Another short status update of what happened on my side last month. Besides the usual amount of housekeeping last month was a lot about getting old issues resolved by finishing some stale merge requests and work in pogress MRs. I also pushed out the Phosh 0.42.0 Release

phosh

• Mark mobile-data quick setting as insensitive when modem is off (MR)
• Document handler naming (MR)
• Phosh 0.41.1 (MR)
• Phosh 0.42~rc1 (MR)
• Phosh 0.42.0 (MR)
• Handle per app notification enable setting (MR) (a 3y old MR cleaned up and out of the way)
• Use parent's icon if child doesn't have one (MR (another 1y old MR moved out of draft status)
• Fix Rust build and upcoming events .plugin file (MR)
• Lint markdown (MR)
• Sanitize versions as this otherwise breaks the libphosh-rs build (MR)
• lockscreen: Swap deck and carousel to avoid triggering the plugins page when entering pin and let the lockscreen shrink to smaller sizes (MR) (two more year old usability issues out of the way)
• Let bitfield values end up in the docs again (MR)
• Don't focus incorrect app on launch (MR). This could happen with apps like calls that run a daemon (and needs more work for a clean solution).
• Continue with wallpaper MR (MR) (still draft)
• Brush up and land an old MR to avoid crashes on scale changes (MR). Another five month old MR out of the way.
• API version the shared library (MR)
• Ensure we send enough feedback when phone is blanked/locked (MR). This should be way easier now for apps as they don't need to do anything and we can avoid duplicate feedback sent from e.g. Chatty.
• Fix possible use after free when activating notifications on the lock screen (MR)

phoc

• Simplify layer-surface creation / destruction (MR)
• Don't lose preedit when switching applications, opening menus, etc (MR). This fixes the case (e.g. with word completion in phosh-osk-stub enabled) where it looks to the user as if the last typed word would get lost when switching from a text editor to another app or when opening a menu
• Ease focus debugging (MR)
• Release 0.42~rc1 (MR)
• Release 0.42.0 (MR)
• Mention examples in docs and check more things (MR)

phosh-mobile-settings

• Release 0.42~rc1 (MR)
• Release 0.42 (MR)
• Update ci-fairy (MR)

libphosh-rs

• Update Phosh-0.gir with above phosh fixes to unbreak the build (MR)
• Rework to work with API versioned libphosh (MR)

phosh-osk-stub

• Add paste button to easy pasting text (MR)
• Add copy button (draft) (MR)
• Fix word salad with presage completer when entering cursor navigation mode (and in some other cases) (MR 1). Presage has the best completion but was marked experimental due to that.
• Submit preedit on changes to terminal and emoji layout (MR)
• Enable hint based completion by default (MR)
• Release 0.42~r1 (MR)
• Release 0.42.0 (MR)

phosh-wallpapers

• Add sound for cellbroadcast (MR)
• Release 0.42.0 (MR)

meta-phosh

• Weekly image builds of nightly packages are now built in CI and uploaded.
• Handle Fixes: tag in git commit messages as well (MR)
• Let release prep handle non-RC versions as well (MR)
• Add common markdown linter job (MR)

Debian

• Update wlr-randr (MR)
• Upload libqmi developement snapshot (MR) (Helps eSIM and CellBroadcast)
• Update phosh to not crash with GSD from GNOME 47 (MR)
• Fix systemd unit path in calls (MR)
• Package wikietractor (MR)

ModemManager

• More work on Cell Broadcast so we can finally undraft (MR)

Calls

• Check consistency when building releases (MR
• Object life cycle fixes (MR)
• Use DBus activation (MR). This ensures it spawns quickly rather than phosh's splash screen timing out.

bluez

• Add user unit for mpris proxy so it works out of the box (Patch) and one can skip e.g. songs in a cars media unit

gnome-text-editor

• Wrap info-bar more (MR) to fit smalls screens
• Forward metainfo/desktop file updates from Mobian (MR) (patch originally by Arnaud Ferraris)

feedbackd

• Add udev rule to support haptic on Oneplus Fajita / Enchilada's (non-mailine driver) (MR)
• Support alert-slider on OnePlus 6/6T (MR. Based on a script by "isyourbrain foss".
• Release 0.5.0 (MR)
• Improve spec a bit regarding notification events (MR)

Chatty

• Don't send feedback for notifications (MR). The notification daemon does this already.
• Add event for cellbroadcast messages (MR)
• Switch to DBus activation (MR). This ensures the compositor sees the activation token and is will be useful for unified push.
• Don't let scroll_down button take focus (MR). This prevents the OSK from folding when the text view is focused and ones scrolls to the bottom.
• Use revealer to show/hide scroll_down button (MR) - just to make the visual more appealing
• Unbreak messge display (MR)
• Unbreak application icon (MR)
• Drop special preedit handling (MR).

libcall-ui

• Drop margin so we can fit on smaller screens (MR). This helps phosh on lower effective resolutions.
• Backport margin patch (MR)

glib

• Fix doc formatting for g_input_stream_read_all* (MR)

wlr-protocols

• Add toplevel responsiveness state (MR) so phosh can inform about unresponsive apps

git-buildpackage

• Modernize docs to use debian/latest instead of debian/sid (commit, commit).
• Use pytest instead of nose as test runner (MR)
• Release 0.9.35

iio-sensor-proxy

• Unbreak and modernize CI a bit (MR). A passing CI is so much more motivating for contributers and reviewers.

Fotema

• Fix app-id and hence the icon shown in Phosh's overview (MR)

Help Development

If you want to support my work see donations. This includes a list of hardware we want to improve support for. Thanks a lot to all current and past donors.

Another short status update of what happened on my side last month.

