feat: add PIV and YubiKey hardware backends

Author: lomigmegard

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install system libraries
-        run: sudo apt-get update && sudo apt-get install -y libssl-dev
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev libpcsclite-dev
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           components: rustfmt, clippy
@@ -28,18 +28,25 @@ jobs:
         run: cargo fmt --all -- --check
       - name: Clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
+      # The default workspace build leaves the hardware-backend features off, so
+      # lint the piv/yubikey code paths and their tests explicitly.
+      - name: Clippy (hardware backends)
+        run: cargo clippy -p rite-stdlib --features piv,yubikey --all-targets -- -D warnings
 
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install system libraries
-        run: sudo apt-get update && sudo apt-get install -y libssl-dev
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev libpcsclite-dev
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: Test
         run: cargo test --workspace
+      # piv/yubikey are off by default; run their action and backend tests.
+      - name: Test (hardware backends)
+        run: cargo test -p rite-stdlib --features piv,yubikey
 
   msrv:
     # Verifies the MSRV floor declared on the library crates that are

.github/workflows/release.yml

@@ -73,7 +73,10 @@ jobs:
           key: release-${{ matrix.rust_target }}
 
       - name: Build rite
-        run: cargo build --release -p rite --target ${{ matrix.rust_target }} --features openssl-vendored
+        # PC/SC is a system framework on macOS (PCSC.framework) and Windows
+        # (WinSCard), so the native release binaries carry the piv/yubikey
+        # backends. Only the static musl Linux tarballs stay software-only.
+        run: cargo build --release -p rite --target ${{ matrix.rust_target }} --features openssl-vendored,piv,yubikey
 
       - name: Build rite-ls
         run: cargo build --release -p rite-ls --target ${{ matrix.rust_target }}
@@ -104,6 +107,13 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
+      # The glibc `image` target compiles the arm64 binary under emulation, so
+      # register QEMU binfmt explicitly rather than relying on the runner's
+      # preinstalled handlers. The musl `binaries-*` targets cross-compile and
+      # do not need it.
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0