Bug 2565411

Summary:	Review Request: ssh-tpm-agent - SSH agent allowing the use of TPM-backed keys
Product:	[Fedora] Fedora	Reporter:	Alex Haydock <alex>
Component:	Package Review	Assignee:	Nobody's working on this, feel free to take it <nobody>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	package-review
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alex Haydock 2026-11-02 21:39:42 UTC

Spec URL: https://raw.githubusercontent.com/alexhaydock/ssh-tpm-agent-fedora/refs/heads/main/ssh-tpm-agent.spec
SRPM URL: https://github.com/alexhaydock/ssh-tpm-agent-fedora/raw/refs/heads/main/ssh-tpm-agent-0.9.0-1.fc46.src.rpm
Description: An ssh-agent compatible agent that allows keys to be created by the Trusted Platform Module (TPM) for authentication towards ssh servers.
Fedora Account System Username: alexhaydock

Proposing to add ssh-tpm-agent (https://github.com/Foxboron/ssh-tpm-agent) to Fedora's package repository. This package allows creating and enrolling SSH keys into a system's TPM module for use in authenticating to SSH servers.

I am part of the `packager` group so don't require sponsorship but this is my first attempt at packaging a Golang package and learning the vendoring process. There were some quirks here that I hope I've addressed appropriately.

The upstream google/go-tpm-tools dependency uses vendored Microsoft code that needs compiling with CGO (https://github.com/google/go-tpm-tools/tree/main/simulator/ms-tpm-20-ref). I'm not clear that the `simulator` module is actually used by the downstream `ssh-tpm-agent` package, but there's no build macro to disable it that I can find so I have manually vendored the upstream code. (It's BSD 3-Clause licensed to that's provided for in the License section properly). Not sure if my approach is right there.

Edit: The upstream application also ships a set of systemd units, which are installed as per the instructions using a CLI command. I'm unsure whether I should pull these out as part of the %install section and put them in the systemd service unit vendor directories under /usr/lib/systemd but it seems like it might be a good option.