python-pkcs11 0.8.0__tar.gz → 0.9.0__tar.gz

python_pkcs11-0.9.0/.github/actions/install-opencryptoki/action.yml

@@ -0,0 +1,58 @@
+name: install-opencryptoki
+author: Matthias Valvekens
+description: Install opencryptoki and configure an empty token
+inputs:
+  os:
+    description: OS to target
+    required: true
+  token-label:
+    description: Label assigned to the token
+    required: true
+  token-user-pin:
+    description: User PIN to configure on the token
+    required: true
+  token-so-pin:
+    description: Security officer PIN to configure on the token
+    required: true
+outputs:
+  module:
+    description: Path to PKCS#11 module
+    value: ${{ steps.install.outputs.module }}
+runs:
+  using: "composite"
+  steps:
+    - name: Install opencryptoki
+      id: install
+      shell: bash
+      run: |
+        if [[ "${OS_NAME:0:6}" == 'ubuntu' ]]; then
+          sudo apt install libcap-dev libldap-dev
+          git clone https://github.com/opencryptoki/opencryptoki
+          cd opencryptoki
+          ./bootstrap.sh
+          ./configure --prefix=/usr --sysconfdir=/etc \
+            --with-pkcs-group=users \
+            --disable-tpmtok --disable-ccatok --disable-ep11tok --disable-icsftok \
+            --disable-p11sak --disable-pkcstok_migrate --disable-pkcsstats
+          make
+          sudo make install
+          sudo ldconfig
+          echo -e "slot 0\n{\nstdll = libpkcs11_sw.so\ntokversion = 3.12\n}" > /tmp/opencryptoki.conf
+          sudo cp /tmp/opencryptoki.conf /etc/opencryptoki/
+          sudo chown root:root /etc/opencryptoki/opencryptoki.conf
+          echo "module=/usr/lib/opencryptoki/libopencryptoki.so" >> "$GITHUB_OUTPUT"
+        else
+          echo "$OS_NAME is not a supported target system"
+          exit 1
+        fi
+      env:
+        OS_NAME: ${{ inputs.os }}
+    - name: Run opencryptoki daemon
+      shell: bash
+      run: sudo -u pkcsslotd pkcsslotd
+    - name: Initialize token
+      shell: bash
+      run: |
+        echo "${{ inputs.token-label }}" | pkcsconf -I -c 0 -S 87654321
+        pkcsconf -P -c 0 -S 87654321 -n "${{ inputs.token-so-pin }}"
+        pkcsconf -u -c 0 -S "${{ inputs.token-so-pin }}" -n "${{ inputs.token-user-pin }}"

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/.github/actions/install-softhsm/action.yml

