Support Possible Mandatory 2FA Rollout

thebeanogamer commented

2026-06-18 15:43:11 +00:00

Member

FESCO are again discussing making 2FA mandatory for contributors (https://pagure.io/fesco/issue/3618) in light of recent events.

If they ahead with this (and I hope they do), we need to figure out what the Security SIG can do.

I've got some ideas around making Hardware 2FA easier through documentation and support in fkinit, but more suggestions are welcomed.

FESCO are again discussing making 2FA mandatory for contributors (<https://pagure.io/fesco/issue/3618>) in light of recent events. If they ahead with this (and I hope they do), we need to figure out what the Security SIG can do. I've got some ideas around making Hardware 2FA easier through documentation and support in `fkinit`, but more suggestions are welcomed.

py0xc3 commented

2026-06-18 19:06:29 +00:00

Owner

Relevant might be a point of @zbyszek :

I think we should tell people to always enroll at least two tokens, e.g. a hardware token and freeotp on the phone, or maybe even three.

I tried to enroll a Nitrokey today, and it works, but https://docs.nitrokey.com/software/nitropy/ is not packaged for Fedora. It'd be nice to add that.

Also, we should have good instructions on enrollment for Yubikeys, Nitrokeys, Freeotp, and whatever other popular stuff is out there.

Given that I remember that there had been in the past severe security issues with some implementations of TOTP that were available in various app stores and such (from unmaintained code up to bad practices such as insecure crypto), one might add that there is some use in maintaining a list of suggested apps. That said, I would expect that proven packagers would not need us for identifying proper apps. But I just had that thought in mind when reading this and thought its worth to be mentioned :P

Relevant might be a point of @zbyszek : > I think we should tell people to always enroll at least two tokens, e.g. a hardware token and freeotp on the phone, or maybe even three. > > I tried to enroll a Nitrokey today, and it works, but https://docs.nitrokey.com/software/nitropy/ is not packaged for Fedora. It'd be nice to add that. > > Also, we should have good instructions on enrollment for Yubikeys, Nitrokeys, Freeotp, and whatever other popular stuff is out there. Given that I remember that there had been in the past severe security issues with some implementations of TOTP that were available in various app stores and such (from unmaintained code up to bad practices such as insecure crypto), one might add that there is some use in maintaining a list of suggested apps. That said, I would expect that proven packagers would not need us for identifying proper apps. But I just had that thought in mind when reading this and thought its worth to be mentioned :P

py0xc3 commented

2026-06-18 19:17:00 +00:00

Owner

I tried to enroll a Nitrokey today, and it works, but https://docs.nitrokey.com/software/nitropy/ is not packaged for Fedora. It'd be nice to add that.

Surely a talk to the packagers of the other dependencies would be appropriate, but if that proves to work out, it would be the python packages ensurepath and pynitrokey I think.

https://github.com/Nitrokey/pynitrokey

https://github.com/knoxell/ensurepath

Licensing seems to fit.

> I tried to enroll a Nitrokey today, and it works, but https://docs.nitrokey.com/software/nitropy/ is not packaged for Fedora. It'd be nice to add that. Surely a talk to the packagers of the other dependencies would be appropriate, but if that proves to work out, it would be the python packages `ensurepath` and `pynitrokey` I think. https://github.com/Nitrokey/pynitrokey https://github.com/knoxell/ensurepath Licensing seems to fit.

👍 1

thebeanogamer commented

2026-06-18 19:24:12 +00:00

Author

Member

I’ve got a nitrokey I bought for work but never ended up using. If I get some time, I could try and package their tools. I recall us already having some of them in repos.

👍 1

py0xc3 commented

2026-06-19 09:01:39 +00:00

Owner

I was thinking something similar. I have not actively maintained any package for ~15 years (and never for Fedora), and more recently that has proven occasionally as a noteworthy limitation, and whenever the issue comes up, the entry barrier is too high to go through the whole process at the very moment. Might be a good opportunity to smoothly get back. At first glance, the packages look realistic.

I have to verify something in advance to be sure (done ~ next week), but if it works out, I can help if that's useful. We can have a chat if you want concerning maintaining, co-maintaining, etc.

I was thinking something similar. I have not actively maintained any package for ~15 years (and never for Fedora), and more recently that has proven occasionally as a noteworthy limitation, and whenever the issue comes up, the entry barrier is too high to go through the whole process at the very moment. Might be a good opportunity to smoothly get back. At first glance, the packages look realistic. I have to verify something in advance to be sure (done ~ next week), but if it works out, I can help if that's useful. We can have a chat if you want concerning maintaining, co-maintaining, etc.

py0xc3 commented

2026-06-19 09:40:16 +00:00

Owner

Update: https://github.com/knoxell/ensurepath is no dependency. It's only about https://github.com/Nitrokey/pynitrokey

py0xc3 commented

2026-06-19 16:05:06 +00:00

Owner

I have started to "play" with a spec file and with the python guidelines. Don't take the file too seriously, it's neither ready nor best practice yet (especially the BuildRequires: are mostly to quick & dirty means to identify what is already somewhere provided and I suspect there are also more errors contained later). Based on the install documentation of NitroKey, I assume pipx auto-resolves dependencies and auto-installs the additional python packages required, which in the context explains to me the error I currently get.

