Skip to contentSkip to conversation

package/libpam-pkcs11: new package

PATCH Superseded Waldemar Brodkorb 2 participants 2 messages Oct 20, 2025 – Nov 2, 2025

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Waldemar Brodkorb

author
#0 lore raw

PATCH 1/1 package/libpam-pkcs11: new package

The Linux-PAM login module for X.509 certificate based user login.

https://github.com/OpenSC/pam_pkcs11

Signed-off-by Waldemar Brodkorb <[email protected]>
---
 DEVELOPERS                               |  1 +
 package/Config.in                        |  1 +
 package/libpam-pkcs11/Config.in          | 18 ++++++++++++++++++
 package/libpam-pkcs11/libpam-pkcs11.hash |  2 ++
 package/libpam-pkcs11/libpam-pkcs11.mk   | 18 ++++++++++++++++++
 5 files changed, 40 insertions(+)
 create mode 100755 package/libpam-pkcs11/Config.in
 create mode 100755 package/libpam-pkcs11/libpam-pkcs11.hash
 create mode 100755 package/libpam-pkcs11/libpam-pkcs11.mk
DEVELOPERS +1 -0
index 66199a5b72..8f3ef4fc38 100644
@@ -3407,6 +3407,7 @@ F:	package/asterisk/
 F:	package/evilwm/
 F:	package/fbv/
 F:	package/libjwt/
+F:	package/libpam-pkcs11/
 F:	package/mksh/
 F:	package/ruby/
 F:	package/uclibc/
package/Config.in +1 -0
index 161d61728b..42b9acb807 100644
@@ -2286,6 +2286,7 @@ menu "Other"
 if BR2_PACKAGE_LINUX_PAM
 comment "linux-pam plugins"
 	source "package/libpam-nfc/Config.in"
+	source "package/libpam-pkcs11/Config.in"
 	source "package/libpam-radius-auth/Config.in"
 	source "package/libpam-tacplus/Config.in"
 endif
package/libpam-pkcs11/Config.in new file +18 -0
new file mode 100755
index 0000000000..6678c48ab9
@@ -0,0 +1,18 @@
+config BR2_PACKAGE_LIBPAM_PKCS11
+	bool "libpam-pkcs11"
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on BR2_USE_MMU # pcsc-lite -> fork()
+	depends on !BR2_STATIC_LIBS
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # pcsc-lite -> _Atomic keyword
+	select BR2_PACKAGE_OPENSSL
+	select BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL
+	select BR2_PACKAGE_PCSC_LITE
+	help
+	  The Linux-PAM login module for X.509 certificate based user login.
+
+	  https://github.com/OpenSC/pam_pkcs11
+
+comment "libpam-pkcs11 needs a toolchain w/ threads, dynamic library, gcc >= 4.9"
+	depends on BR2_USE_MMU
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS || \
+		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
package/libpam-pkcs11/libpam-pkcs11.hash new file +2 -0
new file mode 100755
index 0000000000..9ab133f51b
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256 8a853f4e6e136ceecdcffad798570e3d6af2fde08e975656b2dc931989c35aff  pam_pkcs11-0.6.13.tar.gz
package/libpam-pkcs11/libpam-pkcs11.mk new file +18 -0
new file mode 100755
index 0000000000..9947e58e1a
@@ -0,0 +1,18 @@
+################################################################################
+#
+# libpam-pkcs11
+#
+################################################################################
+
+LIBPAM_PKCS11_VERSION = 0.6.13
+LIBPAM_PKCS11_SOURCE = pam_pkcs11-$(LIBPAM_PKCS11_VERSION).tar.gz
+LIBPAM_PKCS11_SITE = https://github.com/OpenSC/pam_pkcs11/archive/refs/tags
+
+LIBPAM_PKCS11_AUTORECONF = YES
+
+LIBPAM_PKCS11_CONF_OPTS += --libdir=/lib
+LIBPAM_PKCS11_CONF_OPTS += --without-docbook
+LIBPAM_PKCS11_CONF_OPTS += --without-ldap
+LIBPAM_PKCS11_DEPENDENCIES = openssl pcsc-lite linux-pam
+
+$(eval $(autotools-package))
Signature · 6 lines
2.47.3

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#1 lore raw

Hi Waldemar,

Thanks for the patch. I have few comments. See below.

This patch introduces several check-package errors. You can see those using the command:

utils/docker-run make check-package

Quoted 15 lines · Waldemar Brodkorb

The Linux-PAM login module for X.509 certificate based user login.

https://github.com/OpenSC/pam_pkcs11

Signed-off-by Waldemar Brodkorb <[email protected]>
---
 DEVELOPERS                               |  1 +
 package/Config.in                        |  1 +
 package/libpam-pkcs11/Config.in          | 18 ++++++++++++++++++
 package/libpam-pkcs11/libpam-pkcs11.hash |  2 ++
 package/libpam-pkcs11/libpam-pkcs11.mk   | 18 ++++++++++++++++++
 5 files changed, 40 insertions(+)
 create mode 100755 package/libpam-pkcs11/Config.in
 create mode 100755 package/libpam-pkcs11/libpam-pkcs11.hash
 create mode 100755 package/libpam-pkcs11/libpam-pkcs11.mk

[...]

package/libpam-pkcs11/Config.in

Quoted 2 lines
package/libpam-pkcs11/Config.in new file +0 -0
new file mode 100755

check-package reports the error:
package/libpam-pkcs11/Config.in:0: This file does not need to be executable

Could you change it to a regular file, please?

