bug#45613: U2F does not work in IceCat

bug#45613: U2F does not work in IceCat

[John Doe via Bug reports for GNU Guix]

I've been trying to get U2F to work in IceCat without success with the Nitrokey FIDO2 and FIDO U2F devices. To test 2 websites were used: vault.bitwarden.com and u2f.bin.coffee .

For vault.bitwarden.com, after entering the password, the following error popup appears repeatedly:
"An error has occurred. U2F Error: 1"

For u2f.bin.coffee, when clicking the U2F Register button, the following error appears:
"
Sending request with appId: https://u2f.bin.coffee
{
  "version": "U2F_V2",
  "challenge": "pyvBtAPUygH0mZg4_thmdo_Ltnk"
}

Got response:
{
  "errorCode": 1
}

[FAIL] Imported credential public key
Failures: 1 TODOs: 0
"
A similar error appears for the U2F Sign button.

The same websites work without trouble in ungoogled-chromium as well as Firefox installed in Flatpak and run with the options "flatpak run --user --device=all org.mozilla.firefox".

I have installed the pam-u2f package which includes the libu2f-server and libu2f-host packages.

In /etc/config.scm I have the following configuration to add udev rules for the Nitrokey device:

"
(use-modules (guix download)
             (guix packages)
(use-service-modules security-token)
;; ...
(define %nitrokey-udev-rule
  (file->udev-rule
   "41-nitrokey.rules"
   (let ((version "2019"))
     (origin
      (method url-fetch)
      (uri "https://raw.githubusercontent.com/Nitrokey/libnitrokey/master/data/41-nitrokey.rules")
      (sha256
       (base32 "1j8x9i2ypr6jadpmjbcffk7rjqd3a4x0krqx5hqk7bfgsxzima23"))))))

;; ref. https://lists.gnu.org/archive/html/help-guix/2019-07/msg00051.html
(define %updated-desktop-services
  (modify-services
   %desktop-services
   (udev-service-type config =>
                      (udev-configuration
                       (inherit config)
                       (rules (append (udev-configuration-rules config)
                                      (list %nitrokey-udev-rule)))))))

(operating-system
 ;; ...
 (services
  (append
   (list
    (service xfce-desktop-service-type)
    (set-xorg-configuration
     (xorg-configuration
      (keyboard-layout keyboard-layout))))
   (list
    ;; ...
    (service pcscd-service-type))
   %updated-desktop-services))
 ;; ...
"

Please let me know if there is any additional information I can provide.

bug#45613: (No Subject)

[John Doe via Bug reports for GNU Guix]

Forgot to mention in the original report: The issue is very similar to the following bug: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=38341

bug#45613: (no subject)

[Raphaël Mélotte]

To me it looks like this bug is now solved.

I remember having the same problem months ago, but today it seems to work fine 
(on a foreign distro).

Guix:
---
   guix 6eded1a
     repository URL: https://git.savannah.gnu.org/git/guix.git
     branch: master
     commit: 6eded1a04186e3118b293486b038c994e05efedf
---

Icecat:
---
icecat                  78.14.0-guix0-preview1  out 
/gnu/store/xwzp1lj8b429yc9nbx3nwy1ia9r1sr2x-icecat-78.14.0-guix0-preview1
---

It worked both with https://u2f.bin.coffee/ and other services.

Note that I'm "cheating" a little bit though: I'm using an emulated device, not 
an actual USB device (but the same emulated device previously didn't work with a 
Guix-built icecat).

bug#45613: U2F does not work in IceCat

[Maxim Cournoyer]

Hi,

Raphaël Mélotte <raphael.melotte@mind.be> writes:

> To me it looks like this bug is now solved.
>
> I remember having the same problem months ago, but today it seems to
> work fine (on a foreign distro).
>
> Guix:
> ---
>   guix 6eded1a
>     repository URL: https://git.savannah.gnu.org/git/guix.git
>     branch: master
>     commit: 6eded1a04186e3118b293486b038c994e05efedf
> ---
>
> Icecat:
> ---
> icecat                  78.14.0-guix0-preview1  out
> /gnu/store/xwzp1lj8b429yc9nbx3nwy1ia9r1sr2x-icecat-78.14.0-guix0-preview1
> ---
>
> It worked both with https://u2f.bin.coffee/ and other services.
>
> Note that I'm "cheating" a little bit though: I'm using an emulated
> device, not an actual USB device (but the same emulated device
> previously didn't work with a Guix-built icecat).

Thanks for the heads-up.

Closing!

-- 
Thanks,
Maxim