Quite a bit of time went into helping organize the FrOSCon FOSS on Mobile dev room (day 1, day 2, summary) but that was all worth it and fun - so was releasing Phosh 0.41.0 (which incidetally happened right before FrOScon). A three years old MR to xdg-spec to add call categories landed (thanks Matthias) allowing us to finally provide proper feedback for e.g. IM calls too. The rest was some OSK improvements (around Indic language support via varnam and layout configuration), some Cell Broadcast advancements (thanks to NGI0 for supporting this) but also some fixes. Here's the details:

Phosh

• Debug crash when swiping away keyboard on lockscreen (MR).
• Fix outdated clock when swiping back from lockscreen plugins (MR)
• Avoid deprecation warning (MR)
• Better handle mobile network generation bit masks (MR)
• Improve docs that end up in the libphosh-rs docs (MR)
• Modernize ModemManager backend in preparation for Cellbroadcast support (MR)
• Remove hacks from Cell Broadcast support MR (MR). Still draft but not much todo left once the ModemManager side landed
• Remove deprecated UI props and add a check so they don't creep back in (MR)
• Allow to use ASAN when feedbackd is a subproject (MR)
• Fix crash when Wi-Fi hot spot quick setting gets disabled (MR)
• Don't allow to change hotspot state on the lock screen (MR)
• Prepare and release Phosh 0.41.0~rc1 and Phosh 0.41.0
• Prepare 0.41.1 (MR)

Phoc

• Don't reject gesture when we cross another surface (MR)

phosh-mobile-settings

• Drop redundant enums (MR)
• Remember last used panel (MR)
• Fix initial state of move up/down popovers (MR)
• Allow to select OSK layouts (MR). This ensures only actually available layouts can be selected. Currently used by phosh-osk-stub but can easily be extended to squeekboard once it provides the information.

libphosh-rs

• Allow to run doc build locally and fix CI (MR)
• Release 0.0.2

phosh-osk-stub

• Allow to open OSK Settings panel when screen is not locked (MR)
• Unswap Enter and Backspace (MR)
• Bug fix release 0.41.1
• Use varnam_learn() for better completions in the varnam completer (MR)
• Export layout information (MR)
• Reduce flicker when launching settings (MR)

phosh-wallpapers

• Avoid new event sounds not being picked up due to stale caches (MR)
• Improve phone-hangup sound (MR)

meta-phosh

• Add release helpers (MR)

phosh-recipes

• VM images to test nightly packages https://salsa.debian.org/agx/phosh-recipes (based on Mobian's recipes)

Debian

• Upload Phosh 0.41.0~rc1 and 0.41.0 releases
• Robustify release script a bit (MR)
• Enable binding lib in phosh (MR)
• Move govarnam and varnam schemes packages into the input method team
• Upload varnam schemes to sid (MR)
• Make varnam-schemes reproducible, add autopkgtests and run upstream test during build (MR)
• Build wlroots with xcb-errors support (MR)

Mobian

• Help mobian-recipes with newer debos: (MR)

ModemManager

• Rework most bits of Cell Broadcast to move it closer to undraft status (MR). (Remaining bits affect enabling of unsolicited messages and setting channels).

Calls

• Use official notification category (MR)
• Use AdwAboutDialog (MR)

gnome-bluetooth

• Fix some deprecations (MR)
• Make pairing dialog adaptive (MR)
• Allow to use with Phosh without imposing more API/ABI guarantees (MR

gnome-settings-daemon

• Fix crash when hitting an error condition (which could then bring down the whole session): (MR)

feedbackd

• Install the udev rule via meson (MR to makes it easier for distros to pick up rule changes
• Sync packaging with Debian (MR)
• Document used gsettings (MR)

Chatty

• Update information at matrix.org (MR)
• Implement more unified push bits: (MR
• Document things a bit (MR
• Chase libcmatrix API changes (MR)

Libcmatrix

• More cleanups (MR, MR, MR)
• Publish docs (MR)
• Ship introspection data (MR)
• Release 0.0.2 (MR) (Release announcement)

Eigenvalue

• Catch up with libcmatrix API changes (MR)

kunifiedpush

• Avoid broken URLs when using ntfy (MR)

gir-rustdoc

• Improve error message when not running in CI (MR)

python-dbusmock

• Drop outdated comments (MR)

matrix spec

• propose some hints for Mobile clients (MR)

sound-theme spec

• propose new sound name for cell broadcasts (MR)

varname-schemes

• Make reproducible (MR)
• Don't ignore errors in build scripts (MR)
• Allow to run test against installed schemes (MR
• Fix build with recent ruby (MR)

FroSCon

• Helped a bit to setup the event
• Gave a short Phosh status update

Help Development

If you want to support my work see donations. This includes a list of hardware we want to improve support for. Thanks a lot to all current and past donors.

A short status update on what happened on my side last month. Looking at unified push support for Chatty prompted some libcmatrix fixes and Chatty improvements (benefiting other protocols like SMS/MMS as well).

The Bluetooth status page in Phosh was a slightly larger change code wise as we also enhanced our common widgets for building status pages, simplifying the Wi-Fi status page and making future status pages simpler. But as usual investigating bugs, reviewing patches (thanks!) and keeping up with the changing world around us is what ate most of the time.

Phosh

A Wayland Shell for mobile devices

• Update to latest gvc (MR)
• Mark more strings as translatable (MR)
• Improve Bluetooth support by adding a StatusPage (MR)
• Improve vertical space usage for status pages (MR)
• Fix build with newer GObject introspection, we can now finally enable --fatal-warnings (MR)
• Fix empty system modal dialog on keyring lookups: (MR)
• Send logind locked hint: (MR)
• Small cleanups (MR, MR)

Phoc

A Wayland compositor for mobile devices

• Update to wlroots 0.17.4 (MR)
• Fix inhibitors crash (can affect video playback) (MR)

libphosh-rs

Phosh Rust bindings

• Add doc build (MR)
• Release 0.0.1 on crates.io (MR)

phosh-osk-stub

A on screen keyboard for Phosh

• Allow for up to five key rows and add more keyboard layouts: (MR)

phosh-mobile-settings

• Allow to set prefer flash (MR)
• Allow to set quick-silent: (MR)
• Make DBus activatable (MR)

phosh-wallpapers

Wallpapers, Sounds and other artwork

• Add Phone hangup event: (MR)

git-buildpackage

Suite to help with Debian packages in Git repositories

• Fix tests with Python 3.12 and upload 0.9.34

Whatmaps

Tool to find processes mapping shared objects

• Fix build with python 3.12 and release 0.0.14

Debian

The universal operating system

• Upload whatmaps 0.0.14
• Package libssc (MR) for upcoming sensor support on some Qualcomm based phones
• Fix iio-sensor-proxy RC bug and cleanup a bit: (MR)
• Update wlroots to 0.17.4 (MR)
• Update calls to 46.3 (MR)
• Prepare 0.18.0 (MR
• meta-phosh: Switch default font and recommend iio-sensor-proxy: (MR)

Mobian

A Debian derivative for mobile devices

• Fix non booting kernels when built on Trixie (MR)
• Make cross building a bit nicer: (MR, MR)

Calls

PSTN and SIP calls for GNOME

• Emit phone-hangup event when a call ended (MR). Together with the sound theme changes this gives a audible sound when the other side hung up.
• Debug and document Freeswitch sofia-sip failure (it's TLS validation).

Livi

Minimalistic video player targeting mobile devices

• Export stream position and duration via MPRIS (MR)
• Slightly improve duration display (MR)
• Improve docs a bit: (MR)

libcall-ui

Common user interface parts for call handling in GNOME and Phosh.