Quoted 11 lines

index 0000000000..6678c48ab9

package/libpam-pkcs11/Config.in new file +6 -0
@@ -0,0 +1,18 @@
+config BR2_PACKAGE_LIBPAM_PKCS11
+	bool "libpam-pkcs11"
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on BR2_USE_MMU # pcsc-lite -> fork()
+	depends on !BR2_STATIC_LIBS
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # pcsc-lite -> _Atomic

keyword

package/libpam-pkcs11/Config.in line 11

Quoted 5 lines
package/libpam-pkcs11/Config.in new file +5 -0
+	select BR2_PACKAGE_OPENSSL
+	select BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL
+	select BR2_PACKAGE_PCSC_LITE
+	help
+	  The Linux-PAM login module for X.509 certificate based user login.

Here, check-package reports:
package/libpam-pkcs11/Config.in:11: help text: <tab><2 spaces><62 chars> (https://nightly.buildroot.org/#writing-rules-config-in)

The line is too long and just need to be split..

package/libpam-pkcs11/libpam-pkcs11.hash

Quoted 10 lines
package/libpam-pkcs11/Config.in new file +4 -0
+
+	  https://github.com/OpenSC/pam_pkcs11
+
+comment "libpam-pkcs11 needs a toolchain w/ threads, dynamic library,

gcc >= 4.9"

package/libpam-pkcs11/Config.in new file +3 -0
+	depends on BR2_USE_MMU
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS || \
+		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
package/libpam-pkcs11/libpam-pkcs11.hash new file +0 -0
new file mode 100755

Here also:
package/libpam-pkcs11/libpam-pkcs11.hash:0: This file does not need to be executable

Quoted 7 lines

index 0000000000..9ab133f51b

package/libpam-pkcs11/libpam-pkcs11.hash new file +2 -0
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256

8a853f4e6e136ceecdcffad798570e3d6af2fde08e975656b2dc931989c35aff pam_pkcs11-0.6.13.tar.gz

Here there is a missing space between "sha256" and the hash..
package/libpam-pkcs11/libpam-pkcs11.hash:2: separation does not match expectation (https://nightly.buildroot.org/#adding-packages-hash)

You should also add the hash for the license file (see below).

package/libpam-pkcs11/libpam-pkcs11.mk

Quoted 2 lines
package/libpam-pkcs11/libpam-pkcs11.mk new file +0 -0
new file mode 100755

Here also:
package/libpam-pkcs11/libpam-pkcs11.mk:0: This file does not need to be executable

Quoted 13 lines

index 0000000000..9947e58e1a

package/libpam-pkcs11/libpam-pkcs11.mk new file +9 -0
@@ -0,0 +1,18 @@
+################################################################################
+#
+# libpam-pkcs11
+#
+################################################################################
+
+LIBPAM_PKCS11_VERSION = 0.6.13
+LIBPAM_PKCS11_SOURCE = pam_pkcs11-$(LIBPAM_PKCS11_VERSION).tar.gz
+LIBPAM_PKCS11_SITE =
Quoted 1 line

https://github.com/OpenSC/pam_pkcs11/archive/refs/tags

The license information are missing here. According to upstream:
https://github.com/OpenSC/pam_pkcs11/blob/pam_pkcs11-0.6.13/COPYING

We should have here:

LIBPAM_PKCS11_LICENSE = LGPL-2.1
LIBPAM_PKCS11_LICENSE_FILES = COPYING

package/libpam-pkcs11/libpam-pkcs11.mk line 15

Quoted 6 lines
package/libpam-pkcs11/libpam-pkcs11.mk new file +6 -0
+
+LIBPAM_PKCS11_AUTORECONF = YES
+
+LIBPAM_PKCS11_CONF_OPTS += --libdir=/lib
+LIBPAM_PKCS11_CONF_OPTS += --without-docbook
+LIBPAM_PKCS11_CONF_OPTS += --without-ldap

Could you format the previous block as follow:

LIBPAM_PKCS11_CONF_OPTS = \
	--libdir=/lib \
	--without-docbook \
	--without-ldap
Quoted 1 line

+LIBPAM_PKCS11_DEPENDENCIES = openssl pcsc-lite linux-pam

To make maintenance easier, could you sort the dependencies alphabetically, please? This should become:

LIBPAM_PKCS11_DEPENDENCIES = linux-pam openssl pcsc-lite

Quoted 4 lines

+
+$(eval $(autotools-package))
--
2.47.3

Could you send an updated version of this patch, please?

Best regards,

Julien.
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot