[post-launch] bcvk CI: software FIDO2 emulator for enrollment tests without physical YubiKey

[foil-copy-overrate]

Post-launch CI hardening. Running enrollment tests in CI requires a FIDO2 device. A software emulator removes the physical YubiKey dependency.

Options to evaluate:

• uhid-based virtual HID device
• libfido2 virtual device support
• softhsm2 with FIDO2 shim

Actions:

• Identify a viable software FIDO2 emulator compatible with pam-u2f and systemd-cryptenroll
• Integrate into bcvk test VM image
• Cover: LUKS2 enrollment, SSH key generation, pam-u2f sudo

Note: Physical YubiKey tests in a separate bcvk hardware-passthrough job remain required for production validation.

[foil-copy-overrate]

⏳ Post-launch — deferred. Research: uhid-based virtual HID, libfido2 virtual device, softhsm2 shim. Must work with pam-u2f and systemd-cryptenroll.

[foil-copy-overrate]

swu2f (software FIDO2/U2F for CI) — bcvk-side scaffolding pushed to the canonical bcvk branch, not merged (post-launch, per the deferral above).

Branch: feat/swtpm-ci @ 66fbf130 — https://github.com/yubi-OS/bcvk/tree/feat/swtpm-ci (extends the swtpm work on the same branch)

Design call (grounded): unlike swtpm, this can't be a QEMU device. QEMU only ships u2f-emulated (CTAP1/U2F, no hmac-secret), and systemd-cryptenroll --fido2-device + LUKS2 FIDO2 unlock require CTAP2 hmac-secret. So swu2f is in-guest: a userspace CTAP2 authenticator (fidorium/passless) registers a virtual FIDO HID device via /dev/uhid; fido2-token -L, systemd-cryptenroll, and pam-u2f then see a real token.

What landed:

• crates/bcvk-qemu/src/swu2f.rs — Swu2fConfig + uhid_karg()/push_uhid_kargs() builders, 6 table-driven unit tests.
• crates/kit/src/run_ephemeral.rs — --swu2f flag; appends modules-load=uhid to the guest cmdline so /dev/uhid exists early.
• docs/swu2f.md — in-guest vs host rationale, the responsibility split (bcvk loads uhid; the test image ships the authenticator + a systemd unit + udev rule), usage, and the initramfs/root-unlock caveat (CI targets post-boot enrollment against a scratch LUKS2 container).

Caveats: authored via the GitHub API, not compiled — needs cargo build + cargo nextest run -p bcvk-qemu on a dev box and a human Signed-off-by (AGENTS.md/DCO) before any merge. Image-side authenticator packaging + the systemd unit are follow-ups. Test-only; production RoT stays YubiKey FIDO2 (ADR-003).

[foil-copy-overrate]

swu2f (software U2F/FIDO2 for hardware-free CI) staged on bcvk branch feat/swtpm-ci @ be5f3858c5 (same branch as swtpm #3, NO merge).

Layer 1 — landed (QEMU-arg builder + spec): crates/bcvk-qemu/src/swu2f.rs builds -usb -device u2f-emulated[,dir=<setup>] (libu2f-emu), a software USB HID U2F/CTAP1 token. Ephemeral or setup-dir identity, with table tests. Covers pam-u2f. Mirrors the --swtpm flag pattern (--swu2f). Spec: docs/swu2f.md.

Layer 2 — specced, separate PR: u2f-emulated is CTAP1 only, so it can't drive systemd-cryptenroll --fido2 (needs CTAP2 hmac-secret). The uhid route from this issue — an in-guest software authenticator on /dev/uhid + libfido2 + a Dockerfile.swu2f fixture — is documented as Layer 2 guest-image work.

Test-only; production RoT stays YubiKey FIDO2 (ADR-003). Not compiled here — needs cargo build + nextest + human Signed-off-by before merge.

[foil-copy-overrate]

swu2f compile-break reconciled on bcvk@feat/swtpm-ci (commit 2afd8778, no merge).

Two sibling commits had diverged: 66fbf130 wired the in-guest /dev/uhid CTAP2 route (run_ephemeral.rs calls bcvk_qemu::swu2f::push_uhid_kargs), then be5f3858 rewrote swu2f.rs to the host QEMU u2f-emulated (CTAP1) route and dropped push_uhid_kargs — leaving a dangling symbol at crates/kit/src/run_ephemeral.rs:1420, so kit no longer compiled.

Resolution: kept the in-guest uhid route. QEMU u2f-emulated (libu2f-emu) is CTAP1/U2F-only with no hmac-secret, so it cannot drive systemd-cryptenroll --fido2 for the LUKS2 FIDO2 e2e test (#33/#20); the wired --swu2f flag's own help text says it exposes /dev/uhid. Restored push_uhid_kargs + the uhid Swu2fConfig (per 66fbf130) so the call site resolves, and reconciled docs/swu2f.md: Layer 2 (in-guest uhid CTAP2) is what --swu2f implements now; Layer 1 (QEMU u2f-emulated, CTAP1/pam-u2f) is documented as a not-yet-wired optional host-side add-on. Both layers stay documented.

Test-only; production trust anchor stays the physical YubiKey FIDO2 (ADR-003). Caveat: not built here (no cargo/KVM) — needs cargo check -p bcvk-qemu -p kit + nextest + human Signed-off-by before any merge. bcvk stays a referenced branch, no merge.

