FIDO support for openssh

[tavrez]

if you are on Windows 10 version 1903 or higher you need to run git-bash as administrator

[dscho]

This is an incredible achievement, in such a short amount of time.

It inspired me to try to assist more thoroughly than I normally would, e.g. by figuring out why the Release mode would not build, or why C99 was a problem.

I pointed out the fixes I made locally, and suggested a couple more changes.

Additionally, I would think that this commit would like to be split into three steps: adding libcbor and libfido2 separately, then using the latter in OpenSSH.

@tavrez could you fetch the openssh-with-security-tokens branch from https://github.com/dscho/MSYS2-packages and use git log and git diff to compare my suggested edits with your patch, and if you like all of that, force-push and we're good to merge?

[dscho]

To anyone unfamiliar with FIDO or U2F, this description leaves things a bit unclear. I know it was lifted from the README of https://github.com/Yubico/libfido2, and they're probably too deep down in the rabbit hole to come up with a better description.

I think something like this might be better:

A library to support easy, strong authentication (e.g. via USB security tokens or smartcards)

Or something like that.

[rimrul]

openssh/PKGBUILD probably also needs it's pkgrel incremented.

[cw789]

Wow! Thanks a lot Reza.

[dscho]

openssh/PKGBUILD probably also needs it's pkgrel incremented.

@rimrul that is done automatically in the release management: https://github.com/git-for-windows/build-extra/blob/48bcaa455490c664fd9e8c003fdd02134a430869/please.sh#L2749-L2755

I think I forgot to update the checksums, though... My bad.

[dscho]

I think I forgot to update the checksums, though... My bad.

Yep. Fixed. (Force-pushed openssh-with-security-tokens to https://github.com/dscho/MSYS2-packages.)

[rimrul]

that is done automatically in the release management

Right. I tend to forgett about that part of please.sh

[dscho]

Oh, that part is new... I worked pretty hard on parallelizing the Azure Pipeline I use to build and publish Pacman packages. I also moved it from a private org with a private agent pool to the public org over at https://dev.azure.com/git-for-windows/git/_build

In the process, I had to reimplement small parts of the upgrade subcommand in please.sh, to allow for finer-grained steps in the Pipeline. I then introduced the --no-build (or was it --skip-build?) option to that subcommand so that I could run it in the first job (whose only purpose is now to figure out whether a new source version is available for the given component, and create the necessary change for the corresponding PKGBUILD as well as for the ReleaseNotes.md).

So yeah, lots has changed, lots of code should probably be removed, too.

[tavrez]

Sorry I'm little busy these days and can only work at nights. I liked your suggestions and will add some question and notes to them right now.

[dscho]

For lurkers who wonder why this is not deployed to Git for Windows' Pacman repositories yet: I have a reliable hang in the CMake process in 32-bit, just after detecting the C++ compiler: https://dev.azure.com/git-for-windows/git/_build/results?buildId=51479&view=logs&j=cfa20e98-6997-523c-4233-f0a7302c929f&t=4fefe862-c3fb-598f-9db1-d9857aa98bc4&l=377

[dscho]

Okay, I finally got it all built: https://dev.azure.com/git-for-windows/git/_build/results?buildId=51609&view=logs&j=0b109914-fd3b-548c-e58c-f9d47cb04f5f&t=0b109914-fd3b-548c-e58c-f9d47cb04f5f.

[tavrez]

Thanks for all the efforts, I've tracked everything you did through pipelines and pushes on git repo, I had a mistake on not adding libcbor-devel as dependency package on OpenSSH, hope I do things better in my next contributions :)

[dscho]

@tavrez oh, don't worry. The biggest issue here was not caused by you, it was caused by me not realizing that librhash insists on having OpenSSL v1.0.x as a runtime dependency, and not releasing it properly. Git for Windows moved on to OpenSSL v1.1.x and I only kept the earlier DLLs around for the transition period, failing to notice that librhash does not really need it (and in fact, the 32-bit version hangs nowadays if you provide it with the OpenSSL v1.0.x library). It took me long enough to diagnose that.

Your contribution has been my highlight of the past few weeks. So please do not be sorry at all.