Version: 250.2-3

systemd (250.2-3) unstable; urgency=medium

  [ Luca Boccassi ]
  * Build with and suggest fido2 and tpm libraries.
    These are used via dlopen only if available by some tools like
    systemd-cryptsetup, systemd-cryptenroll and systemd-repart,
    with graceful fallbacks if they are not found.
    Build-depend on them so that the features get compiled in
    (apart from stage1 builds), and add appropriate Suggests.
    (Closes: #991129, #1003383)
  * Disable libcryptsetup-plugins.
    They are new, and might not even be supported by libcryptsetup yet
  * Build-depend on libssl-dev.
    Required to use libfido2-dev until #1003699 is fixed


Am 15.03.22 um 08:18 schrieb Trent Lloyd:
Package: systemd

I would like to unlock LUKS encrypted disks with the new systemd-cryptsetup
ability to unlock using security keys such as Yubikey, etc. I am primarily
interested in the FIDO2 support personally however there is also PKCS11 and
TPM2 support.  It would be great to enable all 3 of these.

An introduction/overview of the feature can be found here:
https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html

The relevant options libfido2, p11kit and tpm2 are currently disabled
in debian/rules.

It seems the fido2 support was disabled in 246-1 because "This is only used by
homed which we don't enable.” however that doesn’t apply anymore. Additionally
the p11kit and tpm2 support was disabled in 245-1 due to being new features
that require further review.


Reply via email to