Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

packaging: ship the step-up PAM stack and polkit fallback

Browse source 
SESSION-AUTHORITY-DOCTRINE §3 names /etc/pam.d/souveraine-stepup by path.
Root-owned config can only arrive by package: rootfs-overlay/ reaches a
device on flash and the phone does not flash.

auth_self, never auth_admin — step-up re-proves the user to themselves, it
does not escalate. The leading '-' on pam_fpc_polkit.so loads the fingerprint
factor only where it is installed, so one file serves phone and laptop.

Inert until a consumer calls it; no src/ path does yet.
This commit is contained in:
Fimeg 2026-08-12 10:39:47 -04:00
commit cc541d1eaa
4 changed files with 50 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
packaging/arch/PKGBUILD.prebuilt
View file

@ -10,16 +10,18 @@ pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
url="https://gitea.wiuf.net/Fimeg/souveraine"
license=('MIT')
depends=('gcc-libs' 'alsa-lib')
depends=('gcc-libs' 'alsa-lib' 'pam')
options=('!strip')
backup=('etc/pam.d/souveraine-stepup')
source=('souveraine-binary' 'souveraine.service'
'souveraine-secrets-binary' 'souveraine-secrets.service'
'souveraine-machined-binary' 'souveraine-machined.service'
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
'souveraine-verify-trail' 'souveraine-button'
'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
'LICENSE')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
'SKIP' 'SKIP' 'SKIP')
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
# sessiond is built and packaged for both supported architectures. Installing
# its user unit does not enable or start it; activation remains target-owned.
if [ "$CARCH" = aarch64 ]; then
@ -92,5 +94,15 @@ package() {
# check is not evidence (DEVICE-STATE-MACHINE.md §11).
install -Dm755 "$srcdir/souveraine-verify-trail" \
"$pkgdir/usr/bin/souveraine-verify-trail"
# Step-up authentication. Root-owned system config, so it can only arrive
# by package — rootfs-overlay/ reaches a device on flash and the phone does
# not flash (TASK-28). Both arches: the laptop authenticates by password
# until it has a second factor.
install -Dm644 "$srcdir/souveraine-stepup.pam" \
"$pkgdir/etc/pam.d/souveraine-stepup"
install -Dm644 "$srcdir/org.souveraine.stepup.policy" \
"$pkgdir/usr/share/polkit-1/actions/org.souveraine.stepup.policy"
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
}