Unable to use gnuk usb smartcard token on GuixSD

Done

Details

5 participants

Brice Waegeneire
Chris Marusich
Nils Gillmann
Ludovic Courtès
Vagrant Cascadian

Owner: unassigned

Submitted by: Vagrant Cascadian

Severity: normal

Debbugs page

Vagrant Cascadian wrote 7 years ago

Recipients:(address . bug-guix@gnu.org)

Message-ID:87r2mvui1b.fsf@aikidev.net

I've been unable to use my gnuk usb smartcard token with gnupg on

GuixSD, and it appears this is because scdaemon is built without libusb

support:

$ gpg --card-status

gpg: selecting openpgp failed: No such device

gpg: OpenPGP card not available: No such device

Attached is a patch that gets scdaemon working for me and a gnuk...

Unfortunately, enabling libusb causes one of the tets to hang

indefinitely:

PASS: tests/openpgp/decrypt-session-key.scm

Checking unwrapping the encryption.

> encsig-2-keys-3 encsig-2-keys-4 <

PASS: tests/openpgp/decrypt-unwrap-verify.scm

Checking signing with the default hash algorithm

So far, I've only been able to get it to work by disabling the

tests... so it's obviously not a good idea to enable without further

troubleshooting.

Another option might be to use pcsc-lite and ccid, but I had even less

luck getting that to work.

live well,

vagrant

Toggle diff (38 lines)diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index f397482ab..0e9e72784 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -39,6 +39,7 @@
   #:use-module (gnu packages curl)
   #:use-module (gnu packages crypto)
   #:use-module (gnu packages emacs)
+  #:use-module (gnu packages libusb)
   #:use-module (gnu packages openldap)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages perl-check)
@@ -232,6 +233,7 @@ compatible to GNU Pth.")
        ("libgcrypt" ,libgcrypt)
        ("libgpg-error" ,libgpg-error)
        ("libksba" ,libksba)
+       ("libusb" ,libusb)
        ("npth" ,npth)
        ("openldap" ,openldap)
        ("pcsc-lite" ,pcsc-lite)
@@ -246,12 +248,17 @@ compatible to GNU Pth.")
                           "--enable-all-tests")
       #:phases
       (modify-phases %standard-phases
+	;; (delete 'check)
         (add-before 'configure 'patch-paths
           (lambda* (#:key inputs #:allow-other-keys)
             (substitute* "scd/scdaemon.c"
               (("\"(libpcsclite\\.so[^\"]*)\"" _ name)
                (string-append "\"" (assoc-ref inputs "pcsc-lite")
                               "/lib/" name "\"")))
+            (substitute* "configure"
+              (("/usr/include/libusb-1.0")
+               (string-append (assoc-ref inputs "libusb")
+                              "/include/libusb-1.0")))
             #t))
         (add-after 'build 'patch-scheme-tests
           (lambda _

Nils Gillmann wrote 7 years ago

Recipients:(name . Vagrant Cascadian)(address . vagrant@debian.org)(address . 31337@debbugs.gnu.org)

Message-ID:20180502055707.5c7cpbrnykso6h2h@abyayala

Vagrant Cascadian transcribed 3.3K bytes:

Toggle quote (20 lines)> I've been unable to use my gnuk usb smartcard token with gnupg on
> GuixSD, and it appears this is because scdaemon is built without libusb
> support:
> 
>       $ gpg --card-status
>       gpg: selecting openpgp failed: No such device
>       gpg: OpenPGP card not available: No such device
> 
> Attached is a patch that gets scdaemon working for me and a gnuk...
> 
> Unfortunately, enabling libusb causes one of the tets to hang
> indefinitely:
> 
>       PASS: tests/openpgp/decrypt-session-key.scm
>       Checking unwrapping the encryption.
>           > encsig-2-keys-3 encsig-2-keys-4 <
>       PASS: tests/openpgp/decrypt-unwrap-verify.scm
>       Checking signing with the default hash algorithm
>           >

There should be a test-suite.log in some location in the build chroot,

have you checked that? You might need to build with -K.

Toggle quote (50 lines)> So far, I've only been able to get it to work by disabling the
> tests... so it's obviously not a good idea to enable without further
> troubleshooting.
> 
> Another option might be to use pcsc-lite and ccid, but I had even less
> luck getting that to work.
> 
> 
> live well,
>   vagrant
> 
> 
> diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
> index f397482ab..0e9e72784 100644
> --- a/gnu/packages/gnupg.scm
> +++ b/gnu/packages/gnupg.scm
> @@ -39,6 +39,7 @@
>    #:use-module (gnu packages curl)
>    #:use-module (gnu packages crypto)
>    #:use-module (gnu packages emacs)
> +  #:use-module (gnu packages libusb)
>    #:use-module (gnu packages openldap)
>    #:use-module (gnu packages perl)
>    #:use-module (gnu packages perl-check)
> @@ -232,6 +233,7 @@ compatible to GNU Pth.")
>         ("libgcrypt" ,libgcrypt)
>         ("libgpg-error" ,libgpg-error)
>         ("libksba" ,libksba)
> +       ("libusb" ,libusb)
>         ("npth" ,npth)
>         ("openldap" ,openldap)
>         ("pcsc-lite" ,pcsc-lite)
> @@ -246,12 +248,17 @@ compatible to GNU Pth.")
>                            "--enable-all-tests")
>        #:phases
>        (modify-phases %standard-phases
> +	;; (delete 'check)
>          (add-before 'configure 'patch-paths
>            (lambda* (#:key inputs #:allow-other-keys)
>              (substitute* "scd/scdaemon.c"
>                (("\"(libpcsclite\\.so[^\"]*)\"" _ name)
>                 (string-append "\"" (assoc-ref inputs "pcsc-lite")
>                                "/lib/" name "\"")))
> +            (substitute* "configure"
> +              (("/usr/include/libusb-1.0")
> +               (string-append (assoc-ref inputs "libusb")
> +                              "/include/libusb-1.0")))
>              #t))
>          (add-after 'build 'patch-scheme-tests
>            (lambda _

