[PATCH] systemd: break circular dependency with libfido2

[PATCH] systemd: break circular dependency with libfido2

[Dan McGregor]

From: Dan McGregor <danmcgr@protonmail.com>

libfido2 depends on udev, and when the fido2 feature is enabled
in systemd, systemd depends on libfido2. However, systemd really
only needs libfido2's headers at build time. It uses dlopen to
opportunistically enable the features at runtime. Break this
circular dependency by creating a recipe that provides libfido2's
headers and pkgconfig file. That allows systemd to build with
fido2 enabled and allows libfido2 do build as well.

Signed-off-by: Dan McGregor <danmcgr@protonmail.com>
---
 ...meson-use-libfido2_cflags-dependency.patch | 53 +++++++++++++++++++
 meta/recipes-core/systemd/systemd_259.3.bb    |  3 +-
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/systemd/systemd/0001-meson-use-libfido2_cflags-dependency.patch

diff --git a/meta/recipes-core/systemd/systemd/0001-meson-use-libfido2_cflags-dependency.patch b/meta/recipes-core/systemd/systemd/0001-meson-use-libfido2_cflags-dependency.patch
new file mode 100644
index 00000000000..e65dde10c32
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0001-meson-use-libfido2_cflags-dependency.patch
@@ -0,0 +1,53 @@
+From 97142fd1db4124de5d5bdd3f49cc5a390286e522 Mon Sep 17 00:00:00 2001
+From: Dan McGregor <danmcgr@protonmail.com>
+Date: Wed, 11 Mar 2026 18:26:05 -0600
+Subject: [PATCH] meson: use libfido2_cflags dependency
+
+Add the libfido2 dependency to cryptenroll and cryptsetup's
+meson files. If libfido2's not installed in the default path
+the build wasn't finding its headers correctly.
+
+Upstream-Status: Backport [https://github.com/systemd/systemd/commit/9ce905e35f690e7a10cd286be2b50594d0857f5e]
+---
+ src/cryptenroll/meson.build                  | 1 +
+ src/cryptsetup/cryptsetup-tokens/meson.build | 2 +-
+ src/cryptsetup/meson.build                   | 1 +
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/cryptenroll/meson.build b/src/cryptenroll/meson.build
+index 488ceea14d..11265c8b41 100644
+--- a/src/cryptenroll/meson.build
++++ b/src/cryptenroll/meson.build
+@@ -23,6 +23,7 @@ executables += [
+                 'dependencies' : [
+                         libcryptsetup,
+                         libdl,
++                        libfido2_cflags,
+                         libopenssl,
+                         libp11kit_cflags,
+                 ],
+diff --git a/src/cryptsetup/cryptsetup-tokens/meson.build b/src/cryptsetup/cryptsetup-tokens/meson.build
+index 804e18bc67..0fd6309201 100644
+--- a/src/cryptsetup/cryptsetup-tokens/meson.build
++++ b/src/cryptsetup/cryptsetup-tokens/meson.build
+@@ -58,7 +58,7 @@ modules += [
+                 'sources' : cryptsetup_token_systemd_fido2_sources,
+                 'dependencies' : [
+                         libcryptsetup,
+-                        libfido2,
++                        libfido2_cflags,
+                 ],
+         },
+         template + {
+diff --git a/src/cryptsetup/meson.build b/src/cryptsetup/meson.build
+index d9778259c2..b36354fb0a 100644
+--- a/src/cryptsetup/meson.build
++++ b/src/cryptsetup/meson.build
+@@ -19,6 +19,7 @@ executables += [
+                 'sources' : systemd_cryptsetup_sources,
+                 'dependencies' : [
+                         libcryptsetup,
++                        libfido2_cflags,
+                         libmount_cflags,
+                         libopenssl,
+                         libp11kit_cflags,
diff --git a/meta/recipes-core/systemd/systemd_259.3.bb b/meta/recipes-core/systemd/systemd_259.3.bb
index a244df75c06..1504090f58c 100644
--- a/meta/recipes-core/systemd/systemd_259.3.bb
+++ b/meta/recipes-core/systemd/systemd_259.3.bb
@@ -33,6 +33,7 @@ SRC_URI += " \
            file://0001-binfmt-Don-t-install-dependency-links-at-install-tim.patch \
            file://0002-implment-systemd-sysv-install-for-OE.patch \
            file://0003-Do-not-create-var-log-README.patch \
+           file://0001-meson-use-libfido2_cflags-dependency.patch \
            "
 
 PAM_PLUGINS = " \
@@ -122,7 +123,7 @@ PACKAGECONFIG[default-compression-xz] = "-Dxz=true -Ddefault-compression=xz,,xz"
 PACKAGECONFIG[default-compression-zstd] = "-Dzstd=true -Ddefault-compression=zstd,,zstd"
 PACKAGECONFIG[efi] = "-Defi=true -Dbootloader=enabled,-Defi=false -Dbootloader=disabled,python3-pyelftools-native"
 PACKAGECONFIG[elfutils] = "-Delfutils=enabled,-Delfutils=disabled,elfutils,,libelf libdw"
-PACKAGECONFIG[fido] = "-Dlibfido2=enabled,-Dlibfido2=disabled,libfido2"
+PACKAGECONFIG[fido] = "-Dlibfido2=enabled,-Dlibfido2=disabled,libfido2-initial"
 PACKAGECONFIG[firstboot] = "-Dfirstboot=true,-Dfirstboot=false"
 PACKAGECONFIG[repart] = "-Drepart=enabled,-Drepart=disabled"
 PACKAGECONFIG[homed] = "-Dhomed=enabled,-Dhomed=disabled"

Patchtest results for [PATCH] systemd: break circular dependency with libfido2

[patchtest]

[-- Attachment #1: Type: text/plain, Size: 2145 bytes --]

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/systemd-break-circular-dependency-with-libfido2.patch

FAIL: test Signed-off-by presence: A patch file has been added without a Signed-off-by tag: '0001-meson-use-libfido2_cflags-dependency.patch' (test_patch.TestPatch.test_signed_off_by_presence)

PASS: test CVE tag format (test_patch.TestPatch.test_cve_tag_format)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test Upstream-Status presence (test_patch.TestPatch.test_upstream_status_presence_format)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!