• Release 0.1.2 (Build system cleanups only)
• Add consistency checks: (MR)

feedbackd

DBus service for haptic/visual/audio feedback

• Fix test failures on recent Fedora due to more strict json-glib: (MR)

Chatty

Messaging application for mobile and desktop

• Continue work on push notifications: (MR)
  • Allow to delete push server
  • Hook into DBus connector class
  • Parse push notifications
• Avoid duplicate lib build and fix warnings (MR)
• Let F10 enable the primary menu: (MR)
• Focus search when activating it (MR)
• Fix search keybinding: (MR)
• Fix keybinding to open help overlay (MR)
• Don't hit assertions in libsoup by iterating the wrong context: (MR)
• Matrix: Fix unread count getting out of sync: (MR)
• Allow to disable purple via build profile (MR)
• Fix critical during key verification (MR)
• ChatInfo: Use AdwDialog and show Matrix room topic (MR)
• Fix crash on account creation: (MR)

libcmatrix

A matrix client client library

• Fix gir annotations, make gir and doc warnings fatal: (MR)
• Cleanup README: (MR)
• Some more minor cleanups and docs: (MR, (MR, (MR)
• Generate enum types to make them usable by library consumers (MR)
• Don't blindly iterate the default context (MR)
• Allow to fetch a single event (useful for handling push notifications) (MR)
• Make CmCallback behave like other callbacks (MR)
• Allow to add/remove/fetch pushers sync (MR)
• Add sync variant for fetching past events (MR)
• Make a self contained library, test that in CI and make all public classes show up in the docs (MR)
• Track unread count (MR)
• Release libcmatrix 0.0.1
• Add support for querying room topics (MR)
• Allow to disable running the tests so superprojects have some choice (MR)
• Fix crashes, use after free, … (MR, MR, MR)

Eigenvalue

A libcmatrix test client

• New project to ease testing libcmatrix changes: https://github.com/agx/eigenvalue
• Add support for /room-details: (MR)
• Add support for /room-load-past-events: (MR)

Help Development

If you want to support my work see donations. This includes list of hardware we want to improve support for.

A short status update of what happened on my side last month. Was able to test our Cellbroadcast bits, feedbackd became more flexible regarding LEDs, Phosh 0.40 is out, and some more.

Phosh

• Phosh 0.40.0
• Fix testing custom quick setting plugins (MR)
• Add icons for dark style toggles (thanks to Sam Hewitt for the help) (MR, MR)
• 0.39.x backports (MR)
• Set default sound-theme (MR)
• Launch apps in transient scope (MR)
• Allow to suspend from lock screen (MR)
• Fix media player button style (MR)
• Don't use plain .so for bindings lib (MR)

Phoc

• Fling gesture to open/close phosh's panels (MR)
• Fix crash on output removal (MR)
• Don't draw decorations when maximized (MR)
• Allow to stack layer surfaces (MR was a bit older, polished up to land it) (MR)

gmobile

• Add hwdb support for Juno tablets (based on information by Giovanni Caligaris) (MR)
• Support add generic BT AVRCP profile (with the help of Phil Hands) (MR)
• Released 0.2.1

phosh-mobile-settings

• Use shared gmobile (MR)

phosh-wallpapers

• Add sound theme (MR)

emacs

• Add a major mode for systemd-hwdb files (MR)

Debian

• Backport phog fix to work with phosh-osk-stub (MR)
• Release git snapshot of phosh-wallpaper for NEW processing (MR)
• Backport phosh fixes for 0.39.0 (MR)
• Phoc: Install examples, they're useful for debugging (MR)
• Make libpam-ccreds work with gcrypt 1.11:
• Upload phosh release 0.40.0~rc1 and 0.40.0
• phog: Add example for autologin (MR)
• Update firefox-esr-mobile-config (thanks to Peter Mack for the input) (MR)
• Tweak meta-phosh:
  • Add feedbackd-device-themes (MR)
  • Add jxl pixbuf loader (MR)
  • Make gstreamer-packagekit a recommends (MR)

ModemManager

• Test our current code at NLalert test day: Current branch

Feedbackd

• Only apply Qualcom bits to lpg driver (MR)
• Support arbitrary RGB values for multicolor LEDs (MR)
• Allow to use camera flash LEDs as status LEDs (MR)
• End too noisy feedback when switching profile levels (MR)
  • calls bugfix for this (MR)
  • Trigger this via vol- in Phosh when a call comes in (MR)
• Packaging fixes (MR) , MR)
• device-themes: Lower brightness of feedback events as the flash is too bright on OnePlus 6T (MR)
• cli: Inform user when nothing was triggered (MR)
• Released 0.4.0

Livi

• Released 0.2.0
• Robustify stream resume (MR)

Calls

• build: Add summary (MR)
• Handle missing sim better (MR)
• Backports for 46 (MR)
• Fix SIP crash (MR)

Chatty

• Allow to display a Matrix clients access token (MR)
• libcmatrix: Add support handling push notification servers (MR)
• Allow to add push notification servers (draft)) (MR)
• Package docs (MR)

meta-phosh

• Add check for release consistency (MR)
  • mobile-settings: Use it in mobile settings (MR)

Libhandy

• Fix use-after-free in stackable-box (MR)

If you want to support my work see donations.

A short status update of what happened on my side last month. A broken gcovr in Debian triggered a bit of busy work but 0.39.0 came out nicely nevertheless. We also reduced build time quiet a bit in phosh and phoc.

• Phosh.mobi

  • Release Phosh 0.39.0
  • Blog post on wakeup keys
  • Start video section

• phosh

  • Split mocked and real wall clock: Merge request
  • Speed up build: Merge request
  • Update CI and fix some leaks: Merge request
  • Generate initial Rust bindings for libphosh: https://gitlab.gnome.org/guidog/libphosh-rs
    • Preps for that:
      • Split headers from sources: Merge request
      • Allow to install headers and shared object: Merge request
  • Wire up screenshot keybinding: Merge request
  • Expose OverviewActive property: Merge request
  • Further reduce build time: Merge request
  • Add mocks for ModemManager and NM data connections: Merge request

• phoc

  • Move udev rules and hwdb entries downstream: Merge request
  • Speed up build: Merge request
  • Update wlroots to 0.17.3: Merge request
  • Doc updates: Merge request

• gmobile

  • Add wakeup-key hwdb and udev rules: Merge request
  • Release 0.2.0: Merge request
  • Simplify testing panel information of different devices: Merge request
  • Add hwdb entries for more devices: Merge request

• calls

  • Update ci images so MRs using newer libadwaita can land: Merge request

• mobile-broadband-provider-info:

  • Release 20240407

• feedbackd

  • Initial libfeedback Rust bindings
    • Crate: https://crates.io/crates/libfeedback
  • Test led probing using umockdev: Merge request

• livi:

  • Update flatpak deps: Merge request (This includes a patch from Sebastian Dröge to optionally switch to gtk4paintable sink)
  • Add GSetting for auido visualizer: Merge request

• chatty / libcmatrix

  • Update libcmatrix. This pulls in our changes from last month.

