Switch to new μpkg package format

.github/workflows/release.yaml

@@ -6,13 +6,15 @@ on:
     tags: [ 'v*' ]
 
 jobs:
-  create-release:
+  release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
     - id: version
       uses: orbit-online/image-version@v0.9.1
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Set up buildx
       uses: docker/setup-buildx-action@v2
     - name: Login to docker hub
@@ -29,3 +31,4 @@ jobs:
         build-args: |
           "BUILD_TOOL=github"
           "BUILT_BY=${{ github.actor }}"
+    - uses: orbit-online/upkg-release@v1

.gitignore

@@ -1 +1 @@
-/.upkg/
+/.upkg

Dockerfile

@@ -8,6 +8,11 @@ ENV STEPPATH=
 RUN rm -rf /home/step
 RUN apk --no-cache add su-exec bash jq p11-kit-server gnutls-utils openssl
 
+RUN bash -ec 'src=$(wget -qO- https://raw.githubusercontent.com/orbit-online/upkg/v0.14.0/upkg.sh); \
+shasum -a 256 -c <(printf "8312d0fa0e47ff22387086021c8b096b899ff9344ca8622d80cc0d1d579dccff  -") <<<"$src"; \
+set - install -g orbit-online/upkg@v0.14.0; eval "$src"'
+RUN mkdir /usr/local/lib/step-wrapper
+
 COPY --chmod=755 step-wrapper.sh /usr/local/bin/step-wrapper
 COPY --chmod=755 entrypoint.sh /usr/local/bin/entrypoint.sh
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Orbit Online A/S
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -11,11 +11,7 @@ under `$PWD` will work.
 
 ## Installation
 
-With [μpkg](https://github.com/orbit-online/upkg)
-
-```
-upkg install -g orbit-online/smallstep-wrapper@<VERSION>
-```
+See [the latest release](https://github.com/orbit-online/smallstep-wrapper/releases/latest) for instructions.
 
 ## Environment variables
 

step.sh → bin/step

@@ -4,7 +4,10 @@ step() {
   set -eo pipefail; shopt -s inherit_errexit
   local pkgroot; pkgroot=$(dirname "$(realpath "${BASH_SOURCE[0]}")")
   PATH=$("$pkgroot/.upkg/.bin/path_prepend" "$pkgroot/.upkg/.bin")
-  source "$pkgroot/.upkg/orbit-online/records.sh/records.sh"
+  # shellcheck disable=SC1091
+  source "$pkgroot/.upkg/records.sh/records.sh"
+  # shellcheck disable=SC1091
+  source "$pkgroot/.upkg/collections.sh/collections.sh"
   checkdeps docker jq
 
   : "${STEP_URL:?"\$STEP_URL is required"}"
@@ -17,18 +20,20 @@ step() {
   local p11_kit_socket="$XDG_RUNTIME_DIR/p11-kit/pkcs11"
   if [[ -S "$p11_kit_socket" ]] && ! ${STEP_SKIP_P11_KIT:-false}; then
     checkdeps p11tool
-    local yubikey_serials=()
-    readarray -t yubikey_serials < <(p11tool --list-token-urls | grep manufacturer=Yubico%20%28www.yubico.com%29 | sed 's/.*;serial=\([0-9]\+\);.*/\1/g')
-    [[ ${#yubikey_serials[@]} -gt 0 ]] || fatal "No YubiKeys found"
-    [[ ${#yubikey_serials[@]} -eq 1 ]] || fatal "%d YubiKeys detected, remove all but one" "${#yubikey_serials[@]}"
+    local token_urls=() token_filter=(
+      'manufacturer=Yubico%20%28www.yubico.com%29'
+      'model=Intel.*serial=0000000000000000;token=.\+'
+    )
+    readarray -t token_urls < <(p11tool --list-token-urls | grep "$(join_by $'\n' "${token_filter[@]}")")
+    [[ ${#token_urls[@]} -gt 0 ]] || fatal "No smartcards found"
+    [[ ${#token_urls[@]} -eq 1 ]] || fatal "%d smartcards detected, remove all but one" "${#token_urls[@]}"
     if [[ -z $PIN ]]; then
       export PIN
       # shellcheck disable=2059
-      PIN=$(pinentry-wrapper "PIN" --desc "$(printf -- "${STEP_PIN_DESC:-"Smallstep CLI requires access to your YubiKey in order to authenticate with step-ca
-YubiKey #%s"}" "${yubikey_serials[0]}")")
+      PIN=$(pinentry-wrapper "PIN" --desc "$(printf -- "${STEP_PIN_DESC:-"Smallstep CLI requires access to your smartcard in order to authenticate with step-ca"}" "${token_urls[0]}")")
     fi
     additional_opts+=(
-      -e "YKSERIAL=${yubikey_serials[0]}" -e PIN
+      -e "TOKEN_URL=${token_urls[0]}" -e PIN
       -v "$p11_kit_socket:$p11_kit_socket"
     )
   elif ${STEP_SKIP_P11_KIT:-false}; then

