Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Debian package meta-info and GitHub package builder action #35

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

linux4life798
Copy link

This introduces a complete Debian package meta description and a GitHub action to build it.
The built package automatically sets up the groups and services needed to automatically run tpm-fido.

Specifically, the Debian meta information does the following:

  • Uses the normal Debian package golang source builder script, but slightly alters the behavior to not require providing separate Debian packages for all dependencies. Instead, it will just download all dependencies at build time, like running "go build" would normally do.
  • Uses the systemd-sysusers mechanism to setup a new system group named "uhid". This automatically adds the postinst style package maintenance script hooks to ask systemd-sysusers to add/update the group. However, it will not remove the group on uninstall, which seems to be common package behavior.
  • Sets up a systemd service to change permission of /dev/uhid to root:uhid and 0660, called uhid-permission. I tried using udev, but this wasn't working. See bellow.
  • Sets up a systemd user service to run tpm-fido, called tpm-fido.

Before adding the uhid-permission boot job, I did attempt to get udev to change the permission of /dev/uhid.
However, I couldn't figure out how to get udev to trigger, since it doesn't seem to receive any events about /dev/uhid, until
after a service requests a new virtual hid. See the debian/tpm-fido.udev.disabled file for more detail.

The GitHub action is pretty basic. It checks out the source, opens a Debian docker container, installs the build dependencies (package), runs the dpkg-buildpackage command, and then uploads the output package+build-info as an action artifact.
So, you can just download these artifacts and install away.

I tried to add as many comments and references as possible to help with understanding and maintenance.

As a starting point, I ran the following command and then minimized
the configuration for stand-alone builds:
dh-make-golang github.com/psanford/tpm-fido

I created the debian/changelog file by running the following:
debchange --create

I used the following command to update the changelog version:
git log --date=format:%Y%m%d --pretty="0.0~git%cd.%h-1"
I just ran "debchange -i" and added a note.

In the future, you can just keep running "debchange -i" to increment
the revision on this same entry. When you would line to change it
to an actual release, you just run "debchange -r".
@linux4life798
Copy link
Author

linux4life798 commented May 6, 2024

Hi @psanford! I'm more than happy to change the references to my name/email to your name/email, but I just wanted to check if you were okay with putting your name/email in the text files, before doing so. Let me know what you think!


* Initial release.

-- Craig Hesling <craig@hesling.com> Sun, 05 May 2024 20:23:37 -0700
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is a name/email that I can happily change to your name/email.

Section: golang
Priority: optional
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Uploaders: Craig Hesling <craig@hesling.com>
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is another name/email that I can happily change to your name/email.

linux4life798 referenced this pull request in bast1aan/scripts May 6, 2024
Safe installer and small GUI extension to the great tpm-fido tool
https://github.com/psanford/tpm-fido
@psanford
Copy link
Owner

psanford commented May 6, 2024

Thanks for the pr!

My philosophy is that packaging specific changes belong in the respective distribution repositories. I would encourage you to open this pr directly with Debian.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants