fix test

Cargo.toml

@@ -48,7 +48,6 @@ extended-description = "Decrypt your LUKS partition using a FIDO2 compatible aut
 assets = [
     ["target/release/fido2luks", "usr/bin/", "755"],
     ["fido2luks.bash", "usr/share/bash-completion/completions/fido2luks", "644"],
-    ["pam_mount/fido2luksmounthelper.sh", "usr/bin/", "755"],
     ["initramfs-tools/keyscript.sh", "/lib/cryptsetup/scripts/fido2luks", "755" ],
     ["initramfs-tools/hook/fido2luks.sh", "etc/initramfs-tools/hooks/", "755" ],
     ["initramfs-tools/fido2luks.conf", "etc/", "644"],

PKGBUILD

@@ -17,13 +17,9 @@ pkgver() {
 
 build() {
     cargo build --release --locked --all-features --target-dir=target
-    target/release/${pkgname} completions target
 }
 
 package() {
     install -Dm 755 target/release/${pkgname} -t "${pkgdir}/usr/bin"
-    install -Dm 755 ../pam_mount/fido2luksmounthelper.sh -t "${pkgdir}/usr/bin"
-    install -Dm 644 target/fido2luks.bash "${pkgdir}/usr/share/bash-completion/completions/fido2luks"
-    install -Dm 755 ../initcpio/hook.sh "${pkgdir}/usr/lib/initcpio/install/fido2luks"
-    install -Dm 755 ../initcpio/hook.sh "${pkgdir}/usr/lib/initcpio/hooks/fido2luks"
+    install -Dm 644 ../fido2luks.bash "${pkgdir}/usr/share/bash-completion/completions/fido2luks"
 }

README.md

@@ -2,7 +2,7 @@
 
 This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.
 
-Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T, YubiKey(fw >= [5.2.3](https://support.yubico.com/hc/en-us/articles/360016649319-YubiKey-5-2-3-Enhancements-to-FIDO-2-Support))
+Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T
 
 ## Setup
 

initcpio/hook.sh

@@ -1,74 +0,0 @@
-#!/bin/bash
-
-set -ax
-
-exit_with() {
-    echo "$1" >&2
-    exit 1
-}
-
-validate() {
-    [ ! -e /etc/fido2luks.conf ] && exit_with "/etc/fido2luks.conf does not exist! Please configure first"
-    . /etc/fido2luks.conf
-    [ ! -e "$FIDO2LUKS_DEVICE" ] && exit_with "FIDO2LUKS_DEVICE='$FIDO2LUKS_DEVICE' does not exist!"
-    [ -z "$FIDO2LUKS_CREDENTIAL_ID" ] && exit_with "FIDO2LUKS_CREDENTIAL_ID must be set!"
-    [ -z "$FIDO2LUKS_MAPPER_NAME" ] && exit_with "FIDO2LUKS_MAPPER_NAME must be set!"
-}
-
-build() {
-    local mod
-    add_binary "cryptsetup"
-    add_module "dm-crypt"
-    add_module "dm-integrity"
-    if [[ $CRYPTO_MODULES ]]; then
-        for mod in $CRYPTO_MODULES; do
-            add_module "$mod"
-        done
-    else
-        add_all_modules "/crypto/"
-    fi
-
-    add_binary "dmsetup"
-    add_file "/usr/lib/udev/rules.d/10-dm.rules"
-    add_file "/usr/lib/udev/rules.d/13-dm-disk.rules"
-    add_file "/usr/lib/udev/rules.d/95-dm-notify.rules"
-    add_file "/usr/lib/initcpio/udev/11-dm-initramfs.rules" "/usr/lib/udev/rules.d/11-dm-initramfs.rules"
-
-    add_systemd_unit "systemd-ask-password-console.path"
-    add_systemd_unit "systemd-ask-password-console.service"
-
-    # cryptsetup calls pthread_create(), which dlopen()s libgcc_s.so.1
-    add_binary "/usr/lib/libgcc_s.so.1"
-
-    # add mkswap for creating swap space on the fly (see 'swap' in crypttab(5))
-    add_binary "mkswap"
-
-    [[ -f /etc/crypttab.initramfs ]] && add_file "/etc/crypttab.initramfs" "/etc/crypttab"
-
-    validate 
-    add_file "/etc/fido2luks.conf" "/etc/fido2luks.conf"
-    add_binary "fido2luks" 
-    add_runscipt
-}
-
-run_hook() {
-    modprobe -a -q dm-crypt
-    . /etc/fido2luks.conf
-    if [ -z "$FIDO2LUKS_PASSWORD_HELPER" ]; then 
-        export FIDO2LUKS_PASSWORD_HELPER="systemd-ask-password 'FIDO2 password salt for $FIDO2LUKS_DEVICE'"
-    fi
-    fido2luks open
-}
-
-help() {
-    cat <<HELPEOF
-This hook allows for an encrypted root device with systemd initramfs.
-
-See the manpage of systemd-cryptsetup-generator(8) for available kernel
-command line options. Alternatively, if the file /etc/crypttab.initramfs
-exists, it will be added to the initramfs as /etc/crypttab. See the
-crypttab(5) manpage for more information on crypttab syntax.
-HELPEOF
-}
-
-# vim: set ft=sh ts=4 sw=4 et:

initcpio/keyscript.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-set -a
-. /etc/fido2luks.conf
-
-if [ -z "$FIDO2LUKS_PASSWORD_HELPER" ]; then
-	MSG="FIDO2 password salt for $CRYPTTAB_NAME"
-	export FIDO2LUKS_PASSWORD_HELPER="systemd-ask-password '$MSG'"
-fi
-
-if [ "$FIDO2LUKS_USE_TOKEN" -eq 1 ]; then
-	export FIDO2LUKS_CREDENTIAL_ID="$FIDO2LUKS_CREDENTIAL_ID,$(fido2luks token list --csv $CRYPTTAB_SOURCE)"
-fi
-
-fido2luks print-secret --bin

pam_mount/fido2luksmounthelper.sh

@@ -1,220 +0,0 @@
-#!/bin/bash
-#
-# This is a rather minimal example Argbash potential
-# Example taken from http://argbash.readthedocs.io/en/stable/example.html
-#
-# ARG_POSITIONAL_SINGLE([operation],[Operation to perform (mount|umount)],[])
-# ARG_OPTIONAL_SINGLE([credentials-type],[c],[Type of the credentials to use (external|embedded)])
-# ARG_OPTIONAL_SINGLE([device],[d],[Name of the device to create])
-# ARG_OPTIONAL_SINGLE([mount-point],[m],[Path of the mount point to use])
-# ARG_OPTIONAL_BOOLEAN([ask-pin],[a],[Ask for a pin],[off])
-# ARG_OPTIONAL_SINGLE([salt],[s],[Salt to use],[""])
-# ARG_HELP([Unlocks/Locks a LUKS volume and mount/unmount it in the given mount point.])
-# ARGBASH_GO()
-# needed because of Argbash --> m4_ignore([
-### START OF CODE GENERATED BY Argbash v2.9.0 one line above ###
-# Argbash is a bash code generator used to get arguments parsing right.
-# Argbash is FREE SOFTWARE, see https://argbash.io for more info
-# Generated online by https://argbash.io/generate
-
-
-die()
-{
-	local _ret="${2:-1}"
-	test "${_PRINT_HELP:-no}" = yes && print_help >&2
-	echo "$1" >&2
-	exit "${_ret}"
-}
-
-
-begins_with_short_option()
-{
-	local first_option all_short_options='cdmash'
-	first_option="${1:0:1}"
-	test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0
-}
-
-# THE DEFAULTS INITIALIZATION - POSITIONALS
-_positionals=()
-# THE DEFAULTS INITIALIZATION - OPTIONALS
-_arg_credentials_type=
-_arg_device=
-_arg_mount_point=
-_arg_ask_pin="off"
-_arg_salt=""
-
-
-print_help()
-{
-	printf '%s\n' "Unlocks/Locks a LUKS volume and mount/unmount it in the given mount point."
-	printf 'Usage: %s [-c|--credentials-type <arg>] [-d|--device <arg>] [-m|--mount-point <arg>] [-a|--(no-)ask-pin] [-s|--salt <arg>] [-h|--help] <operation>\n' "$0"
-	printf '\t%s\n' "<operation>: Operation to perform (mount|umount)"
-	printf '\t%s\n' "-c, --credentials-type: Type of the credentials to use (external|embedded) (no default)"
-	printf '\t%s\n' "-d, --device: Name of the device to create (no default)"
-	printf '\t%s\n' "-m, --mount-point: Path of the mount point to use (no default)"
-	printf '\t%s\n' "-a, --ask-pin, --no-ask-pin: Ask for a pin (off by default)"
-	printf '\t%s\n' "-s, --salt: Salt to use (default: '""')"
-	printf '\t%s\n' "-h, --help: Prints help"
-}
-
-
-parse_commandline()
-{
-	_positionals_count=0
-	while test $# -gt 0
-	do
-		_key="$1"
-		case "$_key" in
-			-c|--credentials-type)
-				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
-				_arg_credentials_type="$2"
-				shift
-				;;
-			--credentials-type=*)
-				_arg_credentials_type="${_key##--credentials-type=}"
-				;;
-			-c*)
-				_arg_credentials_type="${_key##-c}"
-				;;
-			-d|--device)
-				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
-				_arg_device="$2"
-				shift
-				;;
-			--device=*)
-				_arg_device="${_key##--device=}"
-				;;
-			-d*)
-				_arg_device="${_key##-d}"
-				;;
-			-m|--mount-point)
-				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
-				_arg_mount_point="$2"
-				shift
-				;;
-			--mount-point=*)
-				_arg_mount_point="${_key##--mount-point=}"
-				;;
-			-m*)
-				_arg_mount_point="${_key##-m}"
-				;;
-			-a|--no-ask-pin|--ask-pin)
-				_arg_ask_pin="on"
-				test "${1:0:5}" = "--no-" && _arg_ask_pin="off"
-				;;
-			-a*)
-				_arg_ask_pin="on"
-				_next="${_key##-a}"
-				if test -n "$_next" -a "$_next" != "$_key"
-				then
-					{ begins_with_short_option "$_next" && shift && set -- "-a" "-${_next}" "$@"; } || die "The short option '$_key' can't be decomposed to ${_key:0:2} and -${_key:2}, because ${_key:0:2} doesn't accept value and '-${_key:2:1}' doesn't correspond to a short option."
-				fi
-				;;
-			-s|--salt)
-				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
-				_arg_salt="$2"
-				shift
-				;;
-			--salt=*)
-				_arg_salt="${_key##--salt=}"
-				;;
-			-s*)
-				_arg_salt="${_key##-s}"
-				;;
-			-h|--help)
-				print_help
-				exit 0
-				;;
-			-h*)
-				print_help
-				exit 0
-				;;
-			*)
-				_last_positional="$1"
-				_positionals+=("$_last_positional")
-				_positionals_count=$((_positionals_count + 1))
-				;;
-		esac
-		shift
-	done
-}
-
-
-handle_passed_args_count()
-{
-	local _required_args_string="'operation'"
-	test "${_positionals_count}" -ge 1 || _PRINT_HELP=yes die "FATAL ERROR: Not enough positional arguments - we require exactly 1 (namely: $_required_args_string), but got only ${_positionals_count}." 1
-	test "${_positionals_count}" -le 1 || _PRINT_HELP=yes die "FATAL ERROR: There were spurious positional arguments --- we expect exactly 1 (namely: $_required_args_string), but got ${_positionals_count} (the last one was: '${_last_positional}')." 1
-}
-
-
-assign_positional_args()
-{
-	local _positional_name _shift_for=$1
-	_positional_names="_arg_operation "
-
-	shift "$_shift_for"
-	for _positional_name in ${_positional_names}
-	do
-		test $# -gt 0 || break
-		eval "$_positional_name=\${1}" || die "Error during argument parsing, possibly an Argbash bug." 1
-		shift
-	done
-}
-
-parse_commandline "$@"
-handle_passed_args_count
-assign_positional_args 1 "${_positionals[@]}"
-
-# OTHER STUFF GENERATED BY Argbash
-
-### END OF CODE GENERATED BY Argbash (sortof) ### ])
-# [ <-- needed because of Argbash
-
-if [ -z ${_arg_mount_point} ]; then
-  die "Missing '--mount-point' argument"
-fi
-
-if [ -z ${_arg_device} ]; then
-  die "Missing '--device' argument"
-fi
-
-ASK_PIN=${_arg_ask_pin}
-OPERATION=${_arg_operation}
-DEVICE=${_arg_device}
-DEVICE_NAME=$(sed "s|/|_|g" <<< ${DEVICE})
-MOUNT_POINT=${_arg_mount_point}
-CREDENTIALS_TYPE=${_arg_credentials_type}
-SALT=${_arg_salt}
-CONF_FILE_PATH="/etc/fido2luksmounthelper.conf"
-
-if [ "${OPERATION}" == "mount" ]; then
-	if [ "${CREDENTIALS_TYPE}" == "external" ]; then
-    if  [ -f ${CONF_FILE_PATH} ]; then
-			if [ "${ASK_PIN}" == "on" ]; then
-				read PASSWORD
-			fi
-			CREDENTIALS=$(<${CONF_FILE_PATH})
-		else
-			die "The configuration file '${CONF_FILE_PATH}' is missing. Please create it or use embedded credentials."
-		fi
-		printf ${PASSWORD} | fido2luks open --salt string:${SALT} --pin --pin-source /dev/stdin ${DEVICE} ${DEVICE_NAME} ${CREDENTIALS}
-	elif [ "${CREDENTIALS_TYPE}" == "embedded" ]; then
-		if [ "${ASK_PIN}" == "on" ]; then
-			read PASSWORD
-		fi
-		printf ${PASSWORD} | fido2luks open-token --salt string:${SALT} --pin --pin-source /dev/stdin ${DEVICE} ${DEVICE_NAME}
-	else
-		die "Given credential-type '${CREDENTIALS_TYPE}' is invalid. It must be 'external' or 'embedded'"
-	fi 
-	mount /dev/mapper/${DEVICE_NAME} ${MOUNT_POINT}
-elif [ "${OPERATION}" == "umount" ]; then
-  umount ${MOUNT_POINT}
-  cryptsetup luksClose ${DEVICE_NAME}
-else
-  die "Given operation '${OPERATION}' is invalid. It must be 'mount' or 'unmount'"
-fi
-
-exit 0
-
-# ] <-- needed because of Argbash