From 503bfeb10f2b3f84787fe5742962a97b5e3ccc1f Mon Sep 17 00:00:00 2001 From: r-vdp Date: Mon, 13 Jul 2026 12:35:00 +0200 Subject: [PATCH] nixos/systemd/fido2: add libpcsclite_real.so.1 to initrd libfido2 links against pcsclite's libpcsclite.so.1, which since pcsclite 2.3.1 is a shim that dlopens libpcsclite_real.so.1. nixpkgs patches that dlopen to an absolute store path. make-initrd-ng only follows DT_NEEDED, so the real library never ends up in the initrd. systemd-cryptsetup then logs at boot: loading ".../pcsclite-2.4.1-lib/lib/libpcsclite_real.so.1" failed: cannot open shared object file: No such file or directory and FIDO2 tokens behind PC/SC (NFC readers) cannot be used to unlock LUKS in stage 1. Add the real library to the initrd store paths. --- nixos/modules/system/boot/systemd/fido2.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/system/boot/systemd/fido2.nix b/nixos/modules/system/boot/systemd/fido2.nix index 02b4a1389fba..e665d1bbb793 100644 --- a/nixos/modules/system/boot/systemd/fido2.nix +++ b/nixos/modules/system/boot/systemd/fido2.nix @@ -27,6 +27,8 @@ in "${cfg.package}/lib/udev/fido_id" "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so" "${pkgs.libfido2}/lib/libfido2.so.1" + # dlopened by the libpcsclite.so.1 shim, invisible to make-initrd-ng + "${lib.getLib pkgs.pcsclite}/lib/libpcsclite_real.so.1" ]; }; }