gnu/packages/security-token.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
   4 ;;; Copyright © 2016 Mike Gerwitz <mtg@gnu.org>
   5 ;;; Copyright © 2016 Marius Bakke <mbakke@fastmail.com>
   6 ;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
   7 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   8 ;;; Copyright © 2017, 2019 Ricardo Wurmus <rekado@elephly.net>
   9 ;;; Copyright © 2018, 2019 Chris Marusich <cmmarusich@gmail.com>
  10 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
  11 ;;;
  12 ;;; This file is part of GNU Guix.
  13 ;;;
  14 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  15 ;;; under the terms of the GNU General Public License as published by
  16 ;;; the Free Software Foundation; either version 3 of the License, or (at
  17 ;;; your option) any later version.
  18 ;;;
  19 ;;; GNU Guix is distributed in the hope that it will be useful, but
  20 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  21 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22 ;;; GNU General Public License for more details.
  23 ;;;
  24 ;;; You should have received a copy of the GNU General Public License
  25 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  26
  27 (define-module (gnu packages security-token)
  28   #:use-module (gnu packages)
  29   #:use-module ((guix licenses) #:prefix license:)
  30   #:use-module (guix packages)
  31   #:use-module (guix download)
  32   #:use-module (guix gexp)
  33   #:use-module (guix git-download)
  34   #:use-module (guix build-system gnu)
  35   #:use-module (guix build-system glib-or-gtk)
  36   #:use-module (guix build-system python)
  37   #:use-module (gnu packages autotools)
  38   #:use-module (gnu packages base)
  39   #:use-module (gnu packages curl)
  40   #:use-module (gnu packages check)
  41   #:use-module (gnu packages docbook)
  42   #:use-module (gnu packages documentation)
  43   #:use-module (gnu packages dns)
  44   #:use-module (gnu packages gettext)
  45   #:use-module (gnu packages graphviz)
  46   #:use-module (gnu packages gtk)
  47   #:use-module (gnu packages libusb)
  48   #:use-module (gnu packages linux)
  49   #:use-module (gnu packages man)
  50   #:use-module (gnu packages networking)
  51   #:use-module (gnu packages cyrus-sasl)
  52   #:use-module (gnu packages popt)
  53   #:use-module (gnu packages readline)
  54   #:use-module (gnu packages tls)
  55   #:use-module (gnu packages tex)
  56   #:use-module (gnu packages perl)
  57   #:use-module (gnu packages pkg-config)
  58   #:use-module (gnu packages python)
  59   #:use-module (gnu packages python-crypto)
  60   #:use-module (gnu packages python-xyz)
  61   #:use-module (gnu packages swig)
  62   #:use-module (gnu packages web)
  63   #:use-module (gnu packages xml))
  64
  65 (define-public ccid
  66   (package
  67     (name "ccid")
  68     (version "1.4.33")
  69     (source (origin
  70               (method url-fetch)
  71               (uri (string-append "https://ccid.apdu.fr/files/ccid-"
  72                                   version ".tar.bz2"))
  73               (sha256
  74                (base32
  75                 "0974h2v9wq0j0ajw3c7yckaw8wqcppb2npfhfhmv9phijy9xlmjj"))))
  76     (build-system gnu-build-system)
  77     (arguments
  78      `(#:configure-flags (list (string-append "--enable-usbdropdir=" %output
  79                                               "/pcsc/drivers"))
  80        #:phases
  81        (modify-phases %standard-phases
  82          (add-after 'unpack 'patch-Makefile
  83            (lambda _
  84              (substitute* "src/Makefile.in"
  85                (("/bin/echo") (which "echo")))
  86              #t)))))
  87     (native-inputs
  88      `(("pcsc-lite" ,pcsc-lite)         ; only required for headers
  89        ("perl" ,perl)
  90        ("pkg-config" ,pkg-config)))
  91     (inputs
  92      `(("libusb" ,libusb)))
  93     (home-page "https://ccid.apdu.fr/")
  94     (synopsis "PC/SC driver for USB smart card devices")
  95     (description
  96      "This package provides a PC/SC IFD handler implementation for devices
  97 compliant with the CCID and ICCD protocols.  It supports a wide range of
  98 readers and is needed to communicate with such devices through the
  99 @command{pcscd} resource manager.")