@@ -7,20 +7,22 @@ inputs:
     required: true
   token-label:
     description: Label assigned to the token
-    required: false
-    default: TEST
+    required: true
   token-user-pin:
     description: User PIN to configure on the token
-    required: false
-    default: "1234"
+    required: true
   token-so-pin:
     description: Security officer PIN to configure on the token
-    required: false
-    default: "5678"
+    required: true
+outputs:
+  module:
+    description: Path to PKCS#11 module
+    value: ${{ steps.install.outputs.module }}
 runs:
   using: "composite"
   steps:
     - name: Install SoftHSM
+      id: install
       shell: bash
       run: |
         if [[ "${OS_NAME:0:6}" == 'ubuntu' ]]; then
@@ -28,14 +30,14 @@ runs:
           mkdir softhsm_tokens
           echo "directories.tokendir = $(pwd)/softhsm_tokens" > /tmp/softhsm2.conf
           echo "SOFTHSM2_CONF=/tmp/softhsm2.conf" >> "$GITHUB_ENV"
-          echo "PKCS11_MODULE=/usr/lib/softhsm/libsofthsm2.so" >> "$GITHUB_ENV"
+          echo "module=/usr/lib/softhsm/libsofthsm2.so" >> "$GITHUB_OUTPUT"
         elif [[ "${OS_NAME:0:5}" == 'macos' ]]; then
           brew install softhsm
-          echo "PKCS11_MODULE=/opt/homebrew/lib/softhsm/libsofthsm2.so" >> "$GITHUB_ENV"
+          echo "module=/opt/homebrew/lib/softhsm/libsofthsm2.so" >> "$GITHUB_OUTPUT"
         elif [[ "${OS_NAME:0:7}" == 'windows' ]]; then
           choco install softhsm.install
           echo "SOFTHSM2_CONF=D:/SoftHSM2/etc/softhsm2.conf" >> "$GITHUB_ENV"
-          echo "PKCS11_MODULE=D:/SoftHSM2/lib/softhsm2-x64.dll" >> "$GITHUB_ENV"
+          echo "module=D:/SoftHSM2/lib/softhsm2-x64.dll" >> "$GITHUB_OUTPUT"
           echo "D:/SoftHSM2/bin" >> "$GITHUB_PATH"
           echo "D:/SoftHSM2/lib" >> "$GITHUB_PATH"
         else
@@ -49,6 +51,3 @@ runs:
       run: |
         softhsm2-util --init-token --free --label "${{ inputs.token-label }}" \
           --pin "${{ inputs.token-user-pin }}" --so-pin "${{ inputs.token-so-pin }}"
-        echo "PKCS11_TOKEN_LABEL=${{ inputs.token-label }}" >> "$GITHUB_ENV"
-        echo "PKCS11_TOKEN_PIN=${{ inputs.token-user-pin }}" >> "$GITHUB_ENV"
-        echo "PKCS11_TOKEN_SO_PIN=${{ inputs.token-so-pin }}" >> "$GITHUB_ENV"

python_pkcs11-0.9.0/.github/actions/test-setup/action.yml

@@ -0,0 +1,87 @@
+name: test-setup
+author: Matthias Valvekens
+description: Perform set-up for python-pkcs11 CI
+inputs:
+  os:
+    description: OS to target
+    required: true
+  python-version:
+    description: Python version to target
+    required: true
+  dependency-group:
+    description: UV dependency group to install
+    required: true
+  pkcs11-platform:
+    description: PKCS#11 platform to target
+    required: true
+  token-label:
+    description: Label assigned to the token
+    required: true
+  token-user-pin:
+    description: User PIN to configure on the token
+    required: true
+  token-so-pin:
+    description: Security officer PIN to configure on the token
+    required: true
+outputs:
+  module:
+    description: Path to PKCS#11 module
+    value: ${{ steps.install-result.outputs.module }}
+  module2:
+    description: Path to alternative PKCS#11 module ('multi' only)
+    value: ${{ steps.install-result.outputs.module2 }}
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ inputs.python-version }}
+    - uses: ./.github/actions/install-softhsm
+      if: inputs.pkcs11-platform == 'softhsm' || inputs.pkcs11-platform == 'multi'
+      id: softhsm
+      with:
+        os: ${{ inputs.os }}
+        token-label: ${{ inputs.token-label }}
+        token-so-pin: ${{ inputs.token-so-pin }}
+        token-user-pin: ${{ inputs.token-user-pin }}
+    - uses: ./.github/actions/install-opencryptoki
+      # only run opencryptoki tests on ubuntu
+      # (macos and windows don't seem to be supported)
+      if: inputs.pkcs11-platform == 'opencryptoki' || inputs.pkcs11-platform == 'multi'
+      id: opencryptoki
+      with:
+        os: ${{ inputs.os }}
+        token-label: ${{ inputs.token-label }}
+        token-so-pin: ${{ inputs.token-so-pin }}
+        token-user-pin: ${{ inputs.token-user-pin }}
+    - name: Set module path
+      id: install-result
+      shell: bash
+      run: |
+        if [[ "$PLATFORM" == 'opencryptoki' ]]; then
+          echo "module=${{ steps.opencryptoki.outputs.module }}" >> "$GITHUB_OUTPUT"
+        elif [[ "$PLATFORM" == 'softhsm' ]]; then
+          echo "module=${{ steps.softhsm.outputs.module }}" >> "$GITHUB_OUTPUT"
+        elif [[ "$PLATFORM" == 'multi' ]]; then
+          # NOTE: the 'multi' platform is only used for testing the code that
+          # swaps between multiple PKCS#11 implementations. As such, any two
+          # PKCS#11 implementations will do. If we add a 3rd platform
+          # to the CI at a later stage that is faster to install than opencryptoki,
+          # switching is an option.
+          echo "module=${{ steps.softhsm.outputs.module }}" >> "$GITHUB_OUTPUT"
+          echo "module2=${{ steps.opencryptoki.outputs.module }}" >> "$GITHUB_OUTPUT"
+        else
+          echo "$PLATFORM is not a valid PKCS#11 platform choice"
+          exit 1
+        fi
+      env:
+        PLATFORM: ${{ inputs.pkcs11-platform }}
+    - name: Install uv
+      uses: astral-sh/setup-uv@v4
+      with:
+        enable-cache: true
+        python-version: ${{ inputs.python-version }}
+    - name: Install testing dependencies
+      shell: bash
+      run: uv sync --no-dev --exact --group "${{ inputs.dependency-group }}"