Ludovic Courtès wrote 7 years ago

Recipients:(name . Vagrant Cascadian)(address . vagrant@debian.org)(address . 31337@debbugs.gnu.org)

Message-ID:87zi1b93y7.fsf@gnu.org

Hi Vagrant,

Vagrant Cascadian <vagrant@debian.org> skribis:

Toggle quote (24 lines)> I've been unable to use my gnuk usb smartcard token with gnupg on
> GuixSD, and it appears this is because scdaemon is built without libusb
> support:
>
>       $ gpg --card-status
>       gpg: selecting openpgp failed: No such device
>       gpg: OpenPGP card not available: No such device
>
> Attached is a patch that gets scdaemon working for me and a gnuk...
>
> Unfortunately, enabling libusb causes one of the tets to hang
> indefinitely:
>
>       PASS: tests/openpgp/decrypt-session-key.scm
>       Checking unwrapping the encryption.
>           > encsig-2-keys-3 encsig-2-keys-4 <
>       PASS: tests/openpgp/decrypt-unwrap-verify.scm
>       Checking signing with the default hash algorithm
>           >
>
> So far, I've only been able to get it to work by disabling the
> tests... so it's obviously not a good idea to enable without further
> troubleshooting.

Did you try attaching strace or gdb to the faulty test to see what’s

going on?

It may be that this test depends on the availability of special hardware

or something like that, in which case we should arrange to skip just

this test.

Thanks for looking into it!

Ludo’.

Chris Marusich wrote 7 years ago

Recipients:(name . Vagrant Cascadian)(address . vagrant@debian.org)(address . 31337@debbugs.gnu.org)

Message-ID:87efimpuam.fsf@gmail.com

Vagrant Cascadian <vagrant@debian.org> writes:

Toggle quote (3 lines)

> Another option might be to use pcsc-lite and ccid, but I had even less

> luck getting that to work.

When you tried that, did you enable the USB drivers by creating a

symlink as described here?

https://lists.gnu.org/archive/html/guix-devel/2016-10/msg01433.html

Chris

Vagrant Cascadian wrote 7 years ago

Recipients:(name . Chris Marusich)(address . cmmarusich@gmail.com)(address . 31337@debbugs.gnu.org)

Message-ID:877engrhzr.fsf@aikidev.net

On 2018-05-07, Chris Marusich wrote:

Toggle quote (10 lines)> Vagrant Cascadian <vagrant@debian.org> writes:
>
>> Another option might be to use pcsc-lite and ccid, but I had even less
>> luck getting that to work.
>
> When you tried that, did you enable the USB drivers by creating a
> symlink as described here?
>
> https://lists.gnu.org/archive/html/guix-devel/2016-10/msg01433.html

With the symlink:

lrwxrwxrwx 1 root root 41 Jun 2 06:31 /var/lib/pcsc/drivers -> /home/vagrant/.guix-profile/pcsc/drivers/

Then I tried to run:

pcscd --debug --foreground

00000000 pcscdaemon.c:347:main() pcscd set to foreground with debug send to stdout

00000077 pcscdaemon.c:623:main() cannot create /var/run/pcscd: Permission denied

Running as root appears to have worked:

sudo -E --debug --foreground pcscd

Then as a user, "gpg --card-status" works. Haven't tried any other

functionality yet, but that's a good start.

So this seems like a somewhat complicated workaround, and making a

proper pcscd service would reduce the complication significantly. It

would obviously be slightly preferable to me for gnupg to support

smartcards out of the box. :)

live well,

vagrant

Brice Waegeneire wrote 4 years ago

Recipients:(name . Vagrant Cascadian)(address . vagrant@debian.org)

Message-ID:874ke2fax4.fsf@waegenei.re

Hello Vagrant,

Vagrant Cascadian <vagrant@debian.org> writes:

Toggle quote (5 lines)

> So this seems like a somewhat complicated workaround, and making a

> proper pcscd service would reduce the complication significantly. It

> would obviously be slightly preferable to me for gnupg to support

> smartcards out of the box. :)

There is a pcscd service in Guix now. Do you still have issue with using

smartcard in Guix or can we close this one?

Cheers,

- Brice

Brice Waegeneire wrote 4 years ago

Recipients:(name . Vagrant Cascadian)(address . vagrant@debian.org)

Message-ID:87zgv2s5qp.fsf@waegenei.re

Brice Waegeneire <brice@waegenei.re> writes:

Closing this issue since it's should be solved. Feel free to reopen it

if it's not the case.

Your comment

This issue is archived.

To comment on this conversation send an email to 31337@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it

mumi current 31337

Then, you may apply the latest patchset in this issue (with sign off)

mumi am -- -s

Or, compose a reply to this issue

mumi compose

Or, send patches to this issue

mumi send-email *.patch

You may also tag this issue. See list of standard tags. For example, to set the confirmed and easy tags

mumi command -t +confirmed -t +easy

Or, remove the moreinfo tag and set the help tag

mumi command -t -moreinfo -t +help

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date