Spelling fixes CI

.github/workflows/ci.yml

@@ -57,6 +57,23 @@ jobs:
         run: make venv
       - name: Check hyperlinks
         run: make check-hyperlinks
+  check-spelling:
+    name: Check spelling
+    runs-on: ubuntu-latest
+    container: python:3.11
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install required packages
+        run: |
+          apt update
+          apt install -y libenchant-2-2
+      - name: Create virtual environment
+        run: make venv
+      - name: Check spelling
+        run: |
+          make check-spelling SKIP_ADD_SPELLINGS=1
+          if [ -z "$(find . -name '*.spelling')" ]; then exit 0; else exit 1; fi
   build-check-foreign:
     if: ${{ github.event.pull_request.head.repo.owner.login != 'nitrokey' }}
     name: Check Build for Foreign Repository

source/components/nethsm/administration.rst

@@ -491,7 +491,7 @@ The current system time can be retrieved as follows.
 The current system time can be manually adjusted as follows. Note that manually
 setting the clock is usually not required to set the system time, as it is set
 during provisioning. If NTP/NTS is configured, the manually set time will be
-eventually overriden by the server's time.
+eventually overridden by the server's time.
 
 .. important::
    Make sure to pass the time in UTC timezone.

source/components/nethsm/clustering.rst

@@ -291,7 +291,7 @@ new member to catch up with the cluster. Once this is done, it can be
 promoted from learner to full member.
 
 .. warning::
-   Promoting a node incrases the cluster's quorum threshold (refer to the `API documentation <https://nethsmdemo.nitrokey.com/api_docs/index.html>`__ and the `Operational Redundancy <clustering.html#operational-redundancy>`__ section of this document). Ensure this new node has a stable connection to the cluster before promoting it.
+   Promoting a node increases the cluster's quorum threshold (refer to the `API documentation <https://nethsmdemo.nitrokey.com/api_docs/index.html>`__ and the `Operational Redundancy <clustering.html#operational-redundancy>`__ section of this document). Ensure this new node has a stable connection to the cluster before promoting it.
 
 You can attempt to promote the new member with a call to ``POST /cluster/members/{MemberID}/promote``
 (refer to the `API documentation <https://nethsmdemo.nitrokey.com/api_docs/index.html>`__). If the learner hasn't
@@ -514,9 +514,9 @@ resolving the underlying condition), you can either:
   *Operational* state depending on the unattended boot setting.
 
 .. note::
-   If a node is isolated with ``force-new``, it will now be desynchronized with
+   If a node is isolated with ``force-new``, it will desynchronized with
    the cluster: any new writes on it or the cluster cannot be reconciled. The
-   node can still re-join the cluster, but will lose all its local
+   node can still rejoin the cluster but will lose all its local
    modifications.
 
 The ``POST /cluster/force-new`` endpoint, which is only available in the

source/components/nethsm/pkiproxy-windows-ca.rst

@@ -1,6 +1,10 @@
 Windows Active Directory Certificate Services (ADCS) with PKI Proxy
 -------------------------------------------------------------------
 
+.. spelling:word-list::
+
+   SPN
+
 This document describes the configuration of Windows Active Directory Certificate Services (ADCS) with PKI Proxy and NetHSM.
 
 Prerequisites
@@ -253,7 +257,7 @@ Windows ADCS Configuration
        This isn't necessary as the PKI Proxy KSP doesn't require any additional authentication for using the private key.
 
 4. After the configuration wizard has finished, open the **Certification Authority** from the **Start menu** or by pressing **Windows Key + R** on your keyboard and entering ``certsrv.msc``.
-   You can verify that the certificate authority service started correctly when you see a green dot with a white checkmark icon on the name of the certification authority.
+   You can verify that the certificate authority service started correctly when you see a green dot with a white check-mark icon on the name of the certification authority.
 
 .. important::
    The availability of the certification authority depends on the availability of the private key and certificate.

source/components/nethsm/system_recovery.rst

@@ -43,7 +43,7 @@ The system recovery can be performed as follows.
             Some USB drives are incompatible with the NetHSM.
             This results in the NetHSM not recognizing them as a boot media.
             In case the NetHSM does not boot from the connected USB drive, try a different USB drive model.
-            Best results are achieved with drives that have samller capacities and USB 2.0 interface.
+            Best results are achieved with drives that have smaller capacities and USB 2.0 interface.
 
