So I can restart pcscd service after every reboot but I would prefer a permanent fix. Any idea how I should proceed fixing / troubleshooting this issue? What further information can I provide to help?
I have not running pcscd all the time, somehow it gets launched when I use gpg (or pass) to decrypt the secrets and afterwards it terminates again. Here is my setup from October 2021:
How to setup the OpenPGP card in the Purism L5 phone
guru@unixarea.de, October 2021
updated March 2022;
https://puri.sm/posts/openpgp-in-your-pocket/
(includes video about inserting the card)
https://source.puri.sm/angus.ainslie/ttxs-firmware/-/blob/purism/PURISM.md
https://source.puri.sm/firmware/ttxs-firmware/-/blob/purism/PURISM.md
install and get the software:
$ cd ~/guru
$ sudo apt install stm32flash git
$ git clone https://source.puri.sm/angus.ainslie/ttxs-firmware
$ cd ttxs-firmware
Upgrade the smart card reader firmware:
$ ./scripts/stm_reflash.sh
...
stm32flash 0.5
http://stm32flash.sourceforge.net/
Using Parser : Raw BINARY
Interface serial_posix: 57600 8E1
Version : 0x31
Option 1 : 0x00
Option 2 : 0x00
Device ID : 0x0435 (STM32L43xxx/44xxx)
- RAM : Up to 48KiB (12544b reserved by bootloader)
- Flash : Up to 256KiB (size first sector: 1x2048)
- Option RAM : 16b
- System RAM : 28KiB
Write to memory
Erasing memory
Wrote address 0x08002388 (100.00%) Done.
And set up the smart card:
$ ./scripts/smartcard_setup.sh
There have been issues, see also:
https://forums.puri.sm/t/openpgp-card-waiting-for-the-first-reader/15189
https://source.puri.sm/Librem5/OS-issues/-/issues/119
What helped was:
# stty -F /dev/ttymxc2 raw cstopb -parenb cs8 115200
# pcscd -f --debug
The startup of pcscd is to be configured here and start is via systemctl:
# vim /lib/systemd/system/pcscd.service
# systemctl status pcscd
# systemctl stop pcscd
# systemctl start pcscd
Setting up the card
$ gpg --card-status
Reader ...........: TTXS serial 00 00
Application ID ...: D27600012401030400050000A6FE0000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: ZeitControl
Serial number ....: 0000A6FE
Name of cardholder: [not set]
Language prefs ...: de
Salutation .......:
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 64 64 64
PIN retry counter : 3 0 3
Signature counter : 0
KDF setting ......: off
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]
$ gpg --change-pin # changed the PIN and Admin PIN
$ gpg --card-edit # generated the keys
$ export GNUPGHOME=/home/guru/.gnupg
$ pass init 'CCID L5'
Password store initialized for guru@unixarea.de
$ pass insert -m test
...
$ gpg --with-keygrip -K
/home/purism/.gnupg/pubring.kbx
-------------------------------
sec> rsa2048 2021-10-30 [SC]
336EB96892FE9FE7F6AD01D6529B7423F3608141
Keygrip = FCBA9E53DF1AF8D6E8D82B0418A01FA33264F704
Card serial no. = 0005 0000A6FE
uid [ultimate] Matthias Apitz (GnuPG CCID L5) <guru@unixarea.de>
ssb> rsa2048 2021-10-30 [A]
Keygrip = EE34E2B1F932D1567A6E21023F4D65B71CF953FF
ssb> rsa2048 2021-10-30 [E]
Keygrip = C544F16750F7F55DCEF781CF57C232015DDF1F90
the '>' means that these keys are on the card;
export the pub key with:
$ gpg --export --armor > ccid-L5-export-key-guru.pub
lock the card again:
$ gpgconf --reload scdaemon
I added this to the pass cmd:
$ tail -8 /usr/bin/pass
# power down the OpenPGP card
# guru@unixarea.de
#
gpgconf --reload scdaemon
sleep 2
exit 0
so the card gets locked again after each operation with the pass cmd.
There are a lot of steps here including flashing the firmware, setting up the card, etc. I’m not yet going to try starting from scratch yet but will keep it in mind. Its not too painful to just restart the service and I could even create a script to do this automatically after startup to see what effect it would have. I’ll look more into this later but more tips are welcome.
Then I guess one step towards troubleshooting would be to work out whether there has been a regression i.e. what (relevant) packages have changed? can they be reverted?
I will get back in a few days my other L5 after some hardware change and flashed; and will check which files from my older configuration in October 2021 are now to be deleted.
I started with UNIX ~1985 with porting a BSD UNIX to an IBM mainframe /370 (a computer with the size of a classroom). Later in the 90s, I read in a book the following phrase (it’s a pity that I can’t find the exact place and words anymore in Internet, I don’t even know if it was in German or English). Here it is loosely as I remember: Sometimes you will find a UNIX Guru. Please be nice to him, pay his drink, but do not ask him any stuff, because his language is not yours anymore.
PS: I wrote this also with the intention that someone else knows the place of an exact citate of the phrase. Thanks in advance.
