Initial package creation

Based on Poldi-git package with additional patch to enable
support of ECC and DSA public keys.

Tested with a Nitrokey Start smartcard and a ECC ed25519 key.

7 files changed, 370 insertions, 0 deletions

diff --git a/.SRCINFO b/.SRCINFO
new file mode 100644
index 000000000000..af218c69a2d8
--- /dev/null
+++ b/.SRCINFO
@@ -0,0 +1,32 @@
+pkgbase = poldi-ecc-dsa-git
+	pkgdesc = PAM module for authentication using a smartcard
+	pkgver = r142.d9a9ff9
+	pkgrel = 1
+	url = http://git.gnupg.org/cgi-bin/gitweb.cgi?p=poldi.git
+	install = poldi.install
+	arch = i686
+	arch = x86_64
+	license = GPL
+	makedepends = git
+	makedepends = autoconf
+	makedepends = automake
+	depends = libgcrypt
+	depends = libgpg-error
+	depends = libksba
+	depends = pam
+	optdepends = logrotate: To avoid giant logfiles
+	conflicts = poldi
+	conflicts = poldi-git
+	backup = etc/poldi/poldi.conf
+	backup = etc/pam.d/system-auth-poldi
+	source = poldi::git://git.gnupg.org/poldi/
+	source = 0001-Update-path-to-scdaemon.patch
+	source = 0002-Support-ECC-and-DSA-pub-keys.patch
+	source = poldi.logrotate
+	md5sums = SKIP
+	md5sums = 6ccfe3af0362bca96d1d85aa097b5f1d
+	md5sums = a91b462fc86511fe7e16bb0168fae48e
+	md5sums = 57009cc5211088396d2521fc1997792b
+
+pkgname = poldi-ecc-dsa-git
+
diff --git a/0001-Update-path-to-scdaemon.patch b/0001-Update-path-to-scdaemon.patch
new file mode 100644
index 000000000000..ba58fe291b7c
--- /dev/null
+++ b/0001-Update-path-to-scdaemon.patch
@@ -0,0 +1,23 @@
+From 097e6e2ad904f0c21870716e4c305a6d0aedb593 Mon Sep 17 00:00:00 2001
+From: Olivier Mehani <shtrom@ssji.net>
+Date: Mon, 30 Apr 2018 21:06:38 +1000
+Subject: [PATCH] Update path to scdaemon
+
+Signed-off-by: Olivier Mehani <shtrom@ssji.net>
+---
+ conf/poldi.conf.skel | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/conf/poldi.conf.skel b/conf/poldi.conf.skel
+index 3fed157..3babbb1 100644
+--- a/conf/poldi.conf.skel
++++ b/conf/poldi.conf.skel
+@@ -11,4 +11,4 @@ log-file /var/log/poldi
+ debug
+ 
+ # Specify SCDaemon executable
+-scdaemon-program /usr/lib/gnupg2/scdaemon
++scdaemon-program /usr/lib/gnupg/scdaemon
+-- 
+2.17.0
+
diff --git a/0002-Support-ECC-and-DSA-pub-keys.patch b/0002-Support-ECC-and-DSA-pub-keys.patch
new file mode 100644
index 000000000000..d426e460934e
--- /dev/null
+++ b/0002-Support-ECC-and-DSA-pub-keys.patch
@@ -0,0 +1,148 @@
+From 5cf6de5ded961302afdfac5e0a7995ae456aaef2 Mon Sep 17 00:00:00 2001
+From: ap4y <mail@ap4y.me>
+Date: Wed, 3 Apr 2019 21:59:31 +1300
+Subject: [PATCH] Support ECC and DSA pub keys
+
+---
+ src/util/support.c | 90 ++++++++++++++++++++++++++++++++++++----------
+ src/util/support.h |  7 ++++
+ 2 files changed, 79 insertions(+), 18 deletions(-)
+
+diff --git a/src/util/support.c b/src/util/support.c
+index 8e576c6..773f3d8 100644
+--- a/src/util/support.c
++++ b/src/util/support.c
+@@ -86,26 +86,17 @@ challenge_verify_sexp (gcry_sexp_t sexp_key,
+   gpg_error_t err = GPG_ERR_NO_ERROR;
+   gcry_sexp_t sexp_signature = NULL;
+   gcry_sexp_t sexp_data = NULL;
+-  gcry_mpi_t mpi_signature = NULL;
