \path\to\globalplatform
cmake -B build -DCMAKE_BUILD_TYPE=Release.
cd build
make
make doc
make install

NOTE: The Homebrew version of pcsc-lite is not a fully functional version. It is missing the USB drivers and is also not started as a system service. The distribution's version of pcscd should be installed. Under Linux the Homebrew version of pcsc-lite must be unlinked:

brew remove --ignore-dependencies pcsc-lite

macOS

The compilation was executed on a system with Homebrew as a package manager.

Install the dependencies with brew:

brew install openssl@3 doxygen cmocka pandoc cmake graphviz

Compile

It is necessary to set the OPENSSL_ROOT_DIR. In the case regarding the usage of Homebrew, this works:

cd \path\to\globalplatform
cmake -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=/usr/bin/gcc -DOPENSSL_ROOT_DIR=$(brew --prefix openssl@3) .
cd build
make
make install

NOTE: CMAKE_C_COMPILER is required if Xcode is installed. CMake would favor the Xcode compiler, leading to potential runtime errors.

Windows

Install the dependencies with Chocolatey in an administrator's PowerShell or install the dependencies manually:

choco install cmake doxygen.install graphviz

• For CMocka a pre-built version is used from the cmock-cmocka-1.1.5 directory.
• For zlib a pre-built version is used the zlib-1.3.1 directory.
• OpenSSL must be installed manually. Chocolatey is using the systems architecture, which is nowadays 64 bit, but the compilation needs the 32 bit version. Download OpenSSL and choose the Win32 bit version and no light version.

Compile

Launch Visual Studio Command Prompt / Developer Command Prompt / Developer PowerShell.

It will be necessary to set the ZLIB_ROOT and CMOCKA_ROOT and OPENSSL_ROOT_DIR. Use the pre-built versions of the project for convenience.

cd \path\to\globalplatform
cmake -G "NMake Makefiles" -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="C:\Program Files (x86)\OpenSSL-Win32" -DZLIB_ROOT="C:\Users\john\Desktop\globalplatform\zlib-1.3.1\win32-build" -DCMOCKA_ROOT="C:\Users\john\Desktop\globalplatform\cmocka-cmocka-1.1.5\build-w32"
nmake

NOTE: Read also the Windows-specific part in the GlobalPlatform subproject.

Documentation

Execute:

make/nmake doc

Binary Packages

Execute:

make/nmake package

Source Packages

Execute:

make/nmake package_source

Debug Builds

To be able to debug the library, enable the debug symbols:

cmake -B build .

Testing

To generate the tests, execute:

cmake -B build -DTESTING=ON -DINTEGRATION_TESTING=ON -DSTATIC=ON .
cd build
make
make test-unit
# with a recent JCOP test card with default keys
export OPGP_PLUGIN_PATH=$(pwd)/gppcscconnectionplugin/src
make test-integration

NOTE: On Windows: When using the Visual Studio command line, the necessary mock functions are not supported by the linker and tests cannot be executed.

Debug Output

The variable GLOBALPLATFORM_DEBUG=1 in the environment must be set. The logfile can be set with GLOBALPLATFORM_LOGFILE=<file>. Under Windows by default C:\Temp\GlobalPlatform.log is chosen, under Unix systems if syslog is available it will be used by default. The default log file under Unix systems is /tmp/GlobalPlatform.log if syslog is not available.

Packaging

cpack is used for packaging.

If only GPShell is in focus, a static build is recommended:

cmake -B build -DCMAKE_BUILD_TYPE=Release -DSTATIC=ON

For the packaging process run inside the build directory after the build:

cpack

• On Linux, cpack creates both DEB and RPM. You need dpkg-deb and rpmbuild installed.
• Windows MSI (WIX) is generated on Windows with WiX installed.
• macOS DragNDrop is generated on macOS.

There is a GitHub Action workflow for creating the packages.

The produced artifacts are automatically attached to a draft release of the corresponding tag. The SHA256SUMS has to be signed manually:

gpg -u kaoh@users.noreply.github.com> --armor --detach-sign SHA256SUMS

Generate GitHub Documentation

The GitHub documentation is located under the docs folder and is using Jekyll.

Installation:

cd docs
gem uninstall jekyll
# select all
gem install jekyll -v 3.9.0
gem uninstall bundler
gem install bundler
bundle
bundle update github-pages

Useful commands inside the docs folder:

• Cleaning local generated site: bundle exec jekyll clean
• Serving site in a local browser updating automatically on content changes: bundle exec jekyll serve
• Update configuration in the Gemfile: bundle update

Issues

For issues please use the GitHub issue tracker.

You can also use the Mailing List or ask a question on Stack Overflow assigning the tags gpshell or globalplatform.