• python-dbusmock

  • Add initial ModemManager mock: Merge request (Makes the ModemManager mock in Phosh mentioned above simpler)

• Linux kernel

  • Export wakeup keys: Merge request
  • Don't wake up on volume key press: Merge request

• libcall-ui

  • Release 0.1.2: Merge request

• Debian

  • Fix and upload gcovr: Merge request, Issue
  • Workarond gcovr breackage in phosh-osk-stub, gmobile, mobile settings and phosh
  • Update wlroots
    • Upload 0.17.2 to sid: Merge request
    • Upload 0.17.3 to exerimental: Merge request
  • Mobile tweaks:
    • Upload new version: Merge request
    • Cleanup a bit: Merge request
    • update Librem 5 power mgmt rules so we don't lose the modem: Merge request (allowed me to drop all PureOS packages on my cross graded device)
  • feedbackd: Install missing docs (Closes: #1050601): Merge request

If you want to support my work see donations.

A short status update of what happened on my side last month. Maintenance and code review keep to be the top time sinks (in a positive way).

• phosh: A Wayland shell for mobile devices

  • Release phosh 0.37.1
  • Release phosh 0.38.0
  • Be more generous in the gnome-session versions we support: Merge Request
  • Improve notification timestamps for translations: Merge Request
  • Improve test coverage a bit: Merge Request
  • Improve introspection data and documentation (Merge Request 1, Merge Request 2). Besides better docs (we now also fail on new warnings and errors (Merge Request) this allows to use parts of phosh in e.g. display managers in languages using introspection (Rust, JS, …). See this issue how this could become useful.
  • Add night light quick settings toggle: Merge Request
  • Fix power menu rendering without Cantarell: Merge Request
  • Track settings state (Merge Request) in shell state flags too. This will be useful to make tests more robust.

• phoc: A wlroots based Wayland compositor mostly used on mobile phones

  • More internal cleanup: Merge Request
  • Use shared gmobile: Merge Request
  • More introspection fixes to improve doc builds: Merge Request
  • Fix window cycle order: Merge Request
  • Fix crash with cutout/notch debug: Merge Request

• phosh-tour: A short introduction to Phosh

  • Fix blurry images: Merge Request
  • Fix flatpak build: Merge Request
  • Fix packaging build: Merge Request
  • Add a small Getting started page so phosh-tour has anything to point at

• gmobile: Functions useful in mobile related, glib based projects

  • Release 0.1.0
  • Update docs for shared lib use: Merge Request
  • Upload to Debian: https://packages.debian.org/sid/libgmobile0

• libcall-ui: Common user interface parts for call handling

  • Release 0.2.0: Merge Request

• calls: Phone calls application

  • Fix crash without location services: Merge Request

• phosh-ev: Monitor battery status of an electric car

  • Switch flatpak runtime to GNOME 46: Merge Request

• phosh-mobile-settings: Mobile specific settings

  • osk: Allow to configure whether to ignore hardware keyboards: Merge Request
  • Fix build without phoc: Merge Request
  • Allow to organise additional quick settings: Merge Request

• epiphany Don't make it appear frozen on first start: Merge Request

• iio-sensor-proxy (missed that one in March): Make test-suite more robust so people aren't puzzled when trying things locally: Merge Request

• mobile-broadband-provider-info Prepare Release: Merge Request

• feedbackd: A daemon to provide haptic, led and audio feedback triggered by application events

  • Allow to override feedback level: Merge Request (gnome-clocks branch using this)
  • Allow to use shared gmobile: Merge Request
  • Release 0.3.0: Merge Request

• meta-phosh Update dependency set: Merge Request Use common style check: Merge Request

• phosh nightly: Package builds of current Phosh git

  • Add some more packages that are useful for mobile: https://source.puri.sm/guido.gunther/phosh-debs

• livi: A small video player targeting mobile devices

  • Add devel profile to ease having the devel and release flatpak installed: Merge Request

• chatty / libcmatrix: Assorted fixes. Some to make matrix a bit more robust:

  • Don't forget to call sync callback: Merge Request
  • Improve copy popover: Merge Request
  • Drop support for libsoup2: Merge Request
  • Matrix robustness: Merge Request
  • Fix Matrix image download: Merge Request
  • Fix Doc build and make sure more methods end up there: Merge Request

• systemd:

  • Discuss hwdb and udev rules so we can track unidle/wakup keys: hwdb Merge Request, udev Merge Request to better handle device tree devices. As it turns out we'll do most of this in phoc initially and then open another merge request once we have more data.

• librem5-flash-image

  • Bring it back to debian testing: https://tracker.debian.org/pkg/librem5-flash-image

If you want to support my work see donations.

The Librem 5 features a built-in smartcard reader. While most people use it for gpg I wanted to see if it can be used as an authenticator for services like email (SMTP, IMAP), access to web pages (HTTPS), calendars, etc without either having to retype a password often or having to store it on the device itself: single sign on for all my frequently used services.

For that one can leverage a feature called PKINIT of Kerberos (a network authentication protocol meant to allow secure communication over a non-secure network) which uses public key cryptography for initial user authentication (instead of a password). If the key material is saved on the smart card even a lost device can hardly be abused as the smart card is protected by a PIN and will lock itself after three incorrect tries (and you can easily revoke the certificate server side too).

On the service side one can use SASL/GSSAPI to make services like exim, postfix, dovecot, cyrus imapd, apache, nginx or prosodi use Kerberos to authenticate users and there's many more (like CalDAV servers, etc). The most prominent missing bit for me is currently the Synapse matrix server not supporting GSSAPI yet.

I won't go into the details of setting up the Kerberos server (KDC) or PKINIT itself or how to configure services as this is already done elsewhwere (1, 2) but rather focus on the Librem 5 and smart card side.

So for the following let's assume you have a Kerberos realm called MS20.NIX set up and your KDC has the DNS name kdc.ms20.nix, and your Kerberos principal (your user in the Kerberos database) is called foo@MS20.NIX. You also have an smtp and imap servers called smtp.ms20.nix and imap.ms20.nix set up to autenticate users via Kerberos. Finally we call the CA that signs all your certificates ca.pem (were're following the naming from 2).