python_pkcs11-0.9.0/.github/workflows/coverage.yml

@@ -0,0 +1,99 @@
+name: Coverage
+on:
+  pull_request: {}
+  workflow_dispatch: {}
+env:
+  UV_PYTHON_PREFERENCE: only-system
+  UV_NO_SYNC: "1"
+  PKCS11_TOKEN_LABEL: "TEST"
+  PKCS11_TOKEN_PIN: "1234"
+  PKCS11_TOKEN_SO_PIN: "5678"
+jobs:
+  # For now, we run the coverage as a separate job.
+  # At the time of writing, the latest version of Cython's line tracing
+  # seems to lead to segfaults in Python 3.13 -> TODO: investigate
+  pytest-coverage:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        pkcs11-platform:
+          - softhsm
+          - opencryptoki
+    steps:
+      - name: Acquire sources
+        uses: actions/checkout@v4
+      - name: Arm coverage-only compiler directives
+        # Unfortunately, it doesn't seem to be possible to pass directives
+        # to Cython through environment variables: https://github.com/cython/cython/issues/3930
+        # Doing it here is still better than introducing a non-declarative setup.py into the
+        # build again.
+        run: sed -i 's/#coverage#cython/#cython/g' pkcs11/*.pyx
+      - uses: ./.github/actions/test-setup
+        id: setup
+        with:
+          os: ubuntu-latest
+          python-version: "3.12"
+          dependency-group: coverage
+          token-label: ${{ env.PKCS11_TOKEN_LABEL }}
+          token-so-pin: ${{ env.PKCS11_TOKEN_SO_PIN }}
+          token-user-pin: ${{ env.PKCS11_TOKEN_PIN }}
+          pkcs11-platform: ${{ matrix.pkcs11-platform }}
+        env:
+          CFLAGS: "-DCYTHON_TRACE_NOGIL=1"
+          EXT_BUILD_DEBUG: "1"
+      - name: Run tests
+        run: uv run pytest -v --cov=pkcs11 --cov-branch --cov-report=xml:${{ matrix.pkcs11-platform }}-coverage.xml
+        env:
+          PKCS11_MODULE: ${{ steps.setup.outputs.module }}
+      - name: Stash coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-${{ strategy.job-index }}
+          path: "*-coverage.xml"
+  pytest-coverage-multilib:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Acquire sources
+        uses: actions/checkout@v4
+      - uses: ./.github/actions/test-setup
+        id: setup
+        with:
+          os: ubuntu-latest
+          pkcs11-platform: multi
+          token-label: ${{ env.PKCS11_TOKEN_LABEL }}
+          token-so-pin: ${{ env.PKCS11_TOKEN_SO_PIN }}
+          token-user-pin: ${{ env.PKCS11_TOKEN_PIN }}
+          python-version: "3.12"
+          dependency-group: coverage
+      - name: Run tests
+        run: uv run pytest -v --cov=pkcs11 --cov-branch --cov-report=xml:multilib-coverage.xml tests/test_multilib.py
+        env:
+          PKCS11_MODULE: ${{ steps.setup.outputs.module }}
+          PKCS11_MODULE2: ${{ steps.setup.outputs.module2 }}
+      - name: Stash coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-multilib
+          path: "*-coverage.xml"
+  codecov-upload:
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    needs: [pytest-coverage]
+    steps:
+      # checkout necessary to ensure the uploaded report contains the correct paths
+      - uses: actions/checkout@v4
+      - name: Retrieve coverage reports
+        uses: actions/download-artifact@v4
+        with:
+          pattern: coverage-*
+          path: ./reports/
+      - name: Upload all coverage reports to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          directory: ./reports/
+          flags: unittests
+          env_vars: OS,PYTHON
+          name: codecov-umbrella