++  int algo = pk_algo (sexp_key);
+ 
+-  /* Convert buffers into MPIs.  */
+-  if (! err)
+-    {
+-      if (gcry_mpi_scan (&mpi_signature, GCRYMPI_FMT_USG, response, response_n,
+-			 NULL))
+-	err = gpg_error (GPG_ERR_BAD_MPI);
+-    }
++  if (algo == 0)
++    return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
++
++  err = challenge_data (&sexp_data, algo, challenge, challenge_n);
+ 
+-  /* Create according S-Expressions.  */
+-  if (! err)
+-    err = gcry_sexp_build (&sexp_data, NULL,
+-			   "(data (flags pkcs1) (hash sha1 %b))",
+-			   challenge_n, challenge);
+   if (! err)
+-    err = gcry_sexp_build (&sexp_signature, NULL, "(sig-val (rsa (s %m)))",
+-			   mpi_signature);
++    err = response_signature (&sexp_signature, algo,
++                              response, response_n);
+ 
+-  /* Verify.  */
+   if (! err)
+     err = gcry_pk_verify (sexp_signature, sexp_data, sexp_key);
+ 
+@@ -113,8 +104,6 @@ challenge_verify_sexp (gcry_sexp_t sexp_key,
+     gcry_sexp_release (sexp_data);
+   if (sexp_signature)
+     gcry_sexp_release (sexp_signature);
+-  if (mpi_signature)
+-    gcry_mpi_release (mpi_signature);
+ 
+   return err;
+ }
+@@ -387,4 +376,69 @@ my_strlen (const char *s)
+   return ret;
+ }
+ 
++int
++pk_algo (gcry_sexp_t sexp_key)
++{
++  gcry_sexp_t sexp_data;
++  char *algoname;
++  int algo;
++
++  sexp_data = gcry_sexp_find_token (sexp_key, "public-key", 0);
++  if (!sexp_data)
++    return 0;
++
++  gcry_sexp_t sexp_tmp = gcry_sexp_cadr (sexp_data);
++  gcry_sexp_release (sexp_data);
++  sexp_data = sexp_tmp;
++
++  algoname = gcry_sexp_nth_string (sexp_data, 0);
++  gcry_sexp_release (sexp_data);
++  if (!algoname)
++    return 0;
++
++  algo = gcry_pk_map_name (algoname);
++  xfree(algoname);
++  return algo;
++}
++
++gpg_error_t
++challenge_data (gcry_sexp_t *data, int algo,
++                unsigned char *challenge, size_t challenge_n)
++{
++  if (algo == GCRY_PK_ECC)
++    {
++      return gcry_sexp_build (data, NULL,
++                              "(data (flags eddsa) (hash-algo sha512) (value %b))",
++                              challenge_n, challenge);
++    }
++
++  return gcry_sexp_build (data, NULL,
++                          "(data (flags pkcs1) (hash sha1 %b))",
++                          challenge_n, challenge);
++}
++
++gpg_error_t
++response_signature (gcry_sexp_t *sig, int algo,
++                    unsigned char *response, size_t response_n)
++{
++  switch (algo)
++    {
++    case GCRY_PK_RSA:
++      return gcry_sexp_build (sig, NULL,
++                              "(sig-val (rsa (s %b)))",
++                              response_n, response);
++    case GCRY_PK_DSA:
++      return gcry_sexp_build (sig, NULL,
++                              "(sig-val (dsa (r %b) (s %b)))",
++                              response_n / 2, response,
++                              response_n / 2, response + response_n / 2);
++    case GCRY_PK_ECC:
++      return gcry_sexp_build (sig, NULL,
++                              "(sig-val (eddsa (r %b) (s %b)))",