 100     (license license:lgpl2.1+)))
 101
 102 (define-public eid-mw
 103   (package
 104     (name "eid-mw")
 105     (version "4.4.27")
 106     (source
 107      (origin
 108        (method git-fetch)
 109        (uri (git-reference
 110              (url "https://github.com/Fedict/eid-mw")
 111              (commit (string-append "v" version))))
 112        (file-name (git-file-name name version))
 113        (sha256
 114         (base32 "17lw8iwp7h5cs3db80sysr84ffi333cf2vrhncs9l6hy6glfl2v1"))))
 115     (build-system glib-or-gtk-build-system)
 116     (native-inputs
 117      `(("autoconf" ,autoconf)
 118        ("automake" ,automake)
 119        ("gettext" ,gettext-minimal)
 120        ("libtool" ,libtool)
 121        ("pkg-config" ,pkg-config)
 122        ("perl" ,perl)))
 123     (inputs
 124      `(("curl" ,curl)
 125        ("openssl" ,openssl)
 126        ("gtk+" ,gtk+)
 127        ("pcsc-lite" ,pcsc-lite)
 128        ("p11-kit" ,p11-kit)
 129        ("libproxy" ,libproxy)
 130        ("libxml2" ,libxml2)
 131        ("cyrus-sasl" ,cyrus-sasl)))
 132     (arguments
 133      `(#:phases
 134        (modify-phases %standard-phases
 135          (add-after 'unpack 'bootstrap
 136            (lambda _
 137              ;; configure.ac relies on ‘git --describe’ to get the version.
 138              ;; Patch it to just return the real version number directly.
 139              (substitute* "scripts/build-aux/genver.sh"
 140                (("/bin/sh") (which "sh"))
 141                (("^(GITDESC=).*" _ match) (string-append match ,version "\n")))
 142              (invoke "sh" "./bootstrap.sh"))))))
 143     (synopsis "Belgian eID Middleware")
 144     (description "The Belgian eID Middleware is required to authenticate with
 145 online services using the Belgian electronic identity card.")
 146     (home-page "https://github.com/Fedict/eid-mw")
 147     (license license:lgpl3)))
 148
 149 (define-public libyubikey
 150   (package
 151     (name "libyubikey")
 152     (version "1.13")
 153     (source (origin
 154               (method url-fetch)
 155               (uri (string-append
 156                     "https://developers.yubico.com/yubico-c/Releases/"
 157                     name "-" version ".tar.gz"))
 158               (sha256
 159                (base32
 160                 "009l3k2zyn06dbrlja2d4p2vfnzjhlcqxi88v02mlrnb17mx1v84"))))
 161     (build-system gnu-build-system)
 162     (synopsis "Development kit for the YubiKey authentication device")
 163     (description
 164      "This package contains a C library and command-line tools that make up
 165 the low-level development kit for the Yubico YubiKey authentication device.")
 166     (home-page "https://developers.yubico.com/yubico-c/")
 167     (license license:bsd-2)))
 168
 169 (define-public softhsm
 170   (package
 171     (name "softhsm")
 172     (version "2.6.1")
 173     (source (origin
 174               (method url-fetch)
 175               (uri (string-append
 176                     "https://dist.opendnssec.org/source/"
 177                     "softhsm-" version ".tar.gz"))
 178               (sha256
 179                (base32
 180                 "1wkmyi6n3z2pak1cj5yk6v6bv9w0m24skycya48iikab0mrr8931"))))
 181     (build-system gnu-build-system)
 182     (arguments
 183      '(#:configure-flags '("--disable-gost"))) ; TODO Missing the OpenSSL
 184                                                ; engine for GOST
 185     (inputs
 186      `(("openssl" ,openssl)))
 187     (native-inputs
 188      `(("pkg-config" ,pkg-config)
 189        ("cppunit" ,cppunit)))
 190     (synopsis "Software implementation of a generic cryptographic device")
 191     (description
 192      "SoftHSM 2 is a software implementation of a generic cryptographic device
 193 with a PKCS #11 Cryptographic Token Interface.")