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/.github/workflows/release.yml

@@ -141,4 +141,4 @@ jobs:
             dist/*.tar.gz
           body_path: release-body/release.md
           fail_on_unmatched_files: true
-          name: python-pkcs11 ${{ needs.extract-params.outputs.version }}
+          name: v${{ needs.extract-params.outputs.version }}

python_pkcs11-0.9.0/.github/workflows/tests.yml

@@ -0,0 +1,85 @@
+name: Tests
+on:
+  push:
+    branches: ["**"]
+  pull_request: {}
+  workflow_dispatch: {}
+env:
+  UV_PYTHON_PREFERENCE: only-system
+  UV_NO_SYNC: "1"
+  PKCS11_TOKEN_LABEL: "TEST"
+  PKCS11_TOKEN_PIN: "1234"
+  PKCS11_TOKEN_SO_PIN: "5678"
+jobs:
+  tests:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      # Our test suite is pretty fast, so fail-fast: false allows for better troubleshooting.
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+          - macos-latest
+        python-version:
+          - "3.9"
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+        pkcs11-platform:
+          - softhsm
+          - opencryptoki
+        exclude:
+          # only run opencryptoki tests on ubuntu
+          # (macos and windows don't seem to be supported)
+          - pkcs11-platform: opencryptoki
+            os: windows-latest
+          - pkcs11-platform: opencryptoki
+            os: macos-latest
+    steps:
+      - name: Acquire sources
+        uses: actions/checkout@v4
+      - uses: ./.github/actions/test-setup
+        id: setup
+        with:
+          os: ${{ matrix.os }}
+          token-label: ${{ env.PKCS11_TOKEN_LABEL }}
+          token-so-pin: ${{ env.PKCS11_TOKEN_SO_PIN }}
+          token-user-pin: ${{ env.PKCS11_TOKEN_PIN }}
+          python-version: ${{ matrix.python-version }}
+          pkcs11-platform: ${{ matrix.pkcs11-platform }}
+          dependency-group: testing
+      - name: Run tests
+        run: uv run pytest -v
+        env:
+          PKCS11_MODULE: ${{ steps.setup.outputs.module }}
+  multilib-tests:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.9"
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+    steps:
+      - name: Acquire sources
+        uses: actions/checkout@v4
+      - uses: ./.github/actions/test-setup
+        id: setup
+        with:
+          os: ubuntu-latest
+          pkcs11-platform: multi
+          token-label: ${{ env.PKCS11_TOKEN_LABEL }}
+          token-so-pin: ${{ env.PKCS11_TOKEN_SO_PIN }}
+          token-user-pin: ${{ env.PKCS11_TOKEN_PIN }}
+          python-version: ${{ matrix.python-version }}
+          dependency-group: testing
+      - name: Run tests
+        run: uv run pytest -v tests/test_multilib.py
+        env:
+          PKCS11_MODULE: ${{ steps.setup.outputs.module }}
+          PKCS11_MODULE2: ${{ steps.setup.outputs.module2 }}

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/.gitignore

@@ -6,4 +6,7 @@ __pycache__
 /dist/
 /docs/_build
 /python_pkcs11.egg-info/
-/.eggs/
+/.eggs/
+.coverage
+*coverage.xml
+*.html

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-pkcs11
-Version: 0.8.0
+Version: 0.9.0
 Summary: PKCS#11 support for Python
 Author-email: Andrey Kislyuk <kislyuk@gmail.com>, Danielle Madeley <danielle@madeley.id.au>
 Maintainer-email: Andrey Kislyuk <kislyuk@gmail.com>
@@ -45,7 +45,8 @@ features.
 
