We decided to remove the authd package in noble for the time being.
The current implementation (in particular the one in the PAM module) is
not up to our standard in terms of quality and what we are confortable
to support in the long term. Rather than releasing as is and having
risky SRUs in the future changing a large part of the implementation, we
decided against this and rather polishing the code, securing it, adding
even more tests and releasing all that as a new package SRUed to the
24.04 LTS in the coming months.
That way, we won’t risk to regress any potential users and we will use an
architecture we are more confortable supporting for the next 5/10 years of the
LTS release.
It means that when we reintroduce it, we will rerequest a new MIR too as the
PAM module will largely change and we want to ensure we follow the process and
quality standard we expect for the Ubuntu distribution.
** Changed in: authd (Ubuntu)
Status: In Progress => Won't Fix
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to authd in Ubuntu.
https://bugs.launchpad.net/bugs/2048781
Title:
[MIR] authd
Status in authd package in Ubuntu:
Won't Fix
Bug description:
[Availability]
- The package authd is already in Ubuntu universe.
- The package authd build for the architectures it is designed to work on.
- It currently builds and works for architectures: amd64, arm64, armhf,
ppc64el, riscv64, s390x
- Link to package https://launchpad.net/ubuntu/+source/authd
[Rationale]
- Authd is the foundation for cloud-based authentication and MFA support on
Ubuntu and identity providers such as Open ID connect or Microsoft Azure /
Entra ID. This package also enables partners to create their own authentication
brokers.
- The package authd is required to be in main for enabling cloud
authentication at provisioning time.
- The package authd will generally be useful for corporate users.
- No package in main or universe currently offers cloud authentication
capabilities.
- The target release is the next LTS 24.04 LTS.
[Security]
- This is a new software developed and maintained by Canonical. It has no
security history.
- No CVEs/security issues in this software in the past (There are false
positives. authd is an authentication daemon for Junos and VMWare):
- (0) https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=authd
- (0) https://ubuntu.com/security/cves?q=&package=authd
- (0) https://security-tracker.debian.org/tracker/source-package/authd
- no `suid` or `sgid` binaries
- Package does install a dpkg trigger on /usr/lib/linux/efi
- Packages does not open privileged ports (ports < 1024)
- Packages does not contain extensions to security-sensitive software
- It installs a service in /usr/sbin/authd, running as root. The service has
some systemd confinement.
- It installs a PAM module
- It installs an NSS module.
- Communication between authd and its brokers is done over DBus
- Communication between the pam/nss module and authd are done over a local
DBus socket (socket activated service), using grpc.
- Security has been kept in mind and common isolation/risk-mitigation
patterns are in place utilizing systemd isolation features, cache
directory permissions are 0700, cache file permissions are 0600.
- /!\ This requires a security review.
[Quality assurance - function/usage]
- The package needs post install configuration and reading of documentation.
- There isn't a safe default because the administrator must configure the
selected authentication broker corresponding to their identity providers.
- Once installed without additional configuration, PAM requests are ignored
by authd.
[Quality assurance - maintenance]
- The Ubuntu Desktop team (~desktop-packages) maintains this package. It
doesn’t have any long-term and critical, open bugs:
- https://github.com/ubuntu/authd/issues
- https://bugs.launchpad.net/ubuntu/+source/authd
[Quality assurance - testing]
- There is a comprehensive, non-trivial, testsuite. The testsuite includes
integration and functional tests.
- The testsuite runs at build time. The branch coverage is 89%:
-
https://github.com/ubuntu/authd/actions/workflows/qa.yaml?query=branch%3Amain
- https://app.codecov.io/gh/ubuntu/authd
- The same test suite runs as autopkgtest. It is passing on all supported
architectures. Links to test logs:
-
https://launchpadlibrarian.net/701470374/buildlog_ubuntu-noble-amd64.authd_0.1_BUILDING.txt.gz
- arm64 tests are flaky due to a Rust regression that makes the build very
slow and timing out.
- Currently, autopkgtests and package build are skipping integration tests
(because it needs a VHS binary). We are working on bringing it before the 24.04
release with a mock ttyd so that we can run them there too.
- Upstream CI also includes code sanity checks (golangci-lint, including
gosec) and vulnerability scanning (govulneck).
[Quality assurance - packaging]
- There is no debian/watch because authd is a native package.
debian/control defines a correct Maintainer field:
Maintainer: Ubuntu Developers <[email protected]>
- This package does not yield massive lintian Warnings, Errors
```
$ lintian --pedantic --tag-display-limit 0
W: authd-dbgsym: debug-file-with-no-debug-symbols
[usr/lib/debug/.build-id/c8/a7886227cc6b0b1004271bd8a3f7eb0bf6a6b3.debug]
W: authd: no-manual-page [usr/sbin/authd]
P: authd: spelling-error-in-copyright Unknwon Unknown
```
- spelling-error-in-copyright is a false positive. Unknwon is the actual name
of the author.
- Lintian overrides package-does-not-install-examples in vendored Rust
modules.
- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies
- The package will not be installed by default. The package is
installed during provisioning if the user explicitly selects it. In
this case, they’ll have to also select an identity provider and
questions will be asked.
- Packaging and build is easy:
- https://github.com/ubuntu/authd/blob/main/debian/rules
[UI standards]
- Application is not end-user facing, one string is translatable, via
standard intltool/gettext or similar build and runtime internationalization
system:
pam/userselection.go: u.Prompt = "Username: " // TODO: i18n
- Most of the translated strings will come from the different brokers
(separate projects)
- The system for internationalization is in place of the project and
the mo and po files are generated. It’s a question of taking the time
to mark the appropriate strings for translations.
[Dependencies]
- No further depends or recommends dependencies that are not yet in main.
[Standards compliance]
- This package correctly follows FHS
- This package violates Debian Policy. It vendorizes various Go (in vendor/)
and Rust libraries (in vendor_rust/). We are maintaining them up to date with
dependabot in our upstream CI. The Go part is covered by the govulncheck
security scanning on the Go version we are depending on and its vendored
dependency.
[Maintenance/Owner]
- The owning team will be desktop-packages and I have their acknowledgement
for that commitment
- The team desktop-packages is subscribed.
- The team desktop-packages is aware of the implications by a static build
and commits to test no-change-rebuilds and to fix any issues found for the
lifetime of the release (including ESM).
- The team desktop-packages is aware of the implications of vendored code and
(as alerted by the security team) commits to provide updates to the security
team for any affected vendored code for the lifetime of the release (including
ESM).
- This package (NSS module) is Rust based and vendors all non
language-runtime dependencies.
[Background information]
- The Package description explains the package well.
- Upstream Name is authd.
- Link to upstream project https://github.com/ubuntu/authd
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/authd/+bug/2048781/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