 194     (home-page "https://www.opendnssec.org/softhsm/")
 195     (license license:bsd-2)))
 196
 197 (define-public pcsc-lite
 198   (package
 199     (name "pcsc-lite")
 200     (version "1.8.26")
 201     (source (origin
 202               (method url-fetch)
 203               (uri (string-append "https://pcsclite.apdu.fr/files/"
 204                                   "pcsc-lite-" version ".tar.bz2"))
 205               (sha256
 206                (base32
 207                 "1ndvvz0fgqwz70pijymsxmx25mzryb0zav1i8jjc067ndryvxdry"))))
 208     (build-system gnu-build-system)
 209     (arguments
 210      `(#:configure-flags '("--enable-usbdropdir=/var/lib/pcsc/drivers"
 211                            "--disable-libsystemd")))
 212     (native-inputs
 213      `(("perl" ,perl)                   ; for pod2man
 214        ("pkg-config" ,pkg-config)))
 215     (inputs
 216      `(("libudev" ,eudev)))
 217     (home-page "https://pcsclite.apdu.fr/")
 218     (synopsis "Middleware to access a smart card using PC/SC")
 219     (description
 220      "pcsc-lite provides an interface to communicate with smartcards and
 221 readers using the SCard API.  pcsc-lite is used to connect to the PC/SC daemon
 222 from a client application and provide access to the desired reader.")
 223     (license (list license:bsd-3                ; pcsc-lite
 224                    license:isc                  ; src/strlcat.c src/strlcpy.c
 225                    license:gpl3+))))            ; src/spy/*
 226
 227 (define-public ykclient
 228   (package
 229     (name "ykclient")
 230     (version "2.15")
 231     (source (origin
 232               (method url-fetch)
 233               (uri (string-append
 234                     "https://developers.yubico.com/yubico-c-client/Releases/"
 235                     name "-" version ".tar.gz"))
 236               (sha256
 237                (base32
 238                 "05jhx9waj3pl120ddnwap1v3bjrnbfhvf3lxs2xmhpcmwzpwsqgl"))))
 239     (build-system gnu-build-system)
 240
 241     ;; There's just one test, and it requires network access to access
 242     ;; yubico.com, so skip it.
 243     (arguments '(#:tests? #f))
 244
 245     (native-inputs `(("pkg-config" ,pkg-config)
 246                      ("help2man" ,help2man)))
 247     (inputs `(("curl" ,curl)))
 248     (synopsis "C library to validate one-time-password YubiKeys")
 249     (description
 250      "YubiKey C Client Library (libykclient) is a C library used to validate a
 251 one-time-password (OTP) YubiKey against Yubico’s servers.  See the Yubico
 252 website for more information about Yubico and the YubiKey.")
 253     (home-page "https://developers.yubico.com/yubico-c-client/")
 254     (license license:bsd-2)))
 255
 256 (define-public opensc
 257   (package
 258     (name "opensc")
 259     (version "0.20.0")
 260     (source (origin
 261               (method url-fetch)
 262               (uri (string-append
 263                     "https://github.com/OpenSC/OpenSC/releases/download/"
 264                     version "/opensc-" version ".tar.gz"))
 265               (sha256
 266                (base32
 267                 "0qs8pabkrpj1z52bkdsk59s2z6q5m0hfh9d5j1f68qs4lksb9x5v"))))
 268     (build-system gnu-build-system)
 269     (arguments
 270      `(#:phases
 271        (modify-phases %standard-phases
 272          ;; By setting an absolute path here, we arrange for OpenSC to
 273          ;; successfully dlopen libpcsclite.so.1 by default.  The user can
 274          ;; still override this if they want to, by specifying a custom OpenSC
 275          ;; configuration file at runtime.
