[tang] Add plugin for the Tang NBDE server

[suraj-cmd]

sos covers the client side of network-bound disk encryption — block.py runs
clevis luks list against LUKS devices — but has no plugin for the Tang server
itself. An sosreport taken from a Tang host currently contains nothing about
the service, which is the side most often at fault when clients hang at boot
waiting to unlock.

The plugin collects the socket unit drop-in directory, service status, the
tangd journal, and tang-show-keys, which reports only the thumbprints of
advertised keys.

The key database is handled deliberately. /var/db/tang holds Tang's signing
and exchange keys; collecting that material would expose the ability to unlock
every volume bound to the server. The JWK files are therefore added to the
forbidden paths and only a directory listing is taken. That listing still shows
the key set, ownership and rotation state, since retired keys are renamed with
a leading dot rather than deleted.

Both the default /var/db/tang and the older /usr/share/tang/db location are
covered.

I do not have a Tang server to test against, so confirmation of the key
database path on current releases and of the tangd@.service unit name would
be welcome. The forbidden-path handling is the part I would most like a second
opinion on — the intent is that no private key material can be collected under
any option combination, including --all-logs.

---

Please place an 'X' inside each '[]' to confirm you adhere to our Contributor Guidelines

• Is the commit message split over multiple lines and hard-wrapped at 72 characters?
• Is the subject and message clear and concise?
• Does the subject start with [plugin_name] if submitting a plugin patch or a [section_name] if part of the core sosreport code?
• Does the commit contain a Signed-off-by: First Lastname email@example.com?
• Are any related Issues or existing PRs properly referenced via a Closes (Issue) or Resolved (PR) line?
• Are all passwords or private data gathered by this PR obfuscated?

[packit-as-a-service]

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

• sudo dnf install -y 'dnf*-command(copr)'
• dnf copr enable packit/sosreport-sos-4418
• And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

[bmr-cymru]

Running on an F43 test system with tangd enabled & a set of rotated keys in /var/db/tang:

# bin/sos report -v --batch --build -o tang

sos report (version 4.11.2)

This command will collect system configuration and diagnostic
information from this Fedora Linux system.

For more information on the Fedora Project visit:

        Community Website : https://fedoraproject.org/
        Community Forums  : https://discussion.fedoraproject.org/

The generated archive may contain data considered sensitive and its
content should be reviewed by the originating organization before being
passed to any third party.

No changes will be made to system configuration.



 Setting up archive ...
 Setting up plugins ...
 Running plugins. Please wait ...

  Starting 1/1   tang            [Running: tang]

  Finished running plugins

Starting post-processing of collected data
Your sos report build tree has been generated in:
        /var/tmp/sosreport-f42-snapm-vm1-2026-08-10-daukpqc

Output:

# ls -la /var/tmp/sosreport-f42-snapm-vm1-2026-08-10-daukpqc/sos_commands/tang/
total 16
drwx------. 2 root root 164 Aug 10 16:20 .
drwxr-xr-x. 3 root root  18 Aug 10 16:20 ..
-rw-r--r--. 1 root root 178 Aug 10 16:20 journalctl_--no-pager_--unit_tangd.socket_--unit_tangd_.service
-rw-r--r--. 1 root root 676 Aug 10 16:20 ls_-alZ_.var.db.tang
-rw-r--r--. 1 root root 868 Aug 10 16:20 systemctl_status_tangd.socket
-rw-r--r--. 1 root root  43 Aug 10 16:20 tang-show-keys
# cat /var/tmp/sosreport-f42-snapm-vm1-2026-08-10-daukpqc/sos_commands/tang/ls_-alZ_.var.db.tang 
total 20
drwx------. 2 tang tang system_u:object_r:tangd_db_t:s0     4096 Aug 10 16:19 .
drwxr-xr-x. 4 root root system_u:object_r:system_db_t:s0      30 Aug 10 16:14 ..
-r--r-----. 1 tang tang system_u:object_r:tangd_db_t:s0      361 Aug 10 16:15 .1L_KDBWChZhC0xaszdiKeDWiYLqNweVesMu8iOtPwg8.jwk
-r--r-----. 1 tang tang system_u:object_r:tangd_db_t:s0      367 Aug 10 16:15 .a4jE6x8ZfJs6yTd5y9TVpsEhqFT2uVgk6j_C1EwbWqM.jwk
-r--r-----. 1 tang tang unconfined_u:object_r:tangd_db_t:s0  354 Aug 10 16:19 gY5fonFdVGPjMO8YtDz-124HX88CmbaKmrsujU3jyKA.jwk
-r--r-----. 1 tang tang unconfined_u:object_r:tangd_db_t:s0  349 Aug 10 16:19 zek7tMU64Ei9iy-phXHDm3HlCeuQkp__xU6SOucNUtg.jwk

Strictly speaking, the add_forbidden_path() calls are redundant since the plugin does not currently call add_copy_spec() for any of the covered paths—that said, I like it, I think they are correct, and I think they should be retained: it provides useful documentation for anyone modifying the plugin in future.

[suraj-cmd]

@bmr-cymru Thank you for taking the time to stand up a test system for this — the rotation
state in that listing is exactly what the plugin was meant to surface, and good
to see it confirmed against a real deployment.

Agreed on add_forbidden_path() being redundant as the plugin stands. I'd rather
keep it for the reason you give: if someone later adds an add_copy_spec() for
the key directory, the exclusion is already in place rather than needing to be
remembered.

One question before I touch this branch. On #4429 @TurboTurtle noted that
declaring units in the services tuple collects status and journal
automatically and acts as an additional enable trigger, and asked for that
across the new plugins. For tang that would mean services = ('tangd.socket',)
with the explicit calls removed. Since this is already approved and tested, I
didn't want to force-push and reset your review — would you prefer I make that
change here, or leave it as-is?

[bmr-cymru]

would you prefer I make that change here, or leave it as-is?

I'm fine with pulling it into this PR. The test system is one I keep around for snapm/stratis work (which supports tang), so I can re-test easily.

[suraj-cmd]

@bmr-cymru or @arif-ali can we gohead with merge or is there any problem here ?

[pmoravec]

LGTM