What it shows
Every FIDO2 authenticator model has an AAGUID — a 128-bit identifier
shared by all units of that model. The FIDO Alliance's Metadata Service publishes a
signed registry mapping each AAGUID to its vendor description, icon and certification
status. keyroost reads your key's AAGUID and looks it up to show the model name and
logo, certification level (e.g. FIDO Certified L2) and date, protocol
family, and the CTAP/U2F versions the key reports.
Where the data comes from
keyroost ships a bundled snapshot of the metadata so the card works offline with no network access at runtime. The snapshot is a slimmed projection of the official MDS3 BLOB.
Updating the metadata
The bundled snapshot is embedded at build time, but keyroost also loads a
user-supplied copy at startup if present — so packaged builds (AppImage,
signed .exe, .dmg) can be refreshed without rebuilding.
python3 tools/gen_mds_data.py # downloads the live FIDO BLOB
python3 tools/gen_mds_data.py --blob mds.jwt # offline, from a local copyThen place the resulting mds_data.json at any of:
$KEYROOST_MDS_FILE, ~/.config/keyroost/mds_data.json (Linux),
~/Library/Application Support/keyroost/mds_data.json (macOS),
%APPDATA%\keyroost\mds_data.json (Windows), or next to the executable.
The runtime copy is read for display only and isn't cryptographically verified, so treat it as a convenience cache; the bundled copy is trusted build input.
Why a key might show no metadata
The AAGUID isn't in the bundled snapshot (regenerate with --all to
include more vendors), or the key reports an all-zero AAGUID — some U2F-only or
privacy modes — which has no MDS entry.