       5. Optionally: Connect a keyboard and monitor with the NetHSM.
       6. Make sure the system is turned off, but connected to power.

source/components/nextbox/faq/generic.rst

@@ -38,7 +38,7 @@ Generic FAQ
 .. faq:: How secure is the NextBox?
 
    Debian with frequent `unattended-upgrades` based security updates, a minimal
-   attack surface by ensuring that not a single unneccessary port is open
+   attack surface by ensuring that not a single unnecessary port is open
    are the main contributors to system security. **Make sure your Nextcloud users
    and passwords are on a high level, either with long-random passwords or a
    2-Factor-Authentification supported login method with e.g., a Nitrokey FIDO2.**

source/components/nextbox/gettingstarted.rst

@@ -53,7 +53,7 @@ Ready To Go
 -----------
 
 .. note::
-   Please make sure your Nextbox is always on and connected to the internet.
+   Please make sure your NextBox is always on and connected to the internet.
    A downtime can lead to it missing an update, and that can in the worst case
    break the device, since some Nextcloud updates don't support updates from older versions.
 

source/components/nitrokeys/features/fido2/nitrophone.rst

@@ -1,6 +1,10 @@
 FIDO2 on Android / NitroPhone
 *****************************
 
+.. spelling:word-list::
+
+   Authnkey
+
 .. Note::
    For more information about FIDO2, FIDO2 U2F and Passkeys, check our `blog article  <https://www.nitrokey.com/blog/2022/fido2-webauthn-passkeys-2022-and-2023>`_.
 
@@ -19,4 +23,4 @@ Authnkey also comes with useful features such as:
 Other apps can also be used, such as:
 
 - `Passchain  <https://f-droid.org/packages/s1m.hwfido2provider/>`_
-- `Open Passkey Authenticator   <https://f-droid.org/packages/de.noisruker.openPasskeyAuth/>`_
+- `Open Passkey Authenticator   <https://f-droid.org/packages/de.noisruker.openPasskeyAuth/>`_

source/components/nitrokeys/features/fido2/provision-entra.rst

@@ -5,7 +5,7 @@ Nitrokey Provisioning for Entra ID
 
 .. contents:: :local:
 
-The Nitrokey 3 and Nitrokey Passkey support provisioning credentials for Microsoft Entra for seamless employee onboarding in enterprise scenarios.
+The Nitrokey 3 and Nitrokey Passkey support provisioning credentials for Microsoft Entra for seamless employee on-boarding in enterprise scenarios.
 
 Setup
 -----

source/components/nitrokeys/features/hsm/dnssec.rst

@@ -4,6 +4,7 @@ DNSSEC
 .. spelling:word-list::
    Lisse
    Piet
+   Mens
 
 .. product-table:: hsm
 

source/components/nitrokeys/features/hsm/ipsec.rst

@@ -1,11 +1,15 @@
 IPSec
 =====
 
+.. spelling:word-list::
+
+   strongSwan
+
 .. product-table:: nk3 storage start pro hsm
 
 .. contents:: :local:
 
-`Strong Swan <https://www.strongswan.org/>`__ works using the `PKCS#11 driver <https://www.nitrokey.com/documentation/applications#pkcs11>`__. Basically follow these steps:
+`strongSwan <https://www.strongswan.org/>`__ works using the `PKCS#11 driver <https://www.nitrokey.com/documentation/applications#pkcs11>`__. Basically follow these steps:
 
 1. Generate a key on Nitrokey via pkcs11-tool. In this example it's a 4096 bit RSA key.
 
@@ -35,7 +39,7 @@ IPSec
 
       $ pkcs11-tool --module /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so -l -y cert -w user@email.com-staging-cert.der --id 10 --label 'Staging Access'
 
-6. Configure Strongswan to load opensc-pkcs11 module then to load the certificate on Nitrokey. Edit /etc/strongswan.d/charon/pkcs11.conf and add the following module:
+6. Configure strongSwan to load OpenSC's PKCS#11 module then to load the certificate on Nitrokey. Edit ``/etc/strongswan.d/charon/pkcs11.conf`` and add the following module:
 
