build libsk-libfido2 for use with Apple's build of OpenSSH on MacOS

build-libsk-libfido2.sh

# See https://gist.github.com/thelastlin/c45b96cf460919e39ab5807b6d20ac2a

set -e

# get source
if [[ ! -d openssh-portable ]] ; then
  git clone https://github.com/openssh/openssh-portable.git
fi
cd openssh-portable

# patch
if [[ ! -f workaround-standalone-libsk.patch ]] ; then
  wget https://gist.githubusercontent.com/thelastlin/c45b96cf460919e39ab5807b6d20ac2a/raw/d84ee70a8f0d8cf846ae8b9f1fa6a4071797123e/workaround-standalone-libsk.patch
  patch < workaround-standalone-libsk.patch
fi

# use OpenSSL from brew
export LDFLAGS="-L/opt/homebrew/opt/openssl@1.1/lib"
export CPPFLAGS="-I/opt/homebrew/opt/openssl@1.1/include"
export PKG_CONFIG_PATH="/opt/homebrew/opt/openssl@1.1/lib/pkgconfig"
autoreconf
./configure
export LDFLAGS="$(grep ^LDFLAGS= Makefile|cut -d= -f2-)"
export LIBFIDO2="$(grep ^LIBFIDO2= Makefile|cut -d= -f2-)"
export CC="$(grep ^CC= Makefile|cut -d= -f2-)"

# build
make libssh.a CFLAGS="-O2 -fPIC"
make openbsd-compat/libopenbsd-compat.a CFLAGS="-O2 -fPIC"
make sk-usbhid.o CFLAGS="-O2 -DSK_STANDALONE -fPIC"
echo $LIBFIDO2 | xargs ${CC} -shared openbsd-compat/libopenbsd-compat.a sk-usbhid.o libssh.a -O2 -fPIC -o libsk-libfido2.so

# install
sudo cp libsk-libfido2.so /usr/local/lib/

# test
/usr/bin/ssh-keygen -t ecdsa-sk -f ./id -N "" -w /usr/local/lib/libsk-libfido2.so
SSH_SK_PROVIDER=/usr/local/lib/libsk-libfido2.so /usr/bin/ssh -T git@github.com

Patch is no longer required.

Problem:

ssh-keygen -t ecdsa-sk -f ./id -N ""     # fails wih "No FIDO SecurityKeyProvider specified"

Solution:

git clone https://github.com/openssh/openssh-portable.git
cd openssh-portable

note: macOS version of OpenSSH is built with LibreSSL, but using OpenSSL here using brew

brew install openssl libfido2
export LDFLAGS=-L/opt/homebrew/opt/openssl/lib/
export CPPFLAGS=-I/opt/homebrew/opt/openssl/include
export PKG_CONFIG_PATH=/opt/homebrew/opt/openssl/lib/pkgconfig

Build a standalone sk-libfido2 library to isolate the FIDO security key provider from the main OpenSSH binaries

autoreconf
./configure --with-security-key-standalone
make

Install:

sudo cp sk-libfido2.dylib /usr/local/lib/
export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib
ssh-keygen -t ecdsa-sk -f ./id -N ""           # works