New formula: openssh-sk-provider (FIDO2 security-key provider for macOS's built-in ssh)

[pete-woods]

Hi all 👋

I'd like to propose adding a small formula to core, and I'm hoping for a notability exception for the reasons below.

The problem

Since macOS 14 Sonoma, the OpenSSH that ships with macOS supports FIDO2 -sk keys (ed25519-sk, ecdsa-sk), but Apple doesn't ship a provider library for them:

• Up to macOS 13, Apple built OpenSSH with --disable-security-key (OpenSSH-282.140.3, macOS 13.5).
• From macOS 14.0 (distribution-macOS macos-140 → OpenSSH-319), that flag is gone (OpenSSH-319) and ssh-sk-helper is built. Apple's builds define ENABLE_SK but leave ENABLE_SK_INTERNAL undefined (config.h), so there's no built-in provider.

Out of the box, ssh-keygen -t ed25519-sk and logging in with a YubiKey in FIDO2 mode don't work with /usr/bin/ssh.

Today the only option with Homebrew is to brew install openssh and use its ssh instead of the system one. That gives up things people rely on in Apple's build, such as Keychain integration (UseKeychain, ssh-add --apple-use-keychain) and the launchd-managed agent. It also means making sure every tool (git, IDEs, GUI apps) picks up the Homebrew binary and not /usr/bin/ssh.

OpenSSH already solves this upstream. Its --with-security-key-standalone configure option builds sk-libfido2.dylib, a standalone SecurityKeyProvider that Apple's ssh loads through SecurityKeyProvider in ssh_config or the SSH_SK_PROVIDER env var. Apple's ssh-keygen and ssh-sk-helper already have the entitlements needed to load a third-party library, so nothing needs re-signing.

The formula

https://github.com/pete-woods/homebrew-tap/blob/main/Formula/openssh-sk-provider.rb

• It uses the same tarball, version and sha256 as core openssh, and livecheck follows openssh.
• It runs ./configure --with-security-key-standalone and then make sk-libfido2.dylib, and installs only that one dylib.
• It depends on libfido2 and openssl@4, the same OpenSSL as libfido2, so only one libcrypto gets loaded.
• The test dlopens the library and calls sk_api_version.
• brew audit --strict --new passes.

I've checked it with Apple's /usr/bin/ssh-keygen: the system ssh-sk-helper loads the provider and reaches the YubiKey's PIN prompt.

Why it's macOS-only

The library only makes sense as a plug-in for an OpenSSH built without FIDO2 support, and that's Apple's build. Linux distros build their OpenSSH with built-in security-key support, and Homebrew's own openssh uses --with-security-key-builtin. On Linux this formula would have nothing to plug into, so it has depends_on :macos.

Notability

I know new formulae normally need to show notability through stars, forks and so on. This formula can't, because it has no upstream project of its own. It's OpenSSH, built from the same release tarball as core's openssh with one extra configure flag. Its notability is really OpenSSH's. I'm hoping that justifies an exception.

Thanks!

[SMillerDev]

I know new formulae normally need to show notability through stars, forks and so on. This formula can't, because it has no upstream project of its own. It's OpenSSH

I'd say OpenSSH is pretty notable, so this sounds like something you can just make a PR for.

[pete-woods]

Sounds great, I shall make a PR!

[pete-woods]

Homebrew/homebrew-core#317734