 276          (add-after 'unpack 'set-default-libpcsclite.so.1-path
 277            (lambda* (#:key inputs #:allow-other-keys)
 278              (let ((libpcsclite (string-append (assoc-ref inputs "pcsc-lite")
 279                                                "/lib/libpcsclite.so.1")))
 280                (substitute* "configure"
 281                  (("DEFAULT_PCSC_PROVIDER=\"libpcsclite\\.so\\.1\"")
 282                   (string-append
 283                    "DEFAULT_PCSC_PROVIDER=\"" libpcsclite "\"")))
 284                #t))))))
 285     (inputs
 286      `(("readline" ,readline)
 287        ("openssl" ,openssl)
 288        ("pcsc-lite" ,pcsc-lite)
 289        ("ccid" ,ccid)))
 290     (native-inputs
 291      `(("libxslt" ,libxslt)
 292        ("docbook-xsl" ,docbook-xsl)
 293        ("pkg-config" ,pkg-config)))
 294     (home-page "https://github.com/OpenSC/OpenSC/wiki")
 295     (synopsis "Tools and libraries related to smart cards")
 296     (description
 297      "OpenSC is a set of software tools and libraries to work with smart
 298 cards, with the focus on smart cards with cryptographic capabilities.  OpenSC
 299 facilitate the use of smart cards in security applications such as
 300 authentication, encryption and digital signatures.  OpenSC implements the PKCS
 301 #15 standard and the PKCS #11 API.")
 302     (license license:lgpl2.1+)))
 303
 304 (define-public yubico-piv-tool
 305   (package
 306     (name "yubico-piv-tool")
 307     (version "1.6.1")
 308     (source (origin
 309               (method url-fetch)
 310               (uri (string-append
 311                     "https://developers.yubico.com/yubico-piv-tool/Releases/"
 312                     name "-" version ".tar.gz"))
 313               (sha256
 314                (base32
 315                 "10xgdc51xvszkxmsvqnbjs8ixxz7rfnfahh3wn8glllynmszbhwi"))))
 316     (build-system gnu-build-system)
 317     (inputs
 318      `(("gengetopt" ,gengetopt)
 319        ("perl" ,perl)
 320        ("pcsc-lite" ,pcsc-lite)
 321        ("openssl" ,openssl)))
 322     (native-inputs
 323      `(("doxygen" ,doxygen)
 324        ("graphviz" ,graphviz)
 325        ("help2man" ,help2man)
 326        ("check" ,check)
 327        ("texlive-bin" ,texlive-bin)
 328        ("pkg-config" ,pkg-config)))
 329     (home-page "https://developers.yubico.com/yubico-piv-tool/")
 330     (synopsis "Interact with the PIV application on a YubiKey")
 331     (description
 332      "The Yubico PIV tool is used for interacting with the Privilege and
 333 Identification Card (PIV) application on a YubiKey.  With it you may generate
 334 keys on the device, import keys and certificates, create certificate requests,
 335 and other operations.  It includes a library and a command-line tool.")
 336     ;; The file ykcs11/pkcs11.h also declares an additional, very short free
 337     ;; license for that one file.  Please see it for details.  The vast
 338     ;; majority of files are licensed under bsd-2.
 339     (license license:bsd-2)))
 340
 341 (define-public yubikey-personalization
 342   (package
 343     (name "yubikey-personalization")
 344     (version "1.19.3")
 345     (source (origin
 346               (method url-fetch)
 347               (uri (string-append
 348                     "https://developers.yubico.com/" name
 349                     "/Releases/ykpers-" version ".tar.gz"))
 350               (sha256
 351                (base32
 352                 "0jhvnavjrpwzmmjcw486df5s48j53njqgyz36yz3dskbaz3kwlfr"))))
 353     (build-system gnu-build-system)
 354     (arguments
 355      '(#:configure-flags (list (string-append "--with-udevrulesdir="
 356                                               (assoc-ref %outputs "out")
 357                                               "/lib/udev/rules.d"))))
 358     (inputs
 359      `(("json-c" ,json-c-0.13)
 360        ("libusb" ,libusb)
 361        ;; The library "libyubikey" is also known as "yubico-c".
 362        ("libyubikey" ,libyubikey)))
 363     (native-inputs
 364      `(("pkg-config" ,pkg-config)
 365        ("eudev" ,eudev)))
 366     (home-page "https://developers.yubico.com/yubikey-personalization/")
 367     (synopsis "Library and tools to personalize YubiKeys")
 368     (description
 369      "The YubiKey Personalization package contains a C library and command
 370 line tools for personalizing YubiKeys.  You can use these to set an AES key,
 371 retrieve a YubiKey's serial number, and so forth.")
 372     (license license:bsd-2)))
 373
 374 (define-public python-pyscard
 375   (package
 376     (name "python-pyscard")
 377     (version "1.9.9")
 378     (source (origin
 379               (method url-fetch)
 380               ;; The maintainer publishes releases on various sites, but
 381               ;; SourceForge is apparently the only one with a signed release.