[foil-copy-overrate]

swu2f Layer 2 (in-guest /dev/uhid CTAP2 authenticator) landed for the yubiOS side: #40 (branch feat/swu2f-layer2-ctap2-fixture, draft, NO MERGE).

• Authenticator: passless (Rust, GPL-3.0, v0.11.2), backend soft-fido2 which fully implements CTAP2 hmac-secret (soft-fido2-ctap/src/extensions.rs).
• Shipped only in a new mkosi --profile test image (mkosi.conf.d/test/); never in production (ADR-003 keeps the YubiKey as RoT).
• bcvk side (--swu2f = modules-load=uhid karg) is on feat/swtpm-ci; this completes the guest-image half this issue called for.
• Headless CI: debug build + PASSLESS_E2E_AUTO_ACCEPT_UV=1 passless --backend-type local, the upstream-documented e2e recipe.

[foil-copy-overrate]

Status — July 8: emulator decided + integrated; CI execution blocked on bcvk boot bug

Context (July 8 org policy): all fork default branches are now identical to upstream; every yubi-OS change lives on feat/feature branches; all CI runs from yubi-OS/yubiOS main via workflow_dispatch only.

Options evaluated (checkbox 1 — done):

• ✅ uhid-based virtual HID: passless (pando85/passless, soft-fido2 backend) — CHOSEN. Real CTAP2 with hmac-secret, works with libfido2 → pam-u2f, systemd-cryptenroll --fido2, homed. Upstream-documented headless e2e mode (PASSLESS_E2E_AUTO_ACCEPT_UV=1, local backend).
• ❌ libfido2 virtual device — no in-tree virtual authenticator with hmac-secret.
• ❌ softhsm2 + FIDO2 shim — softhsm is PKCS#11, not CTAP; no credible shim. (softhsm2 IS used for the PKCS#11 signing mock in ci_mkosi-installer.yml — different trust boundary.)

Integration (checkbox 2 — done): mkosi --profile test ships passless in-guest (PR #40); bcvk --swu2f loads uhid (branch feat/swtpm-ci, never merged).

Coverage (checkbox 3 — scripts landed): LUKS2 enrollment + homed (test-luks-fido2-ci.sh), pam-u2f (both scripts), SSH ed25519-sk keygen (test-fido2-enrollment.sh, new today). All lint-gated in ci_test-vm.yml.

Blocked on: the bcvk ephemeral boot bug (virtiofsd rc=2, see #20 comment) before the legs execute green in CI. Physical-YubiKey jobs remain required for production validation, as noted.

[foil-copy-overrate]

Update — July 8 (docker/podman pass + virtiofsd diagnosis)

Docker/podman audit (org-wide ask): confirmed the only podman call sites in yubiOS are in ci_test-vm.yml and tests/vm/*.sh (pull/rm/logs), and all three are structurally required — bcvk hardcodes Command::new("podman") in crates/kit/src/run_ephemeral.rs and ephemeral.rs with no runtime-select flag. Docker-pulled images live in a separate image store podman can't see, so swapping those calls to docker would just reintroduce "image not known". Left as-is, now with an explicit comment in the workflow explaining why. Everywhere else (ci_mkosi-installer.yml, ci_test-int.yml Stage 4) now runs the same pinned own-dockerd-on-ducker.sock pattern as yubiOS-ci.yml for consistency.

virtiofsd bug — refined, not yet resolved. Patched bcvk@feat/swtpm-ci (commits 3775a70, ca19d1c) so virtiofsd's stdout+stderr always land in a log file next to the socket regardless of race timing, and the startup-failure error now includes stdout, stderr, and the on-disk log tail. Rebuilt and reran: the process now provably produces zero bytes on stdout, stderr, or the log file, exiting cleanly with code 2. That rules out the original theory (stderr lost to a reap race) and rules out a missing /dev/fuse on the host (confirmed present, mode 0666, after adding a modprobe+mknod fallback step — didn't change the outcome). A clean exit(2) with literally no output on any channel is consistent with a very early argument-validation exit that bypasses normal error printing, but I can't confirm which check without namespace-level access inside bcvk's own bwrap/podman re-exec, which isn't reachable from GH Actions log capture. Next step needs either local reproduction with strace/gdb, or an upstream virtiofsd 1.10.0 (Ubuntu 24.04) issue report if it turns out unrelated to yubiOS's fork.

arm64 hosted runners correctly loud-skip the boot leg (no nested KVM) — that's working as designed, not a false pass.

[foil-copy-overrate]

Update (ADR-023): ARM64 is now yubiOS's primary target platform (ADR-023, commit 0f690c1). ci_test-vm.yml's amd64 boot leg now skips loudly via a new policy gate — this is a platform-priority decision, not a claim that the bcvk/virtiofsd bug here is fixed. The diagnosis in this issue stands: virtiofsd exits cleanly (rc=2) with zero output on stdout/stderr/logfile on amd64 GH-hosted runners, root cause still unconfirmed (needs local strace/gdb repro or an upstream virtiofsd 1.10.0 bug report). ARM64's boot leg is unaffected (it already runs, gated only on /dev/kvm availability) and is where CI attention now focuses. Leaving this issue open — the bug itself isn't resolved, just no longer blocking on a now-secondary architecture.