I assume the following error on building the rpm indicates what is missing on Fedora (or is in a package with an unrelated name):

error: Failed build dependencies:
        (python3dist(hidapi) < 0.15~~ with python3dist(hidapi) >= 0.14) is needed by pynitrokey-0.12.3-1.fc44.noarch
        (python3dist(nethsm) < 3~~ with python3dist(nethsm) >= 2.1.1) is needed by pynitrokey-0.12.3-1.fc44.noarch
        (python3dist(nitrokey) < 0.5~~ with python3dist(nitrokey) >= 0.4.2) is needed by pynitrokey-0.12.3-1.fc44.noarch
        (python3dist(nkdfu) < 0.3~~ with python3dist(nkdfu) >= 0.2) is needed by pynitrokey-0.12.3-1.fc44.noarch
        (python3dist(tlv8) < 0.11~~ with python3dist(tlv8) >= 0.10) is needed by pynitrokey-0.12.3-1.fc44.noarch
        python3dist(hidapi) = 0.14^post2 is needed by pynitrokey-0.12.3-1.fc44.noarch
Wrote: /home/py0xc3/rpmbuild/SRPMS/pynitrokey-0.12.3-1.fc44.buildreqs.nosrc.rpm

Seems a good time to stop for today :) I might work more on this in the next days to get back to the topic. But feel free to let me know if someone can see at first glance that my assumption of the error might be wrong or so.

Spec file draft attached (spec files are not allowed for upload on forge, so I just added .csv, but it's a spec file, just remove the .csv from the end). Just to avoid double work etc. No urge to anyone to work on this ;)

I have started to "play" with a spec file and with the python guidelines. Don't take the file too seriously, it's neither ready nor best practice yet (especially the *BuildRequires:* are mostly to quick & dirty means to identify what is already somewhere provided and I suspect there are also more errors contained later). Based on the install documentation of NitroKey, I assume pipx auto-resolves dependencies and auto-installs the additional python packages required, which in the context explains to me the error I currently get. I assume the following error on building the rpm indicates what is missing on Fedora (or is in a package with an unrelated name): ``` error: Failed build dependencies: (python3dist(hidapi) < 0.15~~ with python3dist(hidapi) >= 0.14) is needed by pynitrokey-0.12.3-1.fc44.noarch (python3dist(nethsm) < 3~~ with python3dist(nethsm) >= 2.1.1) is needed by pynitrokey-0.12.3-1.fc44.noarch (python3dist(nitrokey) < 0.5~~ with python3dist(nitrokey) >= 0.4.2) is needed by pynitrokey-0.12.3-1.fc44.noarch (python3dist(nkdfu) < 0.3~~ with python3dist(nkdfu) >= 0.2) is needed by pynitrokey-0.12.3-1.fc44.noarch (python3dist(tlv8) < 0.11~~ with python3dist(tlv8) >= 0.10) is needed by pynitrokey-0.12.3-1.fc44.noarch python3dist(hidapi) = 0.14^post2 is needed by pynitrokey-0.12.3-1.fc44.noarch Wrote: /home/py0xc3/rpmbuild/SRPMS/pynitrokey-0.12.3-1.fc44.buildreqs.nosrc.rpm ``` Seems a good time to stop for today :) I might work more on this in the next days to get back to the topic. But feel free to let me know if someone can see at first glance that my assumption of the error might be wrong or so. Spec file draft attached (spec files are not allowed for upload on forge, so I just added .csv, but it's a spec file, just remove the .csv from the end). Just to avoid double work etc. No urge to anyone to work on this ;) \<file obsoleted\>

py0xc3 commented

2026-06-20 14:18:57 +00:00

Owner

Ok, tested in pipx. Never used that before. pipx does indeed get all these packages. Obviously it also gets those we already have on Fedora for its env from pypi (so more than in the error message).

So beyond pynitrokey, we need to package those mentioned in the error log when we want to avoid dependency on pipx (also, I didn't check yet if they are provided already indirectly through another package).

It could be an easy question for an experienced python packager, but I would leave open for now if we should package all that from PyPI sources or upstream sources. We might discuss that in the channel or so.

Ok, tested in pipx. Never used that before. pipx does indeed get all these packages. Obviously it also gets those we already have on Fedora for its env from pypi (so more than in the error message). So beyond pynitrokey, we need to package those mentioned in the error log when we want to avoid dependency on pipx (also, I didn't check yet if they are provided already indirectly through another package). It could be an easy question for an experienced python packager, but I would leave open for now if we should package all that from PyPI sources or upstream sources. We might discuss that in the channel or so.

thebeanogamer commented

2026-06-20 14:24:10 +00:00

Author

Member

Already on it https://github.com/thebeanogamer/python3-pynitrokey, https://copr.fedorainfracloud.org/coprs/thebeanogamer/python3-pynitrokey/packages/. Should hopefully have them all submitted for review today.

🎉 1

thebeanogamer commented

2026-06-21 17:35:30 +00:00

Author

Member

Package submissions are all in:

oath - https://bugzilla.redhat.com/show_bug.cgi?id=2491197
nkdfu - https://bugzilla.redhat.com/show_bug.cgi?id=2491198
nethsm - https://bugzilla.redhat.com/show_bug.cgi?id=2491200
nitrokey - https://bugzilla.redhat.com/show_bug.cgi?id=2491201
pynitrokey - https://bugzilla.redhat.com/show_bug.cgi?id=2491207

As far as I can tell, the packaged version of nitropy (from pynitrokey) is working with my NitroKeys.

Package submissions are all in: * oath - https://bugzilla.redhat.com/show_bug.cgi?id=2491197 * nkdfu - https://bugzilla.redhat.com/show_bug.cgi?id=2491198 * nethsm - https://bugzilla.redhat.com/show_bug.cgi?id=2491200 * nitrokey - https://bugzilla.redhat.com/show_bug.cgi?id=2491201 * pynitrokey - https://bugzilla.redhat.com/show_bug.cgi?id=2491207 As far as I can tell, the packaged version of nitropy (from pynitrokey) is working with my NitroKeys.

🎉 1

py0xc3 commented

2026-06-22 13:18:47 +00:00

Owner

Thanks, great job :)

Rows
Columns

Support Possible Mandatory 2FA Rollout #11