[Rpm-maint] [rpm-software-management/rpm] rpmsign: enable signing files with PKCS11 tokens (PR #4125)

[Simo Sorce]

simo5 left a comment (rpm-software-management/rpm#4125)

The ideal change uses the STORE API to load a URI (regardless of whether the key is a PEM file or a pkcs11: URI or a tpm: URI, etc... and leaves it to openssl to figure out what provider to use, and fail if the provider is not loaded by configuration.

The pkcs11-provider does not initialize the pkcs11 module (unless it is configured to force early initialization) until openssl encounters a URI that starts with "pkcs11:" or is explicitly asked to fetch an algorithm implementation from the provider. So generally there is no cost to have it pre-configured in the environment that needs to perform signatures.

And given you have to configure the environment to specify the HSM driver (and possibly the PIN to use), it may make sense to rely on the configuration to have it loaded, so openssl wil complain it does not know anything about pkcs11 URIs rather then return some cryptic error.

The error may be confusing because in many OSs the pkcs11-provider is compiled to use the p11-kit driver that tries to load any available driver, so instead of openssl telling you that it deosn't have pkcs11-provider configure, it will claim the pkcs11 module failed to initialize.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4125#issuecomment-4012328908
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4125/c4012328908 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260306/2bb5b3d9/attachment.htm>