feat(TcSecurityDeframer): expose active key SPIs and fingerprints

[nateinaction]

Summary

Stacked on #472. Closes #488.

Adds GET_ACTIVE_KEYS to TcSecurityDeframer: it logs one ActiveKeyInfo(spi, fingerprint) event per active key-store slot, so an operator who has lost track of what was provisioned can identify the slots without knowing the key material. fingerprint is the first 4 bytes of SHA-256(key), hex-encoded (computeKeyFingerprint in Authenticator.cpp) — the raw key never leaves the board. If the store is empty, a NoActiveKeys event is logged instead.

GET_ACTIVE_KEYS is bypass-allowlisted in ProvesRouter, the same as PROVISION_KEY/GET_SEQ_NUM: an operator who doesn't know the key can't send an authenticated command to ask what's provisioned, which is exactly the scenario this command exists for.

Test plan

• make test-unit — all 9 suites pass, including new computeKeyFingerprint coverage (deterministic for the same key, differs for different keys, never echoes the key's own hex encoding) and new Bypasser opcode tests for GET_ACTIVE_KEYS on all three links
• make generate build — clean full build, dictionary confirms opcodes 0x2100B005/0x2200B005/0x2300B005 for UART/LoRa/Sband GET_ACTIVE_KEYS
• make check-console-disabled — OK
• New integration test security_active_keys_test.py (runs after provision_key_test.py): sends GET_ACTIVE_KEYS, asserts the reported SPI matches what was provisioned and the fingerprint is an 8-hex-char string that never contains the raw key

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: afad4af4-c2eb-4383-a15e-2eff5faa2745

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}