++                              response_n / 2, response,
++                              response_n / 2, response + response_n / 2);
++    default:
++      return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
++    }
++}
+ /* END */
+diff --git a/src/util/support.h b/src/util/support.h
+index e25cf01..740ffa0 100644
+--- a/src/util/support.h
++++ b/src/util/support.h
+@@ -71,6 +71,13 @@ void char_vector_free (char **a);
+ 
+ int my_strlen (const char *s);
+ 
++int pk_algo (gcry_sexp_t sexp_key);
++
++gpg_error_t challenge_data (gcry_sexp_t *data, int algo,
++                            unsigned char *challenge, size_t challenge_n);
++
++gpg_error_t response_signature (gcry_sexp_t *sig, int algo,
++                                unsigned char *response, size_t response_n);
+ #endif
+ 
+ /* END */
+-- 
+2.20.1
+
diff --git a/PKGBUILD b/PKGBUILD
new file mode 100644
index 000000000000..305c139b2374
--- /dev/null
+++ b/PKGBUILD
@@ -0,0 +1,78 @@
+# Based on poldi-git maintained by: Olivier Mehani <shtrom-arch@ssji.net>
+# Patch that adds ECC and DSA comes from https://dev.gnupg.org/T4009
+# Maintainer: Adrien Oliva <olivaa@yapbreak.fr>
+
+_gitname=poldi
+pkgname=${_gitname}-ecc-dsa-git
+pkgver=r142.d9a9ff9
+pkgrel=1
+pkgdesc="PAM module for authentication using a smartcard"
+arch=('i686' 'x86_64')
+url="http://git.gnupg.org/cgi-bin/gitweb.cgi?p=poldi.git"
+license=("GPL")
+depends=('libgcrypt' 'libgpg-error' 'libksba' 'pam')
+makedepends=('git' 'autoconf' 'automake')
+optdepends=('logrotate: To avoid giant logfiles')
+options=()
+backup=("etc/poldi/poldi.conf" "etc/pam.d/system-auth-poldi")
+install=poldi.install
+conflicts=("poldi" "poldi-git")
+source=("${_gitname}::git://git.gnupg.org/${_gitname}/"
+	# "poldi-arch.patch"
+	"0001-Update-path-to-scdaemon.patch"
+	"0002-Support-ECC-and-DSA-pub-keys.patch"
+	"poldi.logrotate")
+
+pkgver() {
+	cd "${srcdir}/${_gitname}"
+	printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+}
+
+prepare() {
+  cd "$srcdir/${_gitname}"
+  # sed -i \
+  # 	-e 's!\(#define GNUPG_DEFAULT_SCD\).*!\1 "/usr/lib/gnupg/scdaemon"!' \
+  # 	$srcdir/${_gitname}/config.h.in
+  # Note sure how this file should be generated...
+  sed -i /version.texi/d doc/poldi.texi
+  # patch -p1 < ../poldi-arch.patch
+  patch -p1 < ../0001-Update-path-to-scdaemon.patch
+  patch -p1 < ../0002-Support-ECC-and-DSA-pub-keys.patch
+  ./autogen.sh
+}
+
+build() {
+  cd "$srcdir/${_gitname}"
+
+  ./configure --prefix=/usr --with-pam-module-directory=/usr/lib/security --sysconfdir=/etc
+  make CFLAGS+=-lgpg-error
+}
+
+package() {
+  cd "$srcdir/${_gitname}"
+
+  make DESTDIR="$pkgdir" install
+  make DESTDIR="$pkgdir" install-conf-skeleton
+
+  install -d -m 755 "$pkgdir/usr/share"
+  mv "$pkgdir/etc/poldi" "$pkgdir/usr/share/poldi"
+  rmdir $pkgdir/etc
+  install -D -m 644 "$pkgdir/usr/share/poldi/poldi.conf"  "$pkgdir/etc/poldi/poldi.conf"
+
+  install -d -m 755 "$pkgdir/usr/lib/security"
+  cp src/pam/pam_poldi.so "$pkgdir/usr/lib/security/"
+  install -d -m 755 "$pkgdir/usr/bin"
+  cp tests/pam-test "$pkgdir/usr/bin/pam-test-poldi"