What follows looks as if lots of things need to be done on the command line. I'll show a simplification at the very end but wanted those bits written down for reference/debugging. Note that this post is not meant as an exhaustive introduction but more like a quick summary of commands. I'm happy if someone grabs it and adds more details.

Kerberos Setup on the Librem 5

Let's first install the Kerberos client side packages on the phone and test that:

$ sudo apt install heimdal-clienets

The krb5-config package will ask for your Kerberos realm, KDC etc. With that in place you should be able to test if you can get a Kerberos ticket via

$ kinit

and entering your password.

If that worked the klist output will look something like:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: foo@MS20.NIX

Issued                Expires               Principal
Oct 24 12:55:13 2022  Oct 25 12:55:13 2022  krbtgt/MS20.NIX@MS20.NIX

Now that basic authentication worked We're ready to switch to certificates stored them on the smart card. Let's drop the credentials first:

$ kdestroy

Smartcard Setup

I have used an OpenPGP card smartcard and inserted that into the Librem 5. In my case it was salvaged from a Librem Key. As PKINIT uses OpenSC the OpenSC wiki was very helpful as it has details on how to get key material onto that particular card.

The software to use the Librem 5's smart card reader is enabled by default as part of the librem5-base package. You just need to add opensc to the mix:

$ sudo apt install opensc

With that you should already be able to see the card:

$ opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             L5 built-in SmartCard Reader 00 01 00 00
1    Yes             L5 built-in SmartCard Reader 00 01 00 01

As there's only a single reader and the second entry can confuse opensc let's ignore that one:

$ cat <<EOF > /etc/opensc/opensc.conf
app default {
    ignored_readers = "TTXS serial 00 01 00 01","L5 built-in SmartCard Reader 00 01 00 01"
}
EOF

Which should make the output look like

$ opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             L5 built-in SmartCard Reader 00 01 00 00

With the reader up and running we can now store the certificate and private key on it. For simplicity we create these on the KDC and transfer them to the phone (a more realistic setup would create those locally and use a certificate signing request so the private key never leaves your hands):

On the KDC:

$ hxtool issue-certificate --ca-certificate=FILE:krbca.pem --generate-key=rsa --key-bits=2048 --type="pkinit-client" --pk-init-principal="foo@MS20.NIX" --subject="uid=foo,DC=ms20,DC=nix" --certificate="FILE:user.pem"

Then you'd copy the file to your phone and install certificate and private key on the smartcard like (this will delete any already existing keys on the card):

$ # Install needed packages
$ sudo apt install opensc wipe
$ # Delete old keys and install certificate and private key on smartcard
$ pkcs15-init --delete-objects privkey,pubkey,cert --id 1 --auth-id 3
$ pkcs15-init --delete-objects privkey,pubkey,cert --id 2 --auth-id 3
$ pkcs15-init --delete-objects privkey,pubkey,cert --id 3 --store-private-key user.pem  --store-certificate user.pem --id 3 --auth-id 3
$ # Wipe the file containing the private key
$ wipe user.pem

Afterward we can look at what's on the card

$ pkcs15-tool -D
Using reader with a card: L5 built-in SmartCard Reader 00 01 00 00
PKCS#15 Card [OpenPGP card]:
  Version        : 0
  Serial number  : <serial number>
  Manufacturer ID: ZeitControl
  Language       : de
  Flags          : PRN generation, EID compliant


PIN [User PIN]
  Object Flags   : [0x03], private, modifiable
  Auth ID        : 03
  ID             : 02
  Flags          : [0x13], case-sensitive, local, initialized
  Length         : min_len:6, max_len:64, stored_len:64
  Pad char       : 0x00
  Reference      : 2 (0x02)
  Type           : UTF-8
  Path           : 3f00
  Tries left     : 3

PIN [User PIN (sig)]
  Object Flags   : [0x03], private, modifiable
  Auth ID        : 03
  ID             : 01
  Flags          : [0x13], case-sensitive, local, initialized
  Length         : min_len:6, max_len:64, stored_len:64
  Pad char       : 0x00
  Reference      : 1 (0x01)
  Type           : UTF-8
  Path           : 3f00
  Tries left     : 3

PIN [Admin PIN]
  Object Flags   : [0x03], private, modifiable
  ID             : 03
  Flags          : [0x9B], case-sensitive, local, unblock-disabled, initialized, soPin
  Length         : min_len:8, max_len:64, stored_len:64
  Pad char       : 0x00
  Reference      : 3 (0x03)
  Type           : UTF-8
  Path           : 3f00
  Tries left     : 3

Private RSA Key [Authentication key]
  Object Flags   : [0x03], private, modifiable
  Usage          : [0x222], decrypt, unwrap, nonRepudiation
  Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
  Algo_refs      : 0
  ModLength      : 2048
  Key ref        : 2 (0x02)
  Native         : yes
  Auth ID        : 02
  ID             : 03
  MD:guid        : 135c302c-ddad-1a3c-f558-8beae7612f9f

Public RSA Key [Authentication key]
  Object Flags   : [0x02], modifiable
  Usage          : [0x51], encrypt, wrap, verify
  Access Flags   : [0x02], extract
  ModLength      : 2048
  Key ref        : 0 (0x00)
  Native         : no
  Path           : a401
  ID             : 03

X.509 Certificate [Cardholder certificate]
  Object Flags   : [0x00]
  Authority      : no
  Path           : 3f007f21
  ID             : 03
  Encoded serial : <serial>

The OpenPGP card's default admin PIN is 12345678 and the user pin 123456.

PKINIT Setup

Now add

[libdefaults]
pkinit_anchors = FILE:/etc/ssl/certs/ca.pem

to your /etc/krb5.conf and place the ca.pem in /etc/ssl/certs. With that you should be able to use pkinit. The -C option tells kinit to use your smart card for the crypto:

$ kinit -C PKCS11:/usr/lib/aarch64-linux-gnu/pkcs11/onepin-opensc-pkcs11.so foo@MS20.NET
PIN code for L5 built-in SmartCard Reader 00 01 00 00:

After entering the pin and typing klist the output should be similar to the klist output above. If you connect to various Kerberized services in your realm (e.g. by sending mail) the list will grow without having to retype any PINs or passwords:

$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: foo@ms20.nix

  Issued                Expires               Principal
Oct 24 12:55:13 2022  Oct 25 12:55:13 2022  krbtgt/MS20.NIX@MS20.NIX
Oct 24 12:55:57 2022  Oct 25 12:55:13 2022  imap/imap.ms20.nix@
Oct 24 12:57:45 2022  Oct 25 12:55:13 2022  smtp/smtp.ms20.nix@
Oct 24 13:00:32 2022  Oct 25 12:55:13 2022  HTTP/http.ms20.nix@

Can we make this simpler?

