From c397aaceef4ab72a9437eeb6fb97d534dce1b663 Mon Sep 17 00:00:00 2001 From: Vincent Ambo Date: Sun, 4 Feb 2024 20:32:19 +0300 Subject: [PATCH] fix(3p/overlays): pin specific version of tpm2-pkcs11 Newer versions broke compatibility with who knows whatever part of the stack is required for correct TVM + OpenVPN interaction, but I need this to work. This was previously picked from stable, but we've bumped stable and it has advanced to a version where this is also broken. I believe this is a known issue, but right now I don't have the time to look into it. Change-Id: I1060f3ecfd7b43ebe5e1860f59f7574ca094570a Reviewed-on: https://cl.tvl.fyi/c/depot/+/10743 Reviewed-by: tazjin Autosubmit: tazjin Tested-by: BuildkiteCI --- third_party/nixpkgs/default.nix | 3 - third_party/overlays/patches/.skip-tree | 1 + .../patches/0001-configure-ac-version.patch | 13 +++ third_party/overlays/patches/tpm2-pkcs11.nix | 105 ++++++++++++++++++ third_party/overlays/tvl.nix | 5 + 5 files changed, 124 insertions(+), 3 deletions(-) create mode 100644 third_party/overlays/patches/.skip-tree create mode 100644 third_party/overlays/patches/0001-configure-ac-version.patch create mode 100644 third_party/overlays/patches/tpm2-pkcs11.nix diff --git a/third_party/nixpkgs/default.nix b/third_party/nixpkgs/default.nix index 08ec6f852..747cf5a11 100644 --- a/third_party/nixpkgs/default.nix +++ b/third_party/nixpkgs/default.nix @@ -52,9 +52,6 @@ let stableOverlay = _unstableSelf: unstableSuper: { # weird memory access issues in SBCL on AMD; 2024-02-01 sbcl = stableNixpkgs.sbcl; - - # TPM authentication seems broken on unstable; 2023-11-29 - tpm2-pkcs11 = stableNixpkgs.tpm2-pkcs11; }; # Overlay to expose the nixpkgs commits we are using to other Nix code. diff --git a/third_party/overlays/patches/.skip-tree b/third_party/overlays/patches/.skip-tree new file mode 100644 index 000000000..86eae51a6 --- /dev/null +++ b/third_party/overlays/patches/.skip-tree @@ -0,0 +1 @@ +No readTree-compatible files. diff --git a/third_party/overlays/patches/0001-configure-ac-version.patch b/third_party/overlays/patches/0001-configure-ac-version.patch new file mode 100644 index 000000000..fa2575cb9 --- /dev/null +++ b/third_party/overlays/patches/0001-configure-ac-version.patch @@ -0,0 +1,13 @@ +diff --git a/configure.ac b/configure.ac +index e861e42..018c19c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -26,7 +26,7 @@ + #;**********************************************************************; + + AC_INIT([tpm2-pkcs11], +- [m4_esyscmd_s([git describe --tags --always --dirty])], ++ [git-@VERSION@], + [https://github.com/tpm2-software/tpm2-pkcs11/issues], + [], + [https://github.com/tpm2-software/tpm2-pkcs11]) diff --git a/third_party/overlays/patches/tpm2-pkcs11.nix b/third_party/overlays/patches/tpm2-pkcs11.nix new file mode 100644 index 000000000..2e7db7aca --- /dev/null +++ b/third_party/overlays/patches/tpm2-pkcs11.nix @@ -0,0 +1,105 @@ +{ stdenv +, lib +, fetchFromGitHub +, substituteAll +, pkg-config +, autoreconfHook +, autoconf-archive +, makeWrapper +, patchelf +, tpm2-tss +, tpm2-tools +, opensc +, openssl +, sqlite +, python3 +, glibc +, libyaml +, abrmdSupport ? true +, tpm2-abrmd ? null +}: + +stdenv.mkDerivation rec { + pname = "tpm2-pkcs11"; + version = "1.8.0"; + + src = fetchFromGitHub { + owner = "tpm2-software"; + repo = pname; + rev = version; + sha256 = "sha256-f5wi0nIM071yaQCwPkY1agKc7OEQa/IxHJc4V2i0Q9I="; + }; + + patches = lib.singleton ( + substituteAll { + src = ./0001-configure-ac-version.patch; + VERSION = version; + }); + + # The preConfigure phase doesn't seem to be working here + # ./bootstrap MUST be executed as the first step, before all + # of the autoreconfHook stuff + postPatch = '' + ./bootstrap + ''; + + nativeBuildInputs = [ + pkg-config + autoreconfHook + autoconf-archive + makeWrapper + patchelf + ]; + buildInputs = [ + tpm2-tss + tpm2-tools + opensc + openssl + sqlite + libyaml + (python3.withPackages (ps: with ps; [ packaging pyyaml cryptography pyasn1-modules tpm2-pytss ])) + ]; + + outputs = [ "out" "bin" "dev" ]; + + dontStrip = true; + dontPatchELF = true; + + # To be able to use the userspace resource manager, the RUNPATH must + # explicitly include the tpm2-abrmd shared libraries. + preFixup = + let + rpath = lib.makeLibraryPath ( + (lib.optional abrmdSupport tpm2-abrmd) + ++ [ + tpm2-tss + sqlite + openssl + glibc + libyaml + ] + ); + in + '' + patchelf \ + --set-rpath ${rpath} \ + ${lib.optionalString abrmdSupport "--add-needed ${lib.makeLibraryPath [tpm2-abrmd]}/libtss2-tcti-tabrmd.so"} \ + --add-needed ${lib.makeLibraryPath [tpm2-tss]}/libtss2-tcti-device.so \ + $out/lib/libtpm2_pkcs11.so.0.0.0 + ''; + + postInstall = '' + mkdir -p $bin/bin/ $bin/share/tpm2_pkcs11/ + mv ./tools/* $bin/share/tpm2_pkcs11/ + makeWrapper $bin/share/tpm2_pkcs11/tpm2_ptool.py $bin/bin/tpm2_ptool \ + --prefix PATH : ${lib.makeBinPath [ tpm2-tools ]} + ''; + + meta = with lib; { + description = "A PKCS#11 interface for TPM2 hardware"; + homepage = "https://github.com/tpm2-software/tpm2-pkcs11"; + license = licenses.bsd2; + platforms = platforms.linux; + maintainers = with maintainers; [ matthiasbeyer ]; + }; +} diff --git a/third_party/overlays/tvl.nix b/third_party/overlays/tvl.nix index a070320c7..661470914 100644 --- a/third_party/overlays/tvl.nix +++ b/third_party/overlays/tvl.nix @@ -132,4 +132,9 @@ depot.nix.readTree.drvTargets { license = licenses.asl20; }; }; + + # OpenVPN + TPM2 is broken on versions of this package somewhere + # after 1.8.0, but it is a critical dependency for tazjin. For this + # reason it is vendored from a specific nixpkgs commit. + tpm2-pkcs11 = self.callPackage ./patches/tpm2-pkcs11.nix { }; }