fix(vm-e2e): ship pamu2fcfg subpackage + unblock homectl FIDO2 create - #102
Merged
foil-copy-overrate merged 1 commit intoJul 25, 2026
Merged
Conversation
Root causes from run 30134754109 / job 89616319429 (yubiOS VM e2e, arm64): 1. tests/vm/test-fido2-enrollment.sh step 4 hard-failed with "pamu2fcfg missing from image": mkosi.conf and mkosi.conf.d/test/mkosi.conf list the Packages= pam-u2f RPM, but Fedora Rawhide splits the pamu2fcfg CLI into its own pamu2fcfg subpackage (pam-u2f only ships the PAM module). Added pamu2fcfg to both Packages= lists so the built image actually has the binary the enrollment test requires. 2. tests/vm/test-luks-fido2-ci.sh systemd-homed leg (homectl create citest --storage=luks --fido2-device=auto) timed out after 5 minutes with "Password too weak: No password supplied" -- NEWPASSWORD= (empty) fails homed password-quality check and homectl falls back to an interactive ask-password prompt that never resolves over a non-interactive SSH command, hanging until the step timeout. Added --enforce-password-policy=no, matching the FIDO2-only (no password) auth model this test actually exercises. Minimal, targeted fixes per PROJECT_RULES.md debugging posture -- no redesign. Relates to BLOCKERS.md B-VM-CTAP2, Linear OMN-48.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause (run 30134754109, job 89616319429, arm64 vm-e2e)
https://github.com/yubi-OS/yubiOS/actions/runs/30134754109/job/89616319429
1. pamu2fcfg missing from the image (test-fido2-enrollment.sh FAIL)
Fedora Rawhide splits pamu2fcfg into its own subpackage; pam-u2f alone only ships the PAM module. Both mkosi.conf (production) and mkosi.conf.d/test/mkosi.conf (CI test profile) listed pam-u2f but not pamu2fcfg. Added the subpackage to both.
2. homectl create hang -> 5-minute step timeout (test-luks-fido2-ci.sh)
Log showed LUKS2 FIDO2 pass cleanly, then homed FIDO2 home-create hit "Password too weak: No password supplied" (from NEWPASSWORD= empty) and the step hung until the 5-minute action timeout instead of failing fast. Added --enforce-password-policy=no since this leg is intentionally password-less / FIDO2-only.
Both are minimal targeted fixes, no workflow/design changes (PROJECT_RULES.md debugging posture). Relates to BLOCKERS.md B-VM-CTAP2 and Linear OMN-48.
Note: the image consumed by this workflow is docker.io/0mniteck/yubios:dev, built+pushed by a separate manual-dispatch workflow. This PR only fixes the source (mkosi package lists + test script); the :dev image needs to be rebuilt and re-pushed for the CI job to actually pick up the pamu2fcfg fix. Jenny -- let me know if you want me to ask you to trigger that dispatch once this merges.