 382               (uri (string-append
 383                     "mirror://sourceforge/pyscard/pyscard/pyscard%20"
 384                     version "/pyscard-" version ".tar.gz"))
 385               (sha256
 386                (base32
 387                 "082cjkbxadaz2jb4rbhr0mkrirzlqyqhcf3r823qb0q1k50ybgg6"))))
 388     (build-system python-build-system)
 389     (arguments
 390      `(#:phases
 391        (modify-phases %standard-phases
 392          ;; Tell pyscard where to find the PCSC include directory.
 393          (add-after 'unpack 'patch-platform-include-dirs
 394            (lambda* (#:key inputs #:allow-other-keys)
 395              (let ((pcsc-include-dir (string-append
 396                                       (assoc-ref inputs "pcsc-lite")
 397                                       "/include/PCSC")))
 398                (substitute* "setup.py"
 399                  (("platform_include_dirs = \\[.*?\\]")
 400                   (string-append
 401                    "platform_include_dirs = ['" pcsc-include-dir "']")))
 402                #t)))
 403          ;; pyscard wants to dlopen libpcsclite, so tell it where it is.
 404          (add-after 'unpack 'patch-dlopen
 405            (lambda* (#:key inputs #:allow-other-keys)
 406              (substitute* "smartcard/scard/winscarddll.c"
 407                (("lib = \"libpcsclite\\.so\\.1\";")
 408                 (simple-format #f
 409                                "lib = \"~a\";"
 410                                (string-append (assoc-ref inputs "pcsc-lite")
 411                                               "/lib/libpcsclite.so.1"))))
 412              #t)))))
 413     (inputs
 414      `(("pcsc-lite" ,pcsc-lite)))
 415     (native-inputs
 416      `(("swig" ,swig)))
 417     (home-page "https://github.com/LudovicRousseau/pyscard")
 418     (synopsis "Smart card library for Python")
 419     (description
 420      "The pyscard smart card library is a framework for building smart card
 421 aware applications in Python.  The smart card module is built on top of the
 422 PCSC API Python wrapper module.")
 423     (license license:lgpl2.1+)))
 424
 425 (define-public python2-pyscard
 426   (package-with-python2 python-pyscard))
 427
 428 (define-public libu2f-host
 429   (package
 430     (name "libu2f-host")
 431     (version "1.1.10")
 432     (source (origin
 433               (method url-fetch)
 434               (uri
 435                (string-append
 436                 "https://developers.yubico.com"
 437                 "/libu2f-host/Releases/libu2f-host-" version ".tar.xz"))
 438               (sha256
 439                (base32
 440                 "0vrivl1dwql6nfi48z6dy56fwy2z13d7abgahgrs2mcmqng7hra2"))))
 441     (build-system gnu-build-system)
 442     (arguments
 443      `(#:configure-flags
 444        (list "--enable-gtk-doc"
 445              (string-append "--with-udevrulesdir="
 446                             (assoc-ref %outputs "out")
 447                             "/lib/udev/rules.d"))
 448        #:phases
 449        (modify-phases %standard-phases
 450          (add-after 'unpack 'patch-docbook-xml
 451            (lambda* (#:key inputs #:allow-other-keys)
 452              ;; Avoid a network connection attempt during the build.
 453              (substitute* "gtk-doc/u2f-host-docs.xml"
 454                (("http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd")
 455                 (string-append (assoc-ref inputs "docbook-xml")
 456                                "/xml/dtd/docbook/docbookx.dtd")))
 457              #t)))))
 458     (inputs
 459      `(("json-c" ,json-c-0.13)
 460        ("hidapi" ,hidapi)))
 461     (native-inputs
 462      `(("help2man" ,help2man)
 463        ("gengetopt" ,gengetopt)
 464        ("pkg-config" ,pkg-config)
 465        ("gtk-doc" ,gtk-doc)
 466        ("docbook-xml" ,docbook-xml-4.3)
 467        ("eudev" ,eudev)))
 468     (home-page "https://developers.yubico.com/libu2f-host/")
 469     ;; TRANSLATORS: The U2F protocol has a "server side" and a "host side".