step-wrapper.sh

@@ -14,14 +14,29 @@ step_wrapper() {
   fi
   local config config_path=$STEPPATH/config/defaults.json
   config=$(cat "$config_path")
-  if [[ -n $YKSERIAL ]]; then
-    config=$(jq --arg serial "${YKSERIAL:?}" --arg pin "${PIN:?}" \
-      '.kms="pkcs11:module-path=/usr/lib/pkcs11/p11-kit-client.so;token=YubiKey%20PIV%20%23\($serial)?pin-value=\($pin)" |
-      .["x5c-cert"]="pkcs11:token=YubiKey%20PIV%20%23\($serial);object=X.509%20Certificate%20for%20PIV%20Authentication" |
-      .["x5c-key"]="pkcs11:token=YubiKey%20PIV%20%23\($serial);object=Private%20key%20for%20PIV%20Authentication"' <<<"$config")
+  if [[ -n $TOKEN_URL ]]; then
+    case "$(get_pkcs11_url_val model <<<"${TOKEN_URL:?}")" in
+      YubiKey*)
+        config=$(jq --arg token_url "$TOKEN_URL" --arg pin "${PIN:?}" \
+          '.kms="pkcs11:module-path=/usr/lib/pkcs11/p11-kit-client.so;\($token_url)?pin-value=\($pin)" |
+          .["x5c-cert"]="pkcs11:\($token_url);object=X.509%20Certificate%20for%20PIV%20Authentication" |
+          .["x5c-key"]="pkcs11:\($token_url);object=Private%20key%20for%20PIV%20Authentication"' <<<"$config")
+        ;;
+      Intel*)
+        config=$(jq --arg token_url "$TOKEN_URL" --arg pin "${PIN:?}" \
+          '.kms="pkcs11:module-path=/usr/lib/pkcs11/p11-kit-client.so;\($token_url)?pin-value=\($pin)" |
+          .["x5c-cert"]="pkcs11:\($token_url);object=PIV;" |
+          .["x5c-key"]="pkcs11:\($token_url);object=PIV;type=private"' <<<"$config")
+        ;;
+    esac
   fi
   printf '%s\n' "$config" >"$config_path"
   exec step "$@"
 }
 
+get_pkcs11_url_val() {
+  local field=$1
+  sed 's/^pkcs11:\(.*;\)\?\('"$field"'=\([^;]\+\)\)\?\(;.*\)\?$/\3/g' | grep -v '^pkcs11:'
+}
+
 step_wrapper "$@"

upkg.json

@@ -1,12 +1,29 @@
 {
-  "dependencies": {
-    "orbit-online/checkdeps": "v1.0.2",
-    "orbit-online/records.sh": "v0.9.5",
-    "orbit-online/pinentry-wrapper": "v0.10.4",
-    "orbit-online/image-version": "v0.9.1",
-    "orbit-online/path-tools": "v0.2.1"
-  },
-  "commands": {
-    "step": "step.sh"
-  }
+  "name": "smallstep-wrapper",
+  "dependencies": [
+    {
+      "tar": "https://github.com/orbit-online/image-version/releases/download/v2.0.0/image-version.tar.gz",
+      "sha256": "b5f1c581303221b05b6dc5efe583eb6f43a0b3e6869f2bcf337b8d71e7ff771c"
+    },
+    {
+      "tar": "https://github.com/orbit-online/pinentry-wrapper/releases/download/v1.0.0/pinentry-wrapper.tar.gz",
+      "sha256": "1dfa09636a311edd8c7e7973d62e986a1f46c10648bfdcfc95090b9ada7b104a"
+    },
+    {
+      "tar": "https://github.com/orbit-online/checkdeps/releases/download/v2.0.0/checkdeps.tar.gz",
+      "sha256": "0b7ebb5e60163ccbd4966527f72c0e30f8cb183de6057ddad72b4e6b83ae1637"
+    },
+    {
+      "tar": "https://github.com/orbit-online/collections.sh/releases/download/v1.0.0/collections.sh.tar.gz",
+      "sha256": "ca741323c2bd77f547fa9aea41050d85dfc5f1ce3ff42f73b7a12f7c90b9be2e"
+    },
+    {
+      "tar": "https://github.com/orbit-online/records.sh/releases/download/v1.0.0/records.sh.tar.gz",
+      "sha256": "0469f15f5b689cb29b30f2a3b233c61856eb209fc50c74ef141120bbf70697f1"
+    },
+    {
+      "tar": "https://github.com/orbit-online/path-tools/releases/download/v1.0.0/path-tools.tar.gz",
+      "sha256": "2ae2a98714aa81e2142b749dac9ecdb61e050e66bf8bd33aef0fccb2ce66c84b"
+    }
+  ]
 }