 Historically, this project used to run continuous integration tests against several
 HSM platforms, but this test setup has not been maintained over time. Currently,
-the integration tests in GitHub Actions use SoftHSMv2 as a baseline. If you would like
+the integration tests in GitHub Actions use SoftHSMv2 as a baseline.
+We also test against ``opencryptoki`` in CI. If you would like
 to contribute some CI setup with additional PKCS#11 implementations or actual HSMs,
 let's chat!
 

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/README.rst

@@ -20,7 +20,8 @@ features.
 
 Historically, this project used to run continuous integration tests against several
 HSM platforms, but this test setup has not been maintained over time. Currently,
-the integration tests in GitHub Actions use SoftHSMv2 as a baseline. If you would like
+the integration tests in GitHub Actions use SoftHSMv2 as a baseline.
+We also test against ``opencryptoki`` in CI. If you would like
 to contribute some CI setup with additional PKCS#11 implementations or actual HSMs,
 let's chat!
 

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/extern/load_module.c

@@ -17,9 +17,12 @@ static PyObject* p11_error() {
                     NULL);
         PyObject* errmsg = PyUnicode_FromWideChar(msgbuffer, l);
         LocalFree(msgbuffer);
+        if (errmsg == NULL) {
+            Py_RETURN_NONE;
+        }
         return errmsg;
     } else {
-        return NULL;
+        Py_RETURN_NONE;
     }
 }
 
@@ -57,11 +60,13 @@ static PyObject* p11_error() {
     char* error = dlerror();
 
     if (error == NULL) {
-        return NULL;
+        Py_RETURN_NONE;
     }
     int len = strlen(error);
     PyObject* result = PyUnicode_DecodeUTF8(error, len, NULL);
-    PyMem_Free(error);
+    if (result == NULL) {
+        Py_RETURN_NONE;
+    }
     return result;
 }
 

{python_pkcs11-0.8.0 → python_pkcs11-0.9.0}/extern/pkcs11t.h

@@ -270,6 +270,8 @@ typedef CK_ULONG          CK_USER_TYPE;
 #define CKU_USER                1UL
 /* Context specific */
 #define CKU_CONTEXT_SPECIFIC    2UL
+/* Value used in python-pkcs11 as a sentinel value for non-logged in sessions */
+#define CKU_USER_NOBODY         999UL
 
 /* CK_STATE enumerates the session states */
 typedef CK_ULONG          CK_STATE;

python_pkcs11-0.9.0/pkcs11/__init__.py

@@ -0,0 +1,44 @@
+"""
+:mod:`pkcs11` defines a high-level, "Pythonic" interface to PKCS#11.
+"""
+
+from pkcs11.constants import *  # noqa: F403
+from pkcs11.exceptions import *  # noqa: F403
+from pkcs11.mechanisms import *  # noqa: F403
+from pkcs11.types import *  # noqa: F403
+from pkcs11.util import dh, dsa, ec, rsa, x509  # noqa: F401
+
+_loaded = {}
+
+
+def lib(so):
+    """
+    Wrap the main library call coming from Cython with a preemptive
+    dynamic loading.
+    """
+    global _loaded
+
+    try:
+        _lib = _loaded[so]
+        if not _lib.initialized:
+            _lib.initialize()
+        return _lib
+    except KeyError:
+        pass
+
+    from . import _pkcs11
+
+    _lib = _pkcs11.lib(so)
+    _loaded[so] = _lib
+
+    return _lib
+
+
+def unload(so):
+    global _loaded
+    try:
+        loaded_lib = _loaded[so]
+    except KeyError:
+        return
+    del _loaded[so]
+    loaded_lib.unload()