 470     (synopsis "U2F host-side C library and tool")
 471     (description
 472      "Libu2f-host provides a C library and command-line tool that implements
 473 the host-side of the Universal 2nd Factor (U2F) protocol.  There are APIs to
 474 talk to a U2F device and perform the U2F Register and U2F Authenticate
 475 operations.")
 476     ;; Most files are LGPLv2.1+, but some files are GPLv3+.
 477     (license (list license:lgpl2.1+ license:gpl3+))))
 478
 479 (define-public libu2f-server
 480   (package
 481     (name "libu2f-server")
 482     (version "1.1.0")
 483     (source (origin
 484               (method git-fetch)
 485               (uri
 486                (git-reference
 487                 (url "https://github.com/Yubico/libu2f-server")
 488                 (commit (string-append "libu2f-server-" version))))
 489               (file-name (git-file-name name version))
 490               (sha256
 491                (base32
 492                 "1nmsfq372zza5y6j13ydincjf324bwfcjg950vykh166xkp6wiic"))))
 493     (build-system gnu-build-system)
 494     (arguments
 495      `(#:configure-flags
 496        (list "--enable-gtk-doc"
 497              "--enable-tests")))
 498     (inputs
 499      `(("json-c" ,json-c-0.13)
 500        ("libressl" ,libressl)))
 501     (native-inputs
 502      `(("autoconf" ,autoconf)
 503        ("automake" ,automake)
 504        ("libtool" ,libtool)
 505        ("check" ,check)
 506        ("gengetopt" ,gengetopt)
 507        ("help2man" ,help2man)
 508        ("pkg-config" ,pkg-config)
 509        ("gtk-doc" ,gtk-doc)
 510        ("which" ,which)))
 511     (home-page "https://developers.yubico.com/libu2f-server/")
 512     ;; TRANSLATORS: The U2F protocol has a "server side" and a "host side".
 513     (synopsis "U2F server-side C library")
 514     (description
 515      "This is a C library that implements the server-side of the
 516 @dfn{Universal 2nd Factor} (U2F) protocol.  More precisely, it provides an API
 517 for generating the JSON blobs required by U2F devices to perform the U2F
 518 Registration and U2F Authentication operations, and functionality for
 519 verifying the cryptographic operations.")
 520     (license license:bsd-2)))
 521
 522 (define-public pam-u2f
 523   (package
 524     (name "pam-u2f")
 525     (version "1.0.8")
 526     (source (origin
 527               (method git-fetch)
 528               (uri
 529                (git-reference
 530                 (url "https://github.com/Yubico/pam-u2f")
 531                 (commit (string-append "pam_u2f-" version))))
 532               (file-name (git-file-name name version))
 533               (sha256
 534                (base32
 535                 "04d9davyi33gqbvga1rvh9fijp6f16mx2xmnn4n61rnhcn2jac98"))))
 536     (build-system gnu-build-system)
 537     (arguments
 538      `(#:configure-flags
 539        (list (string-append "--with-pam-dir="
 540                             (assoc-ref %outputs "out") "/lib/security"))))
 541     (inputs
 542      `(("libu2f-host" ,libu2f-host)
 543        ("libu2f-server" ,libu2f-server)
 544        ("linux-pam" ,linux-pam)))
 545     (native-inputs
 546      `(("autoconf" ,autoconf)
 547        ("automake" ,automake)
 548        ("libtool" ,libtool)
 549        ("asciidoc" ,asciidoc)
 550        ("pkg-config" ,pkg-config)))
 551     (home-page "https://developers.yubico.com/pam-u2f/")
 552     (synopsis "PAM module for U2F authentication")
 553     (description
 554      "This package provides a module implementing PAM over U2F, providing an
 555 easy way to integrate the YubiKey (or other U2F compliant authenticators) into
 556 your existing infrastructure.")
 557     (license license:bsd-2)))
 558
 559 (define-public python-fido2
 560   (package
 561     (name "python-fido2")
 562     (version "0.5.0")
 563     (source (origin
 564               (method url-fetch)
 565               (uri
 566                (string-append
 567                 "https://github.com/Yubico/python-fido2/releases/download/"
 568                 version "/fido2-" version ".tar.gz"))
 569               (sha256
 570                (base32
 571                 "1pl8d2pr6jzqj4y9qiaddhjgnl92kikjxy0bgzm2jshkzzic8mp3"))
 572               (snippet
 573                ;; Remove bundled dependency.