The above is very command line heavy and thus hard to use on a phone. With krb5-auth-dialog things become easier to set up. There's no need to adjust /etc//krb5.conf or to copy any certificates. PKINIT via smartcard is being enabled by a single click and you can select your CA (KDC trust anchor) via UI too:

There's a graphical dialog to enter your PIN that can either be started via the menu or triggered via a simple DBus call:

 $ gdbus call -e -d org.gnome.KrbAuthDialog -o /org/gnome/KrbAuthDialog -m org.gnome.KrbAuthDialog.acquireTgt ''

and the good part is that it won't prompt you if you already have a valid ticket. So you can e.g. add this as a hook to your offlineimap config.

As far as I know there's no end user friendly tool to transfer the certificates to the smartcard yet but note that this doesn't even have to happen on the phone itself. You can provision those elsewhere and then add the card to the phone but it might make sense to add that functionality to either krb5-auth-dialog or seahorse.

I hope this post motivates people to try this out and to leverage Kerberos for authenticating to services via the Librem 5's built-in smartcard reader.

Pitfalls

• If you get errors like:

  kinit: krb5_get_init_creds_opt_set_pkinit: Failed to init cert certs: Failed to init PKCS11 slot 0
  

  Then make sure gpg-agent didn't grab the card (e.g. because you ran gpg --card-status).

• If Firefox won't authenticate to your server make sure you've set negotiate.auth.trusted-uris in about:config

---

Since people are sometimes slightly surprised that you can go onto a multi week trip with a smartphone running free sofware so only I wanted to share some impressions from my recent trip to Prizren/Kosovo to attend Debconf 22 using a Librem 5. It's a mix of things that happend and bits that got improved to hopefully make things more fun to use. And, yes, there won't be any big surprises like being stranded without the ability to do phone calls in this read because there weren't and there shouldn't be.

After two online versions Debconf 22 (the annual Debian Conference) took place in Prizren / Kosovo this year and I sure wanted to go. Looking for options I settled for a train trip to Vienna, to meet there with friends and continue the trip via bus to Zagreb, then switching to a final 11h direct bus to Prizren.

When preparing for the trip and making sure my Librem 5 phone has all the needed documents I noticed that there will be quite some PDFs to show until I arrive in Kosovo: train ticket, bus ticket, hotel reservation, and so on. While that works by tapping unlocking the phone, opening the file browser, navigating to the folder with the PDFs and showing it via evince this looked like a lot of steps to repeat. Can't we have that information on the Phone Shell's lockscreen?

This was a good opportunity to see if the upcoming plugin infrastructure for the lock screen (initially meant to allow for a plugin to show upcoming events) was flexible enough, so I used some leisure time on the train to poke at this and just before I reached Vienna I was able to use it for the first time. It was the very last check of that ticket, it also was a bit of cheating since I didn't present the ticket on the phone itself but from phosh (the phones graphical shell) running on my laptop but still.

This was possible since phosh is written in GTK and so I could just leverage evince's EvView. Unfortunately the hotel check in didn't want to see any documents ☹.

For the next day I moved the code over to the Librem 5 and (being a bit nervous as the queue to get on the bus was quite long) could happily check into the Flixbus by presenting the barcode to the barcode reader via the Librem 5's lockscreen.

When switching to the bus to Prizren I didn't get to use that feature again as we bought the tickets at a counter but we got a nice krem banana after entering the bus - they're not filled with jelly, but krem - a real Kosovo must eat!).

Although it was a rather long trip we had frequent breaks and I'd certainly take the same route again. Here's a photo of Prizren taken on the Librem 5 without any additional postprocessing:

What about seeing the conference schedule on the phone? Confy(a conferences schedule viewer using GTK and libhandy) to the rescue:

Since Debian's confy maintainer was around too, confy saw a bunch of improvements over the conference.

For getting around Puremaps(an application to display maps and show routing instructions) was very helpful, here geolocating me in Prizren via GPS:

Puremaps currently isn't packaged in Debian but there's work onging to fix that (I used the flatpak for the moment).

We got ourselves sim cards for the local phone network. For some reason mine wouldn't work (other sim cards from the same operator worked in my phone but this one just wouldn't). So we went to the sim card shop and the guy there was perfectly able to operate the Librem 5 without further explanation (including making calls, sending USSD codes to query balance, …). The sim card problem turned out to be a problem on the operator side and after a couple of days they got it working.

We had nice, sunny weather about all the time. That made me switch between high contrast mode (to read things in bright sunlight) and normal mode (e.g. in conference rooms) on the phone quite often. Thankfully we have a ambient light sensor in the phone so we can make that automatic.

See here for a video.

Jathan kicked off a DebianOnMobile sprint during the conference where we were able to improve several aspects of mobile support in Debian and on Friday I had the chance to give a talk about the state of Debian on smartphones. pdf-presenter-console is a great tool for this as it can display the current slide together with additional notes. I needed some hacks to make it fit the phone screen but hopefully we figure out a way to have this by default.

I had two great weeks in Prizren. Many thanks to the organizers of Debconf 22 - I really enjoyed the conference.

Continuous temperature monitoring from the kernel's /sys/class/thermal/ in an application can be cumbersome. gtherm aims to make that simpler by providing a daemon (gthd) that exports thermal zones and cooling cells over DBus and providing a small library libgtherm (and GObject introspection bindings). gthcli is a simple command line client that displays the currently found values:

Thermal Zones
-------------
      dbus path: /org/sigxcpu/Thermal/ThermalZone/0
           type: cpu-thermal
    temperature: 53,00°C
cooling devices: /org/sigxcpu/Thermal/CoolingDevice/0

      dbus path: /org/sigxcpu/Thermal/ThermalZone/3
           type: max170xx_battery
    temperature: 36,60°C

      dbus path: /org/sigxcpu/Thermal/ThermalZone/2
           type: vpu-thermal
    temperature: 54,00°C

      dbus path: /org/sigxcpu/Thermal/ThermalZone/1
           type: gpu-thermal
    temperature: 54,00°C
cooling devices: /org/sigxcpu/Thermal/CoolingDevice/1

Cooling Devices
---------------
    dbus path: /org/sigxcpu/Thermal/CoolingDevice/0
         type: thermal-idle-0
    max state: 100
current state: 0

    dbus path: /org/sigxcpu/Thermal/CoolingDevice/1
         type: 38000000.gpu
    max state: 6
current state: 0

There's support for gnome-usage in the works:

Next up is support for trip points (and maybe tuning cooling behaviour from userspace later on).

