Install libfido2 on macOS

[avalci]

How to build and install libfido2 from source and its dependencies on macos sequoia 15 on Apple Sillicon M2?

[LDVG]

The build process is identical to what we have outlined in the README. Our dependencies are libcbor, openssl, and zlib.

[LDVG]

It's unlikely that the end result will be any different using the above method; pkg-config performs the same steps for you.

I'm not a MacOS user so my knowledge is fairly limited here. Not searching /usr/local by default appears to be a security feature.

Note that to get security key support in OpenSSH, there's a further set of steps you'll have to take when libfido2 itself functions correctly. Specifically, you'll have to build and setup the middleware. There's a a lengthy thread on the topic here: #464 (comment).

[avalci]

I decided to use the script from the .actions folder.
There, I saw that there is a dependency on pkg-config and scan-build.
I downloaded scan-build from this site here

➜ libfido2 git:(main) ✗ pkg-config --version
0.29.2
➜ libfido2 git:(main) ✗ scan-build --help
...
ANALYZER BUILD: checker-279 (2016-11-14 15:34:09)
...

I needed to make a small modification to the script, since I don't use brew.sh...

PKG_CONFIG_PATH="/usr/local/lib/pkgconfig/"
SCAN="/usr/local/bin/scan-build"

The result was...

...
[100%] Built target man_symlink_gzip
[100%] Built target man_symlink_html
/Library/Developer/CommandLineTools/usr/bin/make  -f man/CMakeFiles/man.dir/build.make man/CMakeFiles/man.dir/depend
cd /Users/avalci/git/libfido2/build-Debug && /Applications/CMake.app/Contents/bin/cmake -E cmake_depends "Unix Makefiles" /Users/avalci/git/libfido2 /Users/avalci/git/libfido2/man /Users/avalci/git/libfido2/build-Debug /Users/avalci/git/libfido2/build-Debug/man /Users/avalci/git/libfido2/build-Debug/man/CMakeFiles/man.dir/DependInfo.cmake
/Library/Developer/CommandLineTools/usr/bin/make  -f man/CMakeFiles/man.dir/build.make man/CMakeFiles/man.dir/build
make[2]: Nothing to be done for `man/CMakeFiles/man.dir/build'.
[100%] Built target man
/Applications/CMake.app/Contents/bin/cmake -E cmake_progress_start /Users/avalci/git/libfido2/build-Debug/CMakeFiles 0
scan-build: 1 bug found.
scan-build: Run 'scan-view /var/folders/j_/0jt2ljyj0x9fyfbpwqgvt0w00000gn/T/scan-build-2024-11-13-093127-6685-1' to examine bug reports.
scan-build: The analyzer encountered problems on some source files.
scan-build: Preprocessed versions of these sources were deposited in '/var/folders/j_/0jt2ljyj0x9fyfbpwqgvt0w00000gn/T/scan-build-2024-11-13-093127-6685-1/failures'.
scan-build: Please consider submitting a bug report using these files:
scan-build:   http://clang-analyzer.llvm.org/filing_bugs.html

[LDVG]

You don't need scan-build. Build as you normally would instead.

[avalci]

#!/bin/sh -eux
export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig/"
for T in Debug Release; do
	mkdir build-$T
	(cd build-$T && cmake -DCMAKE_BUILD_TYPE=$T ..)
	make -C build-$T man_symlink_html
	make -C build-$T regress
	sudo make -C build-$T install
done

Result...

/Applications/CMake.app/Contents/bin/ctest --output-on-failure
Test project /Users/avalci/git/libfido2/build-Debug
    Start 1: regress_assert
1/8 Test #1: regress_assert ...................Subprocess aborted***Exception:   0.75 sec
dyld[22515]: Library not loaded: libcbor.0.11.dylib
  Referenced from: <F721DDF3-0D02-3FC3-B0FD-2740B323EDDE> /Users/user/git/libfido2/build-Debug/regress/regress_assert
  Reason: tried: 'libcbor.0.11.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OSlibcbor.0.11.dylib' (no such file), 'libcbor.0.11.dylib' (no such file), '/Users/user/git/libfido2/build-Debug/regress/libcbor.0.11.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/Users/user/git/libfido2/build-Debug/regress/libcbor.0.11.dylib' (no such file), '/Users/user/git/libfido2/build-Debug/regress/libcbor.0.11.dylib' (no such file)
...
0% tests passed, 8 tests failed out of 8

Total Test time (real) =   1.99 sec

The following tests FAILED:
	  1 - regress_assert (Subprocess aborted)
	  2 - regress_cred (Subprocess aborted)
	  3 - regress_dev (Subprocess aborted)
	  4 - regress_eddsa (Subprocess aborted)
	  5 - regress_es256 (Subprocess aborted)
	  6 - regress_es384 (Subprocess aborted)
	  7 - regress_rs256 (Subprocess aborted)
	  8 - regress_compress (Subprocess aborted)
Errors while running CTest
make[3]: *** [regress] Error 8
make[2]: *** [regress/CMakeFiles/regress.dir/all] Error 2
make[1]: *** [regress/CMakeFiles/regress.dir/rule] Error 2
make: *** [regress] Error 2

Libcbor problem?

➜  ~ ls -l /usr/local/lib/libc*
-rwxr-xr-x@ 1 root  wheel    97736 Nov  9 01:56 /usr/local/lib/libcbor.0.11.0.dylib
lrwxr-xr-x@ 1 root  wheel       20 Oct 30 23:57 /usr/local/lib/libcbor.0.11.dylib -> libcbor.0.11.0.dylib
-rw-r--r--@ 1 root  wheel   175752 Oct 30 23:47 /usr/local/lib/libcbor.a
lrwxr-xr-x@ 1 root  wheel       18 Oct 30 23:57 /usr/local/lib/libcbor.dylib -> libcbor.0.11.dylib
-rwxr-xr-x@ 1 root  wheel  4400384 Oct  9 00:49 /usr/local/lib/libcrypto.3.dylib
-rw-r--r--@ 1 root  wheel  7643688 Oct  9 00:49 /usr/local/lib/libcrypto.a
lrwxr-xr-x@ 1 root  wheel       17 Oct  9 00:49 /usr/local/lib/libcrypto.dylib -> libcrypto.3.dylib

[LDVG]

I'm assuming this is still libcbor installed through a make install. Did you specify --DCMAKE_INSTALL_PREFIX="/usr/local" DCMAKE_INSTALL_NAME_DIR="/usr/local/lib" like #274 (comment) suggests? (I'd argue this is mostly a toolchain issue rather than a libcbor or libfido2 issue...).

otool -l may also be useful in diagnosing the installed libraries.