Support for Yubikey-like devices in containers/boxes

[liljenstolpe]

One of the blockers in an immutable OS is the isolation between host and container when using a hardware-based cryptographic token, such as a Yubikey for various functions. The problem is that that token needs to be shared between both the host and various containers for various purposes, such as:

• web-based FIDO auth
• GPG operations
• SSH operations
• passwd / gopass etc. password vault operations
• etc.

Some of these naturally sit in containers/boxes/flatpacks, others sit in the host. However, smartcard daemons usually try and grab exclusive lock on these tokens, making shared access difficult if not impossible. It can be done, as some VM environments have this working - but it is an open issue in ChromeOS for years now, and is a currently blocking issue in silverblue and here.

I mentioned this to @castrojo, and based on that conversation, am sending 4 yubikeys to the devs to start playing with. Happy to discuss potential avenues.

[castrojo]

Thanks Chris for taking care of the hardware, @EyeCantCU and @KyleGospo will be dipping into this!

[liljenstolpe]

Some suggested use/test cases

1. passwd or gopass repo on host with helper installed on chrome or firefox installed via flatpack
   remote repo for passwords via github / gitlab with SSH keys via yubikey
   1. GPG private key for password repo via yubikey
   2. Try and use the helper to auto-fill a password
   3. Try and use the helper to generate a password and get the remote repo updated
2. Use the yubikey on the host to do GPG and/or SSH operations and then do a FIDO operation via a browser installed via flatpack
3. Use the yubikey to do a GPG operation on the host and then in a box. Repeat with SSH operations.

[liljenstolpe]

This isn't necessarily an issue with ublue-os - but it is an issue with the model we are pursuing that I think we need to sort, either directly, or suggest solutions to other upstream projects.

[liljenstolpe]

Did the keys arrive?

[KyleGospo]

Nothing here yet, we have some ideas of how to get them working though.

[EyeCantCU]

Thank you so much for sending these out our way. Received mine and am already at work on things