To keep up with GNOMEs schedule I've released krb5-auth-dialog 3.15.4. The changes of 3.15.1 and 3.15.4 include among updated translations, the replacement of deprecated GTK+ widgets, minor UI cleanups and bug fixes a header bar fix that makes us only use header bar buttons iff the desktop environment has them enabled:

This makes krb5-auth-dialog better ingtegrated into other desktops again thanks to mclasen's awesome work.

This blog is flattr enabled.

Testing the password dialog of a NetworkManager VPN plugin is as simple as:

echo -e 'DATA_KEY=foo\nDATA_VAL=bar\nDONE\nQUIT\n' | ./auth-dialog/nm-iodine-auth-dialog -n test -u $(uuid) -i

The above is for the iodine plugin when run from the built source tree. This allows one to test these dialogs although one didn't see them since ages since GNOME shell uses the external UI mode to query for the password.

This blog is flattr enabled.

Following up on my port of the crystalhd plugin to the gstreamer 1.0 api I realized that the CrystalHD repo is pretty dormant. After reading slomo's nice article about GStreamer and hardware integration and a short off list mail exchange I decided to split the GStreamer part out of the CrystalHD repo and to try to get the plugin into gst-plugins-bad.

Since the kernel part is already in linux kernel's staging area there would not be much left in the repo except for the libcrystalhd library itself and the firmware blobs. So I split them out as well and started to clean them up a bit by moving it to autoconf/automake, dropping the need for a C++ compiler and adding symbol versioning among other things.

So up to know video is still smooth with:

gst-launch-1.0 filesrc location=sample.mp4 ! decodebin ! xvimagesink

after jhbuilding up to gst-plugins-bad.

There are #ifdefs for macosx and windows but I doubt they're functional but in case anybody is building libcrystalhd on these these platforms it'd be great to know if it still works.

Should these efforts lead to the crystalhd plugin being merged into GStreamer getting the kernel driver out of staging would be a great next step.

This blog is flattr enabled.

Following up on using Debian on the WeTab with GNOME Shell I figured accelerated video using the built in CrystalHD to save battery power and CPU cycles would be nice to have. There's even a Debian package available but not for gstreamer 1.0 (which is used by GNOME 3.6) so I had a look at gstreamer's plugin writers guide and porting guide and updated the driver. Packages are here until there's a new upstream version or Debian package release.

This blog is flattr enabled.

Following up on using Debian on the WeTab with GNOME Shell I had a look at automatically adjusting the screen orientation when rotating the device.

The accelerometer is handled in the asus_laptop module since kernel 3.2, so this shows up in /proc/bus/input/devices:

I: Bus=0019 Vendor=0000 Product=0000 Version=0000
N: Name="Pegatron Lucid Tablet Accelerometer"
P: Phys=pega_accel/input0
S: Sysfs=/devices/platform/asus_laptop/input/input4
U: Uniq=
H: Handlers=event4 js0 
B: PROP=0
B: EV=9
B: ABS=7

Whenever the screen orientation changes the driver emits a udev event. The helper in /lib/udev/accelerometer processes it thanks to /lib/udev/rules.d/61-accelerometer.rules, determines the orientation and adds the ID_INPUT_ACCELEROMETER_ORIENTATION property to the event which can be checked with udevadm monitor --property:

UDEV  [5778.534171] change   /devices/platform/asus_laptop/input/input4 (input)
ABS=7
ACTION=change
DEVPATH=/devices/platform/asus_laptop/input/input4
EV=9
ID_FOR_SEAT=input-platform-asus_laptop
ID_INPUT=1
ID_INPUT_ACCELEROMETER=1
ID_INPUT_ACCELEROMETER_ORIENTATION=right-up
ID_PATH=platform-asus_laptop
ID_PATH_TAG=platform-asus_laptop
MODALIAS=input:b0019v0000p0000e0000-e0,3,kra0,1,2,mlsfw
NAME="Pegatron Lucid Tablet Accelerometer"
PHYS="pega_accel/input0"
PRODUCT=19/0/0/0
PROP=0
SEQNUM=1550
SUBSYSTEM=input
TAGS=:seat:
UDEV_LOG=3
USEC_INITIALIZED=6154288

This is captured by gnome-settings-daemon (>=3.2) that adjusts the screen rotation using xrandr2 accordingly. This can be checked by running gnome-settings-daemon with --debug. The old way of using xinput events is no longer supported.

Unfortunately Debian's udev has a minor bug that misdetects the input device so this patch is needed to have the screen orientation changed automatically on the WeTab.

This blog is flattr enabled.

Following up on using Debian on the WeTab with GNOME Shell I've put together a bit of GTK+3 CSS to make it more touch friendly. It's in the same git repo as the OSK extension. If you put the gtk.css into ~/.config/gtk-3.0/gtk.css scrollbars will be a bit larger and the padding between widgets will be increased over the default theme:

This will need more work since some of the sliders look a bit a awkward now so any enhancements will be greatly appreciated. The docs for GTK3's CSS are here.

This blog is flattr enabled.

Running Debian on the WeTab with GNOME Shell without an external keyboard works pretty nicely. The on screen keyboard - if enabled via the accessibility menu - folds out automatically in the shell itself within text input fields. To have this within GTK+3/GTK+2 applications you need libcaribou-gtk3-module and libcaribou-gtk-module installed. For other cases I stitched together a small extension that puts a keyboard "Button" prominently into the middle of the panel. Clicking/touching it will fold it out, clicking again will hide it again. You can fetch it from

git clone git://honk.sigxcpu.org/git/gnome-shell-oskb-extension.git ~/.local/share/gnome-shell/extensions/OnScreenKeyboardButton@sigxcpu.org

and activate it via

 gsettings set org.gnome.shell enabled-extensions "['OnScreenKeyboardButton@sigxcpu.org']"

For kinetic scrolling in Iceweasel I'm currently using Grab and Drag which is not yet packaged for Debian.

Thanks to the Debian's GNOME packaging team gnome-shell 3.6 is already available in experimental.

This blog is flattr enabled.

Finally found the time to add external ui support to network-manager-iodine. This makes for nicer authentication dialogs when using Gnome Shell and warrants a 0.0.4 release. Debian packages can be fetched from unstable once they passed the NEW queue.

This blog is flattr enabled.

During FOSDEM I finally got around to hack on a iodine plugin for network manager. Given a suitably prepared server on the other end this allows you to tunnel connections over DNS when all other traffic is firewalled. The basic configuration only needs the domain name set:

You can grab the sources from git.gnome.org, a Debian package is also available.

