1
#!/bin/bash
2

3
################################################################################################
4
# Last Updated: January 13, 2025
5
#
6
# macOS OpenSSH Client Patcher for Hardware Security Key Support (ED25519-SK With YubiKey Etc.)
7
# Check out https://gist.github.com/BertanT/9d222da115ca2d1274ef34735c4260cf for details!
8
#
9
# Copyright 2025 Mehmet Bertan Tarakcioglu (github.com/BertanT), under the MIT License.
10
################################################################################################
11

12
# Exit early if there is an error
13
set -e
14

15
printf "\n* Hello! This script compiles and installs the security key provider for the built-in macOS Open SSH client to enable support for hardware security keys (such as a YubiKey)."
16

17
# Check if the script is running as root
18
if [ "$(id -u)" -eq 0 ]; then
19
  printf "\n!!! Error: For safety reasons, this script cannot be run as root. If using sudo, please try again without it.\n" >&2
20
  exit 1
21
fi
22

23
# Function to compare macOS version strings
24
version_ge() {
25
  [[ "$(echo -e "$1\n$2" | sort -V | head -n1)" == "$2" ]]
26
}
27

28
# function to get the current macOS Version
29
macos_version=$(sw_vers -productVersion | cut -d '.' -f1,2)
30

31
# Check if running at least macOS Sonoma
32
if ! version_ge "$macos_version" "14.0"; then
33
  printf "\n!!! Error: macOS version is $macos_version. This script requires at least macOS Sonoma (14.0).\n" >&2
34
  exit 1
35
fi
36
printf "\n* macOS version is supported!"
37

38
# Check if Homebrew is installed
39
if ! which brew &>/dev/null; then
40
  printf "\n!!! Error: This script requires Homebrew to install dependencies! Please install Homebrew and try again\n" >&2
41
  exit 1
42
fi
43
printf "\n* Homebrew is installed!"
44

45
printf "\n* Cloning the latest main branch of openssh-portable from GitHub. This may take a while..."
46
git clone --quiet https://github.com/openssh/openssh-portable.git
47
cd openssh-portable
48

49
printf "\n* Installing dependencies from Homebrew: libfido2, openssl, autoconf, automake, libtool\n"
50
brew install libfido2 openssl autoconf automake libtool pkgconf
51

52
printf "\n* Generating configuration script."
53
autoreconf -i
54

55
printf "\n* Exporting flags."
56

57
# Determine the CPU architecture and set the appropriate Homebrew base path
58
if [[ "$(uname -m)" == "arm64" ]]; then
59
  BREW_PREFIX="/opt/homebrew"
60
elif [[ "$(uname -m)" == "x86_64" ]]; then
61
  BREW_PREFIX="/usr/local"
62
else
63
  echo "!!! Error: Unknown CPU architecture $(uname -m).\n" >&2
64
  exit 1
65
fi
66

67
# Get the appropriate paths for the Homebrew dependecies as they differ through version
68
BREW_OPENSSL_PATH=$(ls -d $BREW_PREFIX/Cellar/openssl@3/*)
69
BREW_LIBFIDO2_PATH=$(ls -d $BREW_PREFIX/Cellar/libfido2/*)
70
export CFLAGS="-L$BREW_OPENSSL_PATH/lib -I$BREW_OPENSSL_PATH/include -L$BREW_LIBFIDO2_PATH/lib -I$BREW_LIBFIDO2_PATH/include -Wno-error=implicit-function-declaration"
71
export LDFLAGS="-L$BREW_OPENSSL_PATH/lib -L$BREW_LIBFIDO2_PATH/lib"
72

73
printf "\n* Configuring build. This may take a while..."
74
./configure --quiet --with-security-key-standalone
75

76
printf "\n* Cleaning previous build for good measure."
77
make --quiet clean
78

79
printf "\n* Building OpenSSH Portable."
80
make --quiet
81

82
printf "\n* Copying the Security Key Provider library to /usr/local/lib."
83
printf "\n  We need root privileges to modify system files.\n"
84
sudo mkdir -p /usr/local/lib
85
sudo mv sk-libfido2.dylib /usr/local/lib/
86

87
# Check if the script is running in ZSH. If not, give the user instructions.
88
# Otherwise, modify .zshenv to set the environment variable if not already present.
89
if [[ "$SHELL" == *zsh* ]]; then
90
  printf "\n* Configuring the ~/.zshenv for the System SSH use the Security Key Provider we just built"
91
    if ! grep -q "export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib" "$HOME/.zshenv" &>/dev/null; then
92
        echo "export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib" >> "$HOME/.zshenv"
93
        printf "\n* Added SSH_SK_PROVIDER to ~/.zshenv."
94
    else
95
        printf "\n* SSH_SK_PROVIDER is already configured in ~/.zshenv."
96
    fi
97
else
98
  printf "*\n Since you are not on ZSH, you will need to manually configure your shell profile to tell the System SSH client to use the Security Key Provider we just built."
99
  printf "\n  The shell profile should export the environment variable as follows:"
100
  printf "\n  export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib"
101
fi
102

103
printf "\n* Exiting the directory and deleting the repository we cloned. We don't need it anymore"
104
cd ..
105
rm -rf openssh-portable
106

107
printf "\n\n* That's it! After restarting your terminal session, you can plug in your hardware security key and test the installation using:"
108
printf "\n  ssh-keygen -t ed25519-sk -O resident -O verify-required -C \"Your Comment\""
109
printf "\n\nHave a nice day! :)\n\n"