    .. code-block:: text
 
@@ -46,6 +50,6 @@ IPSec
       }
 
 
-7. Initiate the VPN connection via IPSec/Strongswan, then prompt for Nitrokey PIN
+7. Initiate the VPN connection via IPSec/strongSwan, then prompt for Nitrokey PIN
 
 8. VPN is now connected

source/components/nitrokeys/features/misc/ecc.rst

@@ -147,7 +147,7 @@ You can install GnuPG 2.1.18 on such system with the commands below.
 This involves newer Debian packages, which is the easiest option.
 This approach has been tested successfully on Ubuntu
 17.10 and probably works on 16.04 as well.
-However, the occurence of problems during usage can't be excluded.
+However, the occurrence of problems during usage can't be excluded.
 
 .. code-block:: bash
 

source/components/nitrokeys/features/openpgp-card/desktop-login/pam.rst

@@ -30,7 +30,7 @@ It is necessary to already have keys generated on the Nitrokey, as the authentic
 2. Now you have to add a line to ``/etc/poldi/localdb/users`` which contains the following information ``<YourApplicationID> <YourUsername>``.
    This could look like ``D00600012401020000000000xxxxxxxx nitrokeyuser``. Now dump the public key from the Nitrokey into Poldi's local database:
 
-   This could look like ``D00600012401020000000000xxxxxxxx nitrokeyuser``. Now dump the public key from the Nitrokey into Poldis local db:
+   This could look like ``D00600012401020000000000xxxxxxxx nitrokeyuser``. Now dump the public key from the Nitrokey into Poldi's local db:
 
    .. code-block:: bash
 

source/components/nitrokeys/features/openpgp-card/openpgp-csp.rst

@@ -23,7 +23,7 @@ You may want to install the driver on the server as well for being able to enfor
 Creating Certificate Template on Server Side
 --------------------------------------------
 
-On Active Directory Server open certsrv.msc to manage your certificate templates. Right click on **Certificate Templates** and choose **Manage**.
+On Active Directory Server open ``certsrv.msc`` to manage your certificate templates. Right click on **Certificate Templates** and choose **Manage**.
 
 .. figure:: images/openpgp-csp/1.png
    :alt: img1
@@ -57,7 +57,7 @@ Then go to *Extensions*, there you edit the applications guideline and add *Secu
 Request Certificate on Client (Domain Member)
 ---------------------------------------------
 
-To request a certificate for a domain member, you have to open certmgr.msc. Right click on folder **Personal** -> **Certificates** and click
+To request a certificate for a domain member, you have to open ``certmgr.msc``. Right click on folder **Personal** -> **Certificates** and click
 **All Tasks** -> **Request New Certificate** and choose the template you created on the AD.
 
 .. figure:: images/openpgp-csp/8.png

source/components/nitrokeys/features/openpgp-card/openpgp-thunderbird.rst

@@ -141,7 +141,7 @@ To encrypt data and e-mails, a key pair consisting of a public key and a private
    avoid known prose or lyric. Also, no name or known term should be
    used.
 
-   **Allowed characters**: a-z A-Z 0-9 /.,;:-!?( )%+ (no umlauts ä,ü,ö,Ä,Ü,Ö or ß)
+   **Allowed characters**: ``a-z``, ``A-Z``, ``0-9``, ``/.,;:-!?( )%+`` (no umlauts ``ä``, ``ü``, ``ö``, ``Ä``, ``Ü``, ``Ö`` or ``ß``)
 
    **Poor Passwords**: ``qwerty123``, ``ILoveSusi3``, ``Password``
 

source/components/nitrokeys/features/openpgp-card/openvpn/easyrsa.rst

@@ -7,7 +7,7 @@ OpenVPN Configuration with Easy-RSA
    :depth: 2
 
 .. note::
-   This guide is work-in-progress, and will be updated accordinlgy. Please take this status into consideration.
+   This guide is work-in-progress, and will be updated accordingly. Please take this status into consideration.
 
