Bug 2509218 - Review Request: libcryptsetup-token-kbs - LUKS2 token plugin that uses a KBS for attestation
Summary: Review Request: libcryptsetup-token-kbs - LUKS2 token plugin that uses a KBS ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Cole Robinson
QA Contact: Fedora Extras Quality Assurance
URL: https://github.com/MatiasVara/%{crate}
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-30 09:28 UTC by Matias Ezequiel Vara Larsen
Modified: 2026-08-31 15:38 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-08-31 15:38:48 UTC
Type: ---
Embargoed:
crobinso: fedora-review+


Attachments (Terms of Use)

Description Matias Ezequiel Vara Larsen 2026-07-30 09:28:58 UTC
Spec URL: https://download.copr.fedorainfracloud.org/results/matiasv/libcryptsetup-token-kbs/fedora-rawhide-x86_64/10792337-libcryptsetup-token-kbs/libcryptsetup-token-kbs.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/matiasv/libcryptsetup-token-kbs/srpm-builds/10792337/libcryptsetup-token-kbs-2.0.0-1.fc37.src.rpm

Description:
LUKS2 external token plugin that unlocks encrypted volumes via TEE
attestation against a Key Broker Service (KBS). Tested with Intel TDX
but compatible with any TEE supported by trustee-attester.
Also ships repart-kbs-helper, a first-boot attestation helper used by
systemd-repart to obtain the LUKS encryption key.

Upstream: https://github.com/MatiasVara/libcryptsetup-token-kbs

License: GPL-3.0-or-later

Successful Copr build: https://copr.fedorainfracloud.org/coprs/matiasv/libcryptsetup-token-kbs/builds/

Fedora Account: matiasv

I am the upstream maintainer of this project.

Comment 1 Cole Robinson 2026-08-02 16:47:53 UTC
rust package but not using rust2rpm so we are off the beaten path here, but the structure looks ok to me.
builds and installs fine on rawhide.
Only other examples of cryptsetup plugins I found in fedora come from systemd-udev and cryptsetup-ssh-token. But doesn't look like there's anything special besides dropping an .so, that this seems fine.


Issues:

+ License: needs to contain the condensed output of LICENSE.dependencies, basically what was done for previous rust crate review. Can use `license-validate` to double check your License: string.

+ use %{__cc} instead of gcc

+ big one that needs testing: the default fedora build flags aren't used. see `rpm --eval '%{build_cflags}'` and `rpm --eval '%{build_ldflags}'`. Possibly some of those will conflict with the special flags you need for building the .so, but append additional options as needed to get the output working.

best IMO for packaging would fix the Makefile up to be well behaved, so that this just works:

%set_build_flags
%make_build YOUR_TARGET_NAME

(and possible %make_install for the %install section too)

Comment 2 Matias Ezequiel Vara Larsen 2026-08-03 16:39:25 UTC
Spec URL: https://download.copr.fedorainfracloud.org/results/matiasv/libcryptsetup-token-kbs/fedora-rawhide-x86_64/10807863-libcryptsetup-token-kbs/libcryptsetup-token-kbs.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/matiasv/libcryptsetup-token-kbs/srpm-builds/10807863/libcryptsetup-token-kbs-2.0.0-1.fc37.src.rpm

Description:
LUKS2 external token plugin that unlocks encrypted volumes via TEE
attestation against a Key Broker Service (KBS). Tested with Intel TDX
but compatible with any TEE supported by trustee-attester.
Also ships repart-kbs-helper, a first-boot attestation helper used by
systemd-repart to obtain the LUKS encryption key.

Upstream: https://github.com/MatiasVara/libcryptsetup-token-kbs

License: GPL-3.0-or-later

Successful Copr build: https://copr.fedorainfracloud.org/coprs/matiasv/libcryptsetup-token-kbs/builds/

Fedora Account: matiasv

I am the upstream maintainer of this project.

Comment 3 Fedora Review Service 2026-08-03 16:46:49 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10807889
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2509218-libcryptsetup-token-kbs/fedora-rawhide-x86_64/10807889-libcryptsetup-token-kbs/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 4 Cole Robinson 2026-08-04 22:45:46 UTC
Looks good to me now, setting fedora-review+

Comment 5 Fedora Admin user for bugzilla script actions 2026-08-07 08:52:49 UTC
The Pagure repository was created at https://src.fedoraproject.org/rpms/libcryptsetup-token-kbs
Monitoring:
Anitya project is accessible by this link 
`https://release-monitoring.org/project/391651`
 you can modify it manually.
Package wasn't created in Anitya, reason: `Bad Request, some necessary arguments were not provided.`.


Note You need to log in before you can comment on or make changes to this bug.