+
+  install -d -m 755 "$pkgdir/etc/pam.d"
+  echo -e "auth\tsufficient\tpam_poldi.so" > $pkgdir/etc/pam.d/system-auth-poldi
+
+  install -d -m 755 "$pkgdir/etc/logrotate.d"
+  install -m 755 ${srcdir}/poldi.logrotate $pkgdir/etc/logrotate.d/poldi
+
+  rm "$pkgdir/usr/share/info/dir"
+}
+md5sums=('SKIP'
+         '6ccfe3af0362bca96d1d85aa097b5f1d'
+         'a91b462fc86511fe7e16bb0168fae48e'
+         '57009cc5211088396d2521fc1997792b')
diff --git a/poldi-arch.patch b/poldi-arch.patch
new file mode 100644
index 000000000000..149401f47936
--- /dev/null
+++ b/poldi-arch.patch
@@ -0,0 +1,26 @@
+diff -ur poldi-0.4-orig/src/util/support.c poldi-0.4/src/util/support.c
+--- poldi-0.4-orig/src/util/support.c	2008-11-10 11:10:19.000000000 +0000
++++ poldi-0.4/src/util/support.c	2008-11-10 11:10:38.000000000 +0000
+@@ -20,6 +20,7 @@
+ 
+ #include "util-local.h"
+ 
++#include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <assert.h>
+--- poldi-0.4.1-orig/conf/poldi.conf.skel	2013-11-21 12:06:29.740052210 +1100
++++ poldi-0.4.1/conf/poldi.conf.skel		2013-11-21 12:05:35.573383899 +1100
+@@ -5,10 +5,10 @@
+ auth-method localdb
+ 
+ # Specify the log file:
+-log-file /home/moritz/logs/poldi.txt
++log-file /var/log/poldi.log
+ 
+ # Enable debugging messages
+ debug
+ 
+ # Specify SCDaemon executable
+-scdaemon-program /usr/bin/scdaemon
++scdaemon-program /usr/lib/gnupg/scdaemon
diff --git a/poldi.install b/poldi.install
new file mode 100644
index 000000000000..27a60c0e469b
--- /dev/null
+++ b/poldi.install
@@ -0,0 +1,54 @@
+## arg 1:  the new package version
+pre_install() {
+  # do nothing here
+  /bin/true
+}
+
+infodir=/usr/share/info
+
+
+## arg 1:  the new package version
+post_install() {
+  for file in ${filelist[@]}; do
+    install-info $infodir/$file $infodir/dir 2> /dev/null
+  done
+
+  echo
+  echo "*** Poldi is now installed."
+  echo
+  echo "A PAM configuration file has been installed as '/etc/pam.d/system-auth-poldi'."
+  echo -e "To enable its use, you need to put 'auth include system-auth-poldi'\nin the relevant files (/etc/pam.d/system-auth is a good starting point)."
+  echo
+  echo "You can test the installation with 'pam-test-poldi SERVICE'."
+  echo
+}
+
+## arg 1:  the new package version
+## arg 2:  the old package version
+pre_upgrade() {
+  # do nothing here
+  /bin/true
+}
+
+## arg 1:  the new package version
+## arg 2:  the old package version
+post_upgrade() {
+  for file in ${filelist[@]}; do
+    install-info $infodir/$file $infodir/dir 2> /dev/null
+  done
+}
+
+## arg 1:  the old package version
+pre_remove() {
+  for file in ${filelist[@]}; do
+    install-info --delete $infodir/$file $infodir/dir 2> /dev/null
+  done
+}
+
+## arg 1:  the old package version
+post_remove() {
+  # do nothing here
+  /bin/true
+}
+
+# vim:set ts=2 sw=2 et:
diff --git a/poldi.logrotate b/poldi.logrotate
new file mode 100644
index 000000000000..9240a79a20c5
--- /dev/null
+++ b/poldi.logrotate
@@ -0,0 +1,9 @@
+/var/log/poldi.log {
+	weekly
+	rotate 4
+	missingok
+	notifempty
+	compress
+	copytruncate
+}
+