This blog is flattr enabled.

A recent trip to Switzerland made me dig out my prepaid card for UMTS usage again. This resulted in some minor enhancements for Prepaid Manager. The new release handles disabled and missing modems more reliably. It also has some visual feedback if we know the length of the top up code:

This blog is flattr enabled.

The slides of my talk about GNOME3 at the FroSCon 2011 in Sankt Augustin are now available. The source code including the examples can be found here:

git clone git://honk.sigxcpu.org/git/talks/2011-08-gnome3-froscon.git

It was a great conference that I really enjoyed being at. Thanks a lot to all who made that event possible and happen!

The new release switches to GDBus and adds an application icon. Together with the recently released Modem Manager 0.5 it's now able to fetch the balance information via USSD on Huawei and ZTE modems as well.

This blog is flattr enabled.

I've made a first release of GNOME Prepaid Manager a couple of days ago after switching to GTK+3, GSettings and PyGObject's GObject introspection but it still wasn't that useful since the very common Huawei chipsets (present in many UMTS USB sticks) weren't working due to some missing code in ModemManager.

Thanks to Dan's great description I just got around to add that which should make ppm useful to more people.

This blog is flattr enabled.

Thanks to Dan merging my changes into mobile-broadband-provider-info and ModemManager the prepaid-manager applet now doesn't need any external dependencies patched which is great news. However I still didn't get around to make it work on the very common Huawei 3G chipsets though. Once this is done the ui needs a lift up badly.

This blog is flattr enabled.

Hello Planet GNOME! As of 2.91.91 krb5-auth-dialog should be fairly usable in GNOME3. The status icon is gone if the notification service supports persistence, we migrated to GDBus and to the new Control Panel.

The move to DConf is still missing though.

During a trip to Switzerland I needed some internet connectivity for my laptop and so I got myself a prepaid UMTS SIM card. That's a lot cheaper than roaming with the UMTS card from my local provider. NetworkManager worked great: after putting the SIM card into the laptop a dialog popped up asking for the PIN, then selecting the provider, ready to go!

After I used up my prepaid credit things got a bit more rough. The connection was failing for now "obvious" reason. So I put the SIM card into a mobile phone, pulled out the manual that came with the SIM card, found how to check the balance and dialed:

*130#

and the mobile phone returned that I didn't have enough credit left. So I got myself a top up code from the next supermarket, dialed:

*130*<topupcode>#

put the card back into my laptop and could connect again.

That's a bit cumbersome to repeat since you not only have to know the above USSD sequences (those vary between providers) but also need a mobile phone to put the SIM card into. So I added prelimanary USSD support to ModemManager, extended mobile-broadband-provider to support balance top-up information and hacked together a simple prepaid-manager-applet that allows you to check and top-up your prepaid balance right from your GNOME desktop. This needs more work (and a nice icon) but it's basically usable.

In case somebody else wants to jhbuild current GNOME 3 prereleases on Debian here's the current set of dependencies and the jhbuildrc I'm using. With the necessary fixes applied upstream now this allows me to build gnome-shell, gnome-control-center and others via

jhbuild build <program>

It needs libmozjs3d-dev from experimental for the shell but the rest comes out of squeeze.

Those old school ones among us that still need a printer who are new school enough to want to get rid of HAL should try system-config-printer from experimental. After replacing hal-cups-utils by system-config-printer-udev aptitude tells me:

    The following packages will be REMOVED:
      hal{u} hal-info{u} 
    0 packages upgraded, 2 newly installed, 2 to remove and 121 not upgraded.

Which means faster startup times and one daemon less on Squeeze's GNOME desktop. The new version also uses PolicyKit instead of gksu for finer grained permission control.

I've just added a simple afs plugin to krb5-auth-dialog. It just calls either aklog or afslog after acquiring or renewing your Kerberos ticket to get you into your AFS cell. To activate it use

gconftool-2 --set --list-type=string --type=list /apps/krb5-auth-dialog/plugins/enabled [afs]

and restart krb5-auth-dialog. A package with the above enabled has been uploaded to Debian. Thanks to the test account in the global2000.at cell provided by Jörg Herzinger I could test this easily and I have to say that AFS looks like a cool thing.

Krb5-auth-dialog now sends DBus signals when you acquire or renew your Kerberos ticket granting ticket and when the ticket expires. When using OpenAFS This can e.g. be used to trigger a call to aklog on ticket renewal. It's simple to catch the DBus signals from a Python script:

import dbus
bus = dbus.SessionBus()
bus.add_signal_receiver(tgt_renewed_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_renewed")
bus.add_signal_receiver(tgt_acquired_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_acquired")
bus.add_signal_receiver(tgt_expired_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_expired")

The tgt_*_handler will then be called when the signal is received. The shipped Python example allows to execute a script already:

tgt-signals.py -q --acquired-action=aklog --renewed-action=aklog

Krb5-auth-dialog also got a plugin system so you could use a loadable module for these kind of things instead. It already ships a PAM plugin that can be used to run some typical actions like calling pam-afs-session or getting kx509 set up.

You need to tell krb5-auth-dialog which plugins to load via gconf. To load the dummy and PAM plugins use:

gconftool-2 --set --list-type=string --type=list /apps/krb5-auth-dialog/plugins/enabled [pam,dummy]

Since I'm not using AFS or kx509 myself I'd be interested to know if this works out as expected.

If you want to write your one plugins you can use the dummy plugin as a basis.

A package with the above enabled has been uploaded to Debian experimental.

gnome-activity-journal recently entered Debian and it could become a great tool to keep track of hacking activities. The underlying zeitgeist can log these and other events and make the information available via DBus. I couldn't find a data provider that feeds the information about Git commits to it so I wrote a simple post commit hook. This way one can easily see when one worked on a source repository:

Now is there a nice way to store additional information like current branch or commit message along with that?

I've finally added basic Negotiate (Kerberos) support to libsoup. Git is available here. Using:

git clone http://git.debian.org/?p=users/agx/libsoup.git;a=summary
./autogen.sh
make
# for nautilus:
killall gvfsd
LD_LIBRARY_PATH=libsoup/.libs/ gvfsd
# epiphany:
LD_LIBRARY_PATH=libsoup/.libs/ epiphany
# totem:
LD_LIBRARY_PATH=libsoup/.libs/ totem

you can protect your music, files, whatever on a webserver using mod_auth_kerb and access them without storing a passwort just using your Kerberos ticket. Would be nice to get this merged #587145.

Besides quiet some bug fixes krb5-auth-dialog 0.13 now features a ticket dialog that lists your current tickets.