cc541d1eaa
SESSION-AUTHORITY-DOCTRINE §3 names /etc/pam.d/souveraine-stepup by path. Root-owned config can only arrive by package: rootfs-overlay/ reaches a device on flash and the phone does not flash. auth_self, never auth_admin — step-up re-proves the user to themselves, it does not escalate. The leading '-' on pam_fpc_polkit.so loads the fingerprint factor only where it is installed, so one file serves phone and laptop. Inert until a consumer calls it; no src/ path does yet.
108 lines
5.7 KiB
Text
108 lines
5.7 KiB
Text
# CI package recipe for prebuilt Souveraine binaries.
|
|
#
|
|
# The runner cross-compiles first, then makepkg assembles this package. This
|
|
# deliberately avoids compiling on the phone and keeps its agent data outside
|
|
# pacman's ownership.
|
|
pkgname=souveraine
|
|
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
|
|
pkgrel=1
|
|
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
|
|
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
|
|
url="https://gitea.wiuf.net/Fimeg/souveraine"
|
|
license=('MIT')
|
|
depends=('gcc-libs' 'alsa-lib' 'pam')
|
|
options=('!strip')
|
|
backup=('etc/pam.d/souveraine-stepup')
|
|
source=('souveraine-binary' 'souveraine.service'
|
|
'souveraine-secrets-binary' 'souveraine-secrets.service'
|
|
'souveraine-machined-binary' 'souveraine-machined.service'
|
|
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
|
|
'souveraine-verify-trail' 'souveraine-button'
|
|
'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
|
|
'LICENSE')
|
|
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
|
|
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
|
|
# sessiond is built and packaged for both supported architectures. Installing
|
|
# its user unit does not enable or start it; activation remains target-owned.
|
|
if [ "$CARCH" = aarch64 ]; then
|
|
source+=('souveraine-sensord-binary' 'souveraine-sensord.service'
|
|
'souveraine-usb-kvm-binary')
|
|
sha256sums+=('SKIP' 'SKIP' 'SKIP')
|
|
depends+=('wayland' 'libx11' 'libxcursor' 'libxi' 'libxkbcommon' 'libxrandr')
|
|
# The wry host links the system webview, so it only cross-builds once
|
|
# webkit2gtk is in the aarch64 sysroot. Declared only when CI actually
|
|
# produced one: makepkg validates every entry in `source`, so naming a file
|
|
# that is not there fails the entire package — and the avatar must never be
|
|
# what stops sessiond reaching the phone.
|
|
if [ -f "$startdir/souveraine-web-binary" ]; then
|
|
source+=('souveraine-web-binary')
|
|
sha256sums+=('SKIP')
|
|
fi
|
|
fi
|
|
|
|
package() {
|
|
install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
|
|
sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
|
|
| install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
|
|
# Session authority daemon, package-owned on both architectures. The unit
|
|
# points at /usr/bin and package installation does not enable or start it.
|
|
install -Dm755 "$srcdir/souveraine-sessiond-binary" \
|
|
"$pkgdir/usr/bin/souveraine-sessiond"
|
|
install -Dm644 "$srcdir/souveraine-sessiond.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
|
|
# Sensor reporter, aarch64 only — the laptop has no iio-sensor-proxy
|
|
# sources worth reporting and no device state machine listening.
|
|
if [ -f "$srcdir/souveraine-web-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-web-binary" \
|
|
"$pkgdir/usr/bin/souveraine-web"
|
|
fi
|
|
|
|
if [ -f "$srcdir/souveraine-sensord-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-sensord-binary" \
|
|
"$pkgdir/usr/bin/souveraine-sensord"
|
|
install -Dm644 "$srcdir/souveraine-sensord.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-sensord.service"
|
|
fi
|
|
if [ -f "$srcdir/souveraine-usb-kvm-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-usb-kvm-binary" \
|
|
"$pkgdir/usr/bin/souveraine-usb-kvm"
|
|
fi
|
|
# Hardware button reporter. Every arch: it decides nothing and depends on
|
|
# nothing, and a laptop with a power button is the same shape. Replaces
|
|
# blueline-power-button, which was owned by no package and carried its own
|
|
# copy of the lock-then-blank ordering.
|
|
install -Dm755 "$srcdir/souveraine-button" "$pkgdir/usr/bin/souveraine-button"
|
|
# Secrets rail (user service, owns org.freedesktop.secrets) and machined
|
|
# (system service, machine identity). Both were hand-copied to the phone
|
|
# and owned by no package — same gap as sessiond.
|
|
install -Dm755 "$srcdir/souveraine-secrets-binary" "$pkgdir/usr/bin/souveraine-secrets"
|
|
install -Dm644 "$srcdir/souveraine-secrets.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-secrets.service"
|
|
# NOT shipping /usr/share/dbus-1/services/org.freedesktop.secrets.service:
|
|
# gnome-keyring owns that path, and two packages claiming the secrets
|
|
# provider is the collision the session-authority doctrine warns about.
|
|
# souveraine-secrets.service already owns the bus name at runtime, so the
|
|
# rail works without stealing the D-Bus activation file.
|
|
|
|
install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
|
|
install -Dm644 "$srcdir/souveraine-machined.service" \
|
|
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
|
|
|
|
# Verifies the forensic trail's hash chain. Ships with the daemon that
|
|
# writes it, not in the rootfs overlay: the overlay only reaches a device
|
|
# at provision time, and the phone is not reflashed. Evidence nobody can
|
|
# check is not evidence (DEVICE-STATE-MACHINE.md §11).
|
|
install -Dm755 "$srcdir/souveraine-verify-trail" \
|
|
"$pkgdir/usr/bin/souveraine-verify-trail"
|
|
|
|
# Step-up authentication. Root-owned system config, so it can only arrive
|
|
# by package — rootfs-overlay/ reaches a device on flash and the phone does
|
|
# not flash (TASK-28). Both arches: the laptop authenticates by password
|
|
# until it has a second factor.
|
|
install -Dm644 "$srcdir/souveraine-stepup.pam" \
|
|
"$pkgdir/etc/pam.d/souveraine-stepup"
|
|
install -Dm644 "$srcdir/org.souveraine.stepup.policy" \
|
|
"$pkgdir/usr/share/polkit-1/actions/org.souveraine.stepup.policy"
|
|
|
|
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
|
}
|