 This guide shows how to configure OpenVPN clients to login using a `Nitrokey Pro
 2 <https://shop.nitrokey.com/shop/product/nk-pro-2-nitrokey-pro-2-3>`__ or a `Nitrokey Storage

source/components/nitrokeys/features/openpgp-card/overview.rst

@@ -32,10 +32,10 @@ If you do not have OpenPGP keys yet, you need to generate them first.
 
 -  `Generate keys locally <openpgp-keygen-backup.html>`_
 
-   Ccopy them to your Nitrokey device - this is the most flexible, expert option,
+   Copy them to your Nitrokey device - this is the most flexible, expert option,
    but only secure if your system is not compromised, because you can
    create a backup key outside your Nitrokey A similar description in
-   french can be found `here <https://xieme-art.org/post/importer-des-clefs-gnupg-dans-sa-nitrokey-pro/>`__.
+   French can be found `here <https://xieme-art.org/post/importer-des-clefs-gnupg-dans-sa-nitrokey-pro/>`__.
 
 Importing Existing Keys
 -----------------------

source/components/nitrokeys/fido2/firmware-update.rst

@@ -4,7 +4,8 @@ Firmware Update
 This guide describes how to update the firmware on the Nitrokey FIDO2.
 
 .. important::
-   User Data is retained during firmware update. Anyways, be sure to **always** have another device (or login method) registered with your service, if for some reason your data is not retained.
+   User Data is retained during firmware update.
+   Anyway, be sure to **always** have another device (or login method) registered with your service, if for some reason your data is not retained.
 
 How to Update
 -------------

source/components/nitrokeys/nitrokey3/firmware-update-qubes.rst

@@ -13,7 +13,7 @@ This guide describes how to update Nitrokey 3's firmware with nitropy in Qubes O
 
 .. important::
    Please read the general `firmware update instructions`_ before!
-   Since for specifc versions there are limitations regarding what data is possible to migrate to the new version.
+   Since for specific versions there are limitations regarding what data is possible to migrate to the new version.
 
 .. _firmware update instructions: ./firmware-update.html
 

source/components/nitrokeys/nitrokey3/firmware-update.rst

@@ -14,7 +14,8 @@ This guide describes how to update the firmware on the Nitrokey 3.
    applications/services.
 
 
-   **For firmware v1.0.1 and above user data is retained** during the update. Anyways, be sure to always have another device (or login method) registered with your service, if for some reason your data is not retained.
+   **For firmware v1.0.1 and above user data is retained** during the update.
+   Anyway, be sure to always have another device (or login method) registered with your service, if for some reason your data is not retained.
 
 How to Update
 -------------

source/components/nitrokeys/nitrokey3/set-pins.rst

@@ -26,7 +26,7 @@ The PIN for FIDO2 can be set with `Nitropy <../../software/nitropy/index.html>`_
 
 .. warning::
    The PIN has a retry counter of eight attempts. After eight attempts, the PIN is locked and the FIDO feature must be reset, which deletes all saved FIDO2 credentials.
-   To prevent accidental lock of the PIN, the device needs to be unplugged and rei-plugged every 3 attempts.
+   To prevent accidental lock of the PIN, the device needs to be unplugged and re-plugged every 3 attempts.
 
 .. note::
    The *FIDO2 PIN* must have a minimal length of 4 characters and maximal length of 63 characters.
@@ -131,7 +131,7 @@ The factory default for the *Admin PIN* is ``12345678``.
 
 .. note::
    The *Admin PIN* must have a minimal length of 8 characters and maximal length of 127 characters.
-   It can contain alphanumeric characters, including special characters such as punctation.
+   It can contain alphanumeric characters, including special characters such as punctuation.
 
 .. warning::
    The *Admin PIN* has a PIN retry counter of 3 attempts.
@@ -155,7 +155,7 @@ It is useful in situations when the user of the Nitrokey should be able to unblo
 
 .. note::
    The *Reset Code* must have a minimal length of 8 characters and maximal length of 127 characters.
-   It can contain alphanumeric characters, including special characters such as punctation.
+   It can contain alphanumeric characters, including special characters such as punctuation.
 
