From 3b14303c5955c413cb7ad942b8c4e68b60146d43 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Sun, 19 Jan 2025 12:28:21 +0100
Subject: [PATCH] libsecret: enable TPM support

---
 pkgs/by-name/li/libsecret/package.nix | 110 +++++++++++++++++++++++---
 1 file changed, 97 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/li/libsecret/package.nix b/pkgs/by-name/li/libsecret/package.nix
index f422de359ca2..52bf76bc68a7 100644
--- a/pkgs/by-name/li/libsecret/package.nix
+++ b/pkgs/by-name/li/libsecret/package.nix
@@ -24,8 +24,51 @@
   gjs,
   libintl,
   dbus,
+  withTpm2Tss ? false,
+  abrmdSupport ? false,
+  writeShellApplication,
+  tpm2-tss,
+  tpm2-abrmd,
+  libsecret,
 }:
 
+assert abrmdSupport -> withTpm2Tss;
+
+let
+  tpm-emu = writeShellApplication {
+    name = "tpm-emu";
+    runtimeInputs = [
+      dbus
+      tpm2-abrmd
+    ];
+
+    text = ''
+      coproc {
+        # Monitor session bus for name acquisition
+        dbus-monitor "type='signal',interface='org.freedesktop.DBus',member='NameAcquired',arg0='com.intel.tss2.Tabrmd'"
+      }
+
+      # Discard initial dbus-monitor output
+      while read -r -t 0.1 -u "''${COPROC[0]}"; do :; done
+
+      tpm2-abrmd \
+        --tcti=libtpms \
+        --allow-root \
+        --flush-all \
+        --session &
+
+      # Terminate tpm2-abrmd on exit
+      # shellcheck disable=SC2064 # immediate expansion intended
+      trap "kill '$!'" EXIT
+
+      # Wait for daemon to become available to avoid spurious test failures
+      read -r -t 60 -u "''${COPROC[0]}"
+      kill "$COPROC_PID"
+
+      TCTI="tabrmd:bus_type=session" "$@"
+    '';
+  };
+in
 stdenv.mkDerivation rec {
   pname = "libsecret";
   version = "0.21.6";
@@ -62,9 +105,12 @@ stdenv.mkDerivation rec {
       gobject-introspection
     ];
 
-  buildInputs = [
-    libgcrypt
-  ];
+  buildInputs =
+    [
+      libgcrypt
+    ]
+    ++ lib.optionals withTpm2Tss [ tpm2-tss ]
+    ++ lib.optionals abrmdSupport [ tpm2-abrmd ];
 
   propagatedBuildInputs = [
     glib
@@ -81,6 +127,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     (lib.mesonBool "introspection" withIntrospection)
     (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonBool "tpm2" withTpm2Tss)
     (lib.mesonOption "bashcompdir" "share/bash-completion/completions")
   ];
 
@@ -93,19 +140,39 @@ stdenv.mkDerivation rec {
     # dbus-run-session defaults to FHS path
     substituteInPlace meson.build --replace-fail \
       "exe_wrapper: dbus_run_session," \
-      "exe_wrapper: [dbus_run_session, '--config-file=${dbus}/share/dbus-1/session.conf'],"
+      "exe_wrapper: [dbus_run_session, '--config-file=${dbus}/share/dbus-1/session.conf'${lib.optionalString withTpm2Tss ", '${lib.getExe tpm-emu}'"}],"
   '';
 
-  preCheck = ''
-    # Our gobject-introspection patches make the shared library paths absolute
-    # in the GIR files. When running tests, the library is not yet installed,
-    # though, so we need to replace the absolute path with a local one during build.
-    # We are using a symlink that will be overwitten during installation.
-    mkdir -p $out/lib $out/lib
-    ln -s "$PWD/libsecret/libmock-service.so" "$out/lib/libmock-service.so"
-    ln -s "$PWD/libsecret/libsecret-1.so.0" "$out/lib/libsecret-1.so.0"
+  preConfigure = lib.optionalString abrmdSupport ''
+    # Add dependencies on TCTI modules required for user‐space TPM resource
+    # manager support so that they can be loaded at run time through dlopen().
+    mesonFlagsArray+=("-Dc_link_args=-Wl,--push-state,--no-as-needed -ltss2-tcti-tabrmd -ltss2-tcti-device -Wl,--pop-state")
   '';
 
+  preCheck =
+    ''
+      # Our gobject-introspection patches make the shared library paths absolute
+      # in the GIR files. When running tests, the library is not yet installed,
+      # though, so we need to replace the absolute path with a local one during build.
+      # We are using a symlink that will be overwitten during installation.
+      mkdir -p $out/lib $out/lib
+      ln -s "$PWD/libsecret/libmock-service.so" "$out/lib/libmock-service.so"
+      ln -s "$PWD/libsecret/libsecret-1.so.0" "$out/lib/libsecret-1.so.0"
+    ''
+    + lib.optionalString (withTpm2Tss && !abrmdSupport) ''
+      # If abrmdSupport is disabled, the user‐space resource manager TCTI
+      # module is not linked at compile time. It is however needed during
+      # testing because the TPM emulator lacks an integrated resource manager
+      # The module path is therefore injected temporarly using the
+      # LD_LIBRARY_PATH environment variable, so that it may be found by
+      # dlopen().
+      #
+      # If abrmdSupport is enabled, this is avoided to check that the
+      # module has been properly linked and can be located through the
+      # DT_RUNPATH and DT_NEEDED entries in libsecret-1.so.
+      export LD_LIBRARY_PATH+=":${lib.makeLibraryPath [ tpm2-abrmd ]}"
+    '';
+
   checkPhase = ''
     runHook preCheck
 
@@ -130,6 +197,18 @@ stdenv.mkDerivation rec {
       # Does not seem to use the odd-unstable policy: https://gitlab.gnome.org/GNOME/libsecret/issues/30
       versionPolicy = "none";
     };
+
+    tests = {
+      libsecret-tpm2 = libsecret.override {
+        withTpm2Tss = true;
+        abrmdSupport = false;
+      };
+
+      libsecret-tpm2-abrmd = libsecret.override {
+        withTpm2Tss = true;
+        abrmdSupport = true;
+      };
+    };
   };
 
   meta = {
@@ -137,6 +216,11 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.gnome.org/GNOME/libsecret";
     license = lib.licenses.lgpl21Plus;
     mainProgram = "secret-tool";
-    inherit (glib.meta) platforms maintainers;
+    platforms =
+      if withTpm2Tss then
+        lib.intersectLists glib.meta.platforms tpm2-tss.meta.platforms
+      else
+        glib.meta.platforms;
+    inherit (glib.meta) maintainers;
   };
 }