Bug 2565411 - Review Request: ssh-tpm-agent - SSH agent allowing the use of TPM-backed keys
Summary: Review Request: ssh-tpm-agent - SSH agent allowing the use of TPM-backed keys
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody's working on this, feel free to take it
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-02 21:39 UTC by Alex Haydock
Modified: 2026-11-02 23:39 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Alex Haydock 2026-11-02 21:39:42 UTC
Spec URL: https://raw.githubusercontent.com/alexhaydock/ssh-tpm-agent-fedora/refs/heads/main/ssh-tpm-agent.spec
SRPM URL: https://github.com/alexhaydock/ssh-tpm-agent-fedora/raw/refs/heads/main/ssh-tpm-agent-0.9.0-1.fc46.src.rpm
Description: An ssh-agent compatible agent that allows keys to be created by the Trusted Platform Module (TPM) for authentication towards ssh servers.
Fedora Account System Username: alexhaydock

Proposing to add ssh-tpm-agent (https://github.com/Foxboron/ssh-tpm-agent) to Fedora's package repository. This package allows creating and enrolling SSH keys into a system's TPM module for use in authenticating to SSH servers.

I am part of the `packager` group so don't require sponsorship but this is my first attempt at packaging a Golang package and learning the vendoring process. There were some quirks here that I hope I've addressed appropriately.

The upstream google/go-tpm-tools dependency uses vendored Microsoft code that needs compiling with CGO (https://github.com/google/go-tpm-tools/tree/main/simulator/ms-tpm-20-ref). I'm not clear that the `simulator` module is actually used by the downstream `ssh-tpm-agent` package, but there's no build macro to disable it that I can find so I have manually vendored the upstream code. (It's BSD 3-Clause licensed to that's provided for in the License section properly). Not sure if my approach is right there.

Edit: The upstream application also ships a set of systemd units, which are installed as per the instructions using a CLI command. I'm unsure whether I should pull these out as part of the %install section and put them in the systemd service unit vendor directories under /usr/lib/systemd but it seems like it might be a good option.


Note You need to log in before you can comment on or make changes to this bug.