Packaging for Fedora/CentOS/RHEL

[carlos-sarmiento]

Is there an option to package/install this on Fedora and other RHEL based distros?

The old pam_ssh_agent_auth is getting deprecated in Fedora 42 and is already gone from CentOS 10 and RHEL 10.

[nresare]

I would not be opposed to accepting an rpm packaging contribution, if anyone is willing. However, since I don't personally run any rpm-based distributions, I is pretty far down on my list of priorities to set up a test environment and figure out how to properly do rpm packaging these days

[pbiering]

I would be also strongly interested in, but unfortunatly, this was written in "Rust", and there is a statement: Fedora's packaging guidelines require it to be unbundled to package. Not 100% sure what this means, see also:

• https://discussion.fedoraproject.org/t/f42-change-proposal-deprecate-pam-ssh-agent-component-self-contained/138977
• https://bugzilla.redhat.com/show_bug.cgi?id=2362165

[beldmit]

I think it means that you have to package each missing crate as a separate package. Don't know how many of them, BTW

[neverpanic]

I would be also strongly interested in, but unfortunatly, this was written in "Rust", and there is a statement: Fedora's packaging guidelines require it to be unbundled to package. Not 100% sure what this means

It means that you will also have to package the dependencies (https://github.com/nresare/pam-ssh-agent/blob/main/Cargo.toml#L16-L24) before you can package this software, if they aren't packaged in Fedora yet.

Note that the posts you link to were written about https://github.com/z4yx/pam_rssh. It seems to be different implementation of the same idea, both written in Rust.

[nresare]

Ok. I had a brief look at the packaging requirements, and it seems to me like most deps are already packaged (significantly rust-ssh-key), so this should be a pretty straight forward task. The one potential issue I sense from here is that there might be some work that needs to be done to either support old versions of dependencies or update those dependencies in Fedora

[pbiering]

For offline mode on F42 (and rawhide) following rust packages are missing

• rust-pam-bindings+default-devel
• rus-ssh-agent-client-rs+default-devel

I have now an initial spec file created which in online mode build successfully locally (should also work on COPR with Internet access enabled) - functionalwise to be tested still:

rpm -qlp pam_ssh_agent-0.5.1-1.fc42.x86_64.rpm
/usr/lib/.build-id
/usr/lib/.build-id/3b
/usr/lib/.build-id/3b/9cb870708f6af54576026645a2fc82e6a3290c
/usr/lib64/security/libpam_ssh_agent.so
/usr/share/doc/pam_ssh_agent
/usr/share/doc/pam_ssh_agent/README.md

Potentially missing rust dependencies need to be bundled in the source RPM until appearing in distro, are there already any hints around in other spec files?

[AdmiralNemo]

Potentially missing rust dependencies need to be bundled in the source RPM until appearing in distro, are there already any hints around in other spec files?

Are you using rust2rpm? There's a section in a documentation that discusses how to "vendor" the dependencies in the RPM.

https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/#_vendored_dependencies

[nresare]

Nice that you are making progress. ssh-agent-client-rs is my code, has a small set of dependencies, so it should be straightforward to package.

Please let me know if there are any changes that would be helpful to simplify packaging

[pbiering]

spec file for F42 is working, EL10 started, but got temporary stucked because of missing ssh-encoding, sure I found a solution next here...

https://github.com/pbiering/pam-ssh-agent/blob/rpm-specfile/contrib/pam_ssh_agent.spec

[pbiering]

Coming from Perl's CPAN "heaven", sucessfully sailed through Python's PyPI "purgatory", now entered the Rust's Crates "hell" :-(

Spec file enhanced, now able to build for F42, F43 and EL10 (ugly workarounds...but no other way to circumvent missing Rust dependencies)

https://github.com/pbiering/pam-ssh-agent/blob/rpm-specfile/contrib/pam_ssh_agent.spec

koji scratch builds for x86_64 are here until regular cleanup run:

• F42: https://koji.fedoraproject.org/koji/taskinfo?taskID=132692855
• F43: https://koji.fedoraproject.org/koji/taskinfo?taskID=132693116
• EL10: https://koji.fedoraproject.org/koji/taskinfo?taskID=132693424

successfully tested adding to /etc/pam.d/su and /etc/pam.d/sudo:
auth sufficient libpam_ssh_agent.so file=/root/.ssh/authorized_keys

A maintainer is required now for Fedora and EPEL incl. a new-package request.

BTW: what should happen with https://github.com/z4yx/pam_rssh - has one compared the implementation?

[pbiering]

Intermediate RPMs now are available for EL10/F42/F43 in my personal Fedora copr repository, currently based on my fork until this PR is merged.

https://copr.fedorainfracloud.org/coprs/pbiering/InternetServerExtensions/build/9046782/

See also
https://copr.fedorainfracloud.org/coprs/pbiering/InternetServerExtensions/

[nresare]

Thank you for the contributions! Just a small set of comments on the PR.

When it comes to pam_rssh it does indeed seem like we have two independent implementations of pretty much the same functionality. I am obviously partial in favour of my variation, here are some differences:

• pam_rssh leans on openssl and rust to c bindings whereas pam-ssh-agent leans on the ssh-key crate with rust native crypto
• There is quite a bit of code that interacts with openssl in sign_verify.rs that doesn't seem to be covered by unit tests in pam_rssh, by contrast pam-ssh-agent is leaning on ssh-key for those interactions, a crate with comprehensive testing and a larger user base
• Each of the variants lean on a custom implementation of the ssh-agent binary protocol. ssh-agent-client-rs that pam-ssh-agent uses has API documentation, pretty extensive unit testing and example binaries using the API whereas ssh-agent.rs that pam_rssh uses lacks documentation and examples and has a significantly lower unit test coverage
• pam_rssh has some variable extrapolation support in the pam config parametrs that pam-ssh does not yet have. With this push however, I feel keen to finish my half baked implementation that I started a while ago

[nresare]

Since I went through the exercise of comparing pam-ssh-agent to pam_rssh I felt like it would be good to plug the "feature gap" by implementing the little pieces still missing.

If someone following this issue uses variable extrapolation and could review/test my changes that would be most welcome, the PR is #26