Flatpak issue: SSH login with WebAuthN tokens (e.g. Yubikey) fails #143

binderb commented 2026年06月16日 17:02:59 +02:00

Using WebAuthN tokens for SSH login currently fails with an error (e.g. after pulling):

ssh_msg_recv: read header: Connection reset by peer: client_converse: receive: unexpected internal error- reap_helper: helper exited with non-zero exit status. sign_and_send_pubkey: signing failed for ED25519-SK ...

Unfortunately I wasn't able to find the logs of gitte, journald doesn't report anything.

System:
Fedora 44 Cosmic (Wayland)
Linux 7.0.12-201.fc44.x86_64
Gitte 0.6.1 (Flatpak de.wwwtech.gitte)

SSH-config:

Host *
	IdentityFile ~/.ssh/token
	IdentityAgent=none
	SetEnv TERM=xterm-256color

My token is a Yubikey 5.

Anecdotal evidence: Other flatpak tool (zed) was able to access the key.

Using WebAuthN tokens for SSH login currently fails with an error (e.g. after pulling): ``` ssh_msg_recv: read header: Connection reset by peer: client_converse: receive: unexpected internal error- reap_helper: helper exited with non-zero exit status. sign_and_send_pubkey: signing failed for ED25519-SK ... ``` Unfortunately I wasn't able to find the logs of gitte, journald doesn't report anything. System: Fedora 44 Cosmic (Wayland) Linux 7.0.12-201.fc44.x86_64 Gitte 0.6.1 (Flatpak de.wwwtech.gitte) SSH-config: ``` Host * IdentityFile ~/.ssh/token IdentityAgent=none SetEnv TERM=xterm-256color ``` My token is a Yubikey 5. Anecdotal evidence: Other flatpak tool (zed) was able to access the key.

ckruse commented 2026年06月16日 20:40:54 +02:00

Zed has all sandboxing disabled :P

I‘m pretty sure Gitte is missing the permissions. Can you try setting them?

flatpak override --user --device=usb de.wwwtech.gitte

That should be the right permission

Zed has all sandboxing disabled :P I‘m pretty sure Gitte is missing the permissions. Can you try setting them? ``` flatpak override --user --device=usb de.wwwtech.gitte ``` That *should* be the right permission

binderb commented 2026年06月17日 08:52:04 +02:00

Thank you so much for the quick response.

Unfortunately this wasn't it. Error message stays the same.

I also tried to add socket=pcsd (used by some YubiKey tools) and socket=gpg-agent and device=input to the allow-list, all didn't help either.

Even allowing device=all and allowing all sockets didn't help.

For reference I tried using regular git on CLI, access to the token was possible.

Thank you so much for the quick response. Unfortunately this wasn't it. Error message stays the same. I also tried to add `socket=pcsd` (used by some YubiKey tools) and `socket=gpg-agent` and `device=input` to the allow-list, all didn't help either. Even allowing `device=all` and allowing all sockets didn't help. For reference I tried using regular git on CLI, access to the token was possible.

binderb commented 2026年06月17日 09:58:09 +02:00

https://github.com/flatpak/flatpak/issues/4723 and https://github.com/flatpak/flatpak/issues/4066#issuecomment-1034040834 seem to indicate this is a bigger issue, probably only on Fedora (https://bugzilla.redhat.com/show_bug.cgi?id=2054826).

It seems there is no proper pcs-protocol between host and container, which would facilitate bridging different versions of pcslite packages.
I built the example application and wasn't able to access my token in there too.

Seems we have to wait until flatpak/Fedora get this sorted out :(

I'm very sorry for taking up your time 😟

https://github.com/flatpak/flatpak/issues/4723 and https://github.com/flatpak/flatpak/issues/4066#issuecomment-1034040834 seem to indicate this is a bigger issue, probably only on Fedora (https://bugzilla.redhat.com/show_bug.cgi?id=2054826). It seems there is no proper pcs-protocol between host and container, which would facilitate bridging different versions of pcslite packages. I built the example application and wasn't able to access my token in there too. Seems we have to wait until flatpak/Fedora get this sorted out :( I'm very sorry for taking up your time 😟

ckruse commented 2026年06月17日 13:29:30 +02:00

Oh, interesting. Thank you for investigating.

I will keep this issue open for tracking purposes.

Oh, interesting. Thank you for investigating. I will keep this issue open for tracking purposes.