 .. note::
    Once the *Reset Code* is set it can not be disabled anymore. Disabling would require a reset of the OpenPGP Card application.
@@ -187,7 +187,7 @@ The factory default for the *PIN* is ``123456``.
 
 .. note::
    The *PIN* must have maximal length of 8 characters.
-   It can contain alphanumeric characters, including special characters such as punctation.
+   It can contain alphanumeric characters, including special characters such as punctuation.
 
 .. warning::
    The *PIN* has a PIN retry counter of 3 attempts.
@@ -204,7 +204,7 @@ The factory default for the *PUK* is ``12345678``.
 
 .. note::
    The *PUK* must have a maximal length of 8 characters.
-   It can contain alphanumeric characters, including special characters such as punctation.
+   It can contain alphanumeric characters, including special characters such as punctuation.
 
 .. warning::
    The *PUK* has a retry counter of 3 attempts.

source/components/nitropad-nitropc/faq.rst

@@ -28,5 +28,5 @@ NitroPad, NitroPC FAQ
    they may have copied the LUKS header, i.e., the encryption key. Using this
    copy, one might decrypt the hard-disk even with a new password being set.
    This is why the re-ownership wizard proposes to re-encrypt the hard-disk,
-   which reencrypts in place ensuring the previously described scenario
+   which re-encrypts in place ensuring the previously described scenario
    cannot be applied.

source/components/nitropad-nitropc/heads/factory-reset-heads2.rst

@@ -23,7 +23,7 @@ Procedure
 .. tabs::
    .. tab:: Heads v2.5+
       1. Connect your Nitrokey to the NitroPad.
-      2. Turn on the NitroPad and interupt the automatic boot by pressing any key.
+      2. Turn on the NitroPad and interrupt the automatic boot by pressing any key.
       3. Select “Options”.
 
          .. figure:: /components/nitropad-nitropc/images/factory-reset-heads2/options.jpg
@@ -40,7 +40,7 @@ Procedure
             :alt: confirm
 
       6. The integrity of your setup will be tested.
-         Deppending on your reason to perform the reset this can fail; continue with "Ok" anyway.
+         Depending on your reason to perform the reset this can fail; continue with "OK" anyway.
 
          .. figure:: /components/nitropad-nitropc/images/factory-reset-heads2/confirm-integrity.jpg
             :alt: confirm integrity
@@ -89,7 +89,7 @@ Procedure
           .. figure:: /components/nitropad-nitropc/images/factory-reset-heads2/tpm.jpg
              :alt: tpm password enter
 
-      12. Scan QR code with Phone to inport TOTP Seceret (optional) and hit Enter
+      12. Scan QR code with Phone to import TOTP Secret (optional) and hit Enter
 
           .. figure:: /components/nitropad-nitropc/images/factory-reset-heads2/totp.jpg
              :alt: qr code totp

source/components/nitropad-nitropc/qubes/index.rst

@@ -62,7 +62,7 @@ changed by you:
    To update use the Update Manager as described in the `Qubes Documentation <https://www.qubes-os.org/doc/how-to-update/>`__.
 
 .. note::
-   Specifically for NitroPad V54 the Qubes 4.2.3 installation image contains a bug that limits to use the highest screen resoultion only.
+   Specifically for NitroPad V54 the Qubes 4.2.3 installation image contains a bug that limits to use the highest screen resolution only.
    This is fixed after you update dom0 and reboot.
 
 Behavior After a System Update

source/components/nitrophone/hmdm/launcher-app-installation.rst

@@ -8,7 +8,7 @@ Launcher App Installation
 
 .. important::
 
-   We recommand to backup your data before installing MDM.
+   We recommend to backup your data before installing MDM.
 
 Your NitroPhone needs to be connected to the internet during the configuration and you also need a PC.
 

source/components/nitrophone/hmdm/server-update.rst

@@ -52,5 +52,5 @@ In case of an update only the WAR file for the application server is required.
    If you encounter an HTTP error 404, restore the HMDM configuration file from the backup and restart the application server again.
 
 .. note::
-   If the version number has not been updated in the webpanel "about" section you may need to clear the cache of your browser.
+   If the version number has not been updated in the web panel *About* section you may need to clear the cache of your browser.