 574                #~(delete-file "fido2/public_suffix_list.dat"))))
 575     (build-system python-build-system)
 576     (arguments
 577      `(#:phases
 578        (modify-phases %standard-phases
 579          (add-after 'unpack 'install-public-suffix-list
 580            (lambda* (#:key inputs #:allow-other-keys)
 581              (copy-file
 582               (string-append (assoc-ref inputs "public-suffix-list")
 583                              "/share/public-suffix-list-"
 584                              ,(package-version public-suffix-list)
 585                              "/public_suffix_list.dat")
 586               "fido2/public_suffix_list.dat")
 587              #t)))))
 588     (propagated-inputs
 589      `(("python-cryptography" ,python-cryptography)
 590        ("python-six" ,python-six)))
 591     (native-inputs
 592      `(("python-mock" ,python-mock)
 593        ("python-pyfakefs" ,python-pyfakefs)
 594        ("public-suffix-list" ,public-suffix-list)))
 595     (home-page "https://github.com/Yubico/python-fido2")
 596     (synopsis "Python library for communicating with FIDO devices over USB")
 597     (description
 598      "This Python library provides functionality for communicating with a Fast
 599 IDentity Online (FIDO) device over Universal Serial Bus (USB) as well as
 600 verifying attestation and assertion signatures.  It aims to support the FIDO
 601 Universal 2nd Factor (U2F) and FIDO 2.0 protocols for communicating with a USB
 602 authenticator via the Client-to-Authenticator Protocol (CTAP 1 and 2).  In
 603 addition to this low-level device access, classes defined in the
 604 @code{fido2.client} and @code{fido2.server} modules implement higher level
 605 operations which are useful when interfacing with an Authenticator, or when
 606 implementing a Relying Party.")
 607     ;; python-fido2 contains some derivative files originally from pyu2f
 608     ;; (https://github.com/google/pyu2f).  These files are licensed under the
 609     ;; Apache License, version 2.0.  The maintainers have customized these
 610     ;; files for internal use, so they are not really a bundled dependency.
 611     (license (list license:bsd-2 license:asl2.0))))
 612
 613 (define-public python2-fido2
 614   (package-with-python2 python-fido2))
 615
 616 (define-public python-yubikey-manager
 617   (package
 618     (name "python-yubikey-manager")
 619     (version "2.1.0")
 620     (source (origin
 621               (method url-fetch)
 622               (uri (string-append
 623                     "https://developers.yubico.com/yubikey-manager/Releases"
 624                     "/yubikey-manager-" version ".tar.gz"))
 625               (sha256
 626                (base32
 627                 "11rsmcaj60k3y5m5gdhr2nbbz0w5dm3m04klyxz0fh5hnpcmr7fm"))))
 628     (build-system python-build-system)
 629     (propagated-inputs
 630      `(("python-six" ,python-six)
 631        ("python-pyscard" ,python-pyscard)
 632        ("python-pyusb" ,python-pyusb)
 633        ("python-click" ,python-click)
 634        ("python-cryptography" ,python-cryptography)
 635        ("python-pyopenssl" ,python-pyopenssl)
 636        ("python-fido2" ,python-fido2)))
 637     (inputs
 638      `(("yubikey-personalization" ,yubikey-personalization)
 639        ("pcsc-lite" ,pcsc-lite)
 640        ("libusb" ,libusb)))
 641     (native-inputs
 642      `(("swig" ,swig)
 643        ("python-mock" ,python-mock)))
 644     (home-page "https://developers.yubico.com/yubikey-manager/")
 645     (synopsis "Command line tool and library for configuring a YubiKey")
 646     (description
 647      "Python library and command line tool for configuring a YubiKey.  Note
 648 that after installing this package, you might still need to add appropriate
 649 udev rules to your system configuration to be able to configure the YubiKey as
 650 an unprivileged user.")
 651     (license license:bsd-2)))
 652
 653 (define-public python2-yubikey-manager
 654   (package-with-python2 python-yubikey-manager))