python-pkcs11 0.9.4__tar.gz → 0.10.0__tar.gz

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/.github/actions/install-softhsm/action.yml

@@ -26,7 +26,19 @@ runs:
       shell: bash
       run: |
         if [[ "${OS_NAME:0:6}" == 'ubuntu' ]]; then
-          sudo apt-get install softhsm2
+          openssl version
+          # Build SoftHSM2 devel from source so that ML-DSA autodetects via
+          # the OpenSSL 3.5+ already present on ubuntu-26.04
+          # TODO pin this to an actual ref once there's a release with ML-DSA support
+          sudo apt-get install -y libssl-dev
+          git clone --depth 1 https://github.com/softhsm/SoftHSMv2
+          cd SoftHSMv2
+          ./autogen.sh
+          ./configure --prefix=/usr --disable-gost --enable-mldsa
+          make -j"$(nproc)"
+          sudo make install
+          sudo ldconfig
+          cd ..
           mkdir softhsm_tokens
           echo "directories.tokendir = $(pwd)/softhsm_tokens" > /tmp/softhsm2.conf
           echo "SOFTHSM2_CONF=/tmp/softhsm2.conf" >> "$GITHUB_ENV"

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/.github/workflows/coverage.yml

@@ -15,7 +15,7 @@ jobs:
   # At the time of writing, the latest version of Cython's line tracing
   # seems to lead to segfaults in Python 3.13 -> TODO: investigate
   pytest-coverage:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         pkcs11-platform:
@@ -53,7 +53,7 @@ jobs:
           name: coverage-${{ strategy.job-index }}
           path: "*-coverage.xml"
   pytest-coverage-multilib:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Acquire sources
         uses: actions/checkout@v6

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/.github/workflows/tests.yml

@@ -18,11 +18,10 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - ubuntu-latest
+          - ubuntu-26.04
           - windows-latest
           - macos-14
         python-version:
-          - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
@@ -56,12 +55,11 @@ jobs:
         env:
           PKCS11_MODULE: ${{ steps.setup.outputs.module }}
   multilib-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
         python-version:
-          - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-pkcs11
-Version: 0.9.4
+Version: 0.10.0
 Summary: PKCS#11 support for Python
 Author-email: Andrey Kislyuk <kislyuk@gmail.com>, Danielle Madeley <danielle@madeley.id.au>
 Maintainer-email: Andrey Kislyuk <kislyuk@gmail.com>
@@ -11,14 +11,13 @@ Project-URL: Issues, https://github.com/pyauth/python-pkcs11/issues
 Project-URL: Repository, https://github.com/pyauth/python-pkcs11
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security :: Cryptography
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 Requires-Dist: asn1crypto>=1.5.1
@@ -320,11 +319,15 @@ Tested Compatibility
 |        +---------------------+--------------+-----------------+              |                   |
 |        | Derive Key          | Works        | Caveats [7]_    |              |                   |
 +--------+---------------------+--------------+-----------------+--------------+-------------------+
-| EC     | Generate key pair   | Caveats [6]_ | ? [3]_          | N/A          | Works             |
-|        +---------------------+--------------+-----------------+              +-------------------+
-|        | Sign/Verify (ECDSA) | Works [4]_   | ? [3]_          |              | Sign only [9]_    |
-|        +---------------------+--------------+-----------------+              +-------------------+
-|        | Derive key (ECDH)   | Works        | ? [3]_          |              | ?                 |
+| EC     | Generate key pair   | Caveats [6]_ | ? [3]_          | Works        | Works             |
+|        +---------------------+--------------+-----------------+--------------+-------------------+
+|        | Sign/Verify (ECDSA) | Works [4]_   | ? [3]_          | Works        | Sign only [9]_    |
+|        +---------------------+--------------+-----------------+--------------+-------------------+
+|        | Derive key (ECDH)   | Works        | ? [3]_          | Works        | ?                 |
++--------+---------------------+--------------+-----------------+--------------+-------------------+
+| ML-DSA | Generate key pair   | Works        | ? [3]_          | Works        | N/A               |
+|        +---------------------+--------------+-----------------+--------------+                   |
+|        | Sign/Verify         | Works        | ? [3]_          | Works        |                   |
 +--------+---------------------+--------------+-----------------+--------------+-------------------+
 | Proprietary extensions       | N/A          | Not implemented | N/A          | N/A               |
 +------------------------------+--------------+-----------------+--------------+-------------------+
@@ -341,7 +344,7 @@ Tested Compatibility
 
 Python version:
 
-* >= 3.9
+* >= 3.10
 
 PKCS#11 versions:
 
@@ -349,6 +352,7 @@ PKCS#11 versions:
 * 2.20
 * 2.40
 * 3.1
+* 3.2
 
 Feel free to send pull requests for any functionality that's not exposed. The
 code is designed to be readable and expose the PKCS #11 spec in a

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/README.rst

@@ -294,11 +294,15 @@ Tested Compatibility
 |        +---------------------+--------------+-----------------+              |                   |
 |        | Derive Key          | Works        | Caveats [7]_    |              |                   |
 +--------+---------------------+--------------+-----------------+--------------+-------------------+
-| EC     | Generate key pair   | Caveats [6]_ | ? [3]_          | N/A          | Works             |
-|        +---------------------+--------------+-----------------+              +-------------------+
-|        | Sign/Verify (ECDSA) | Works [4]_   | ? [3]_          |              | Sign only [9]_    |
-|        +---------------------+--------------+-----------------+              +-------------------+
-|        | Derive key (ECDH)   | Works        | ? [3]_          |              | ?                 |
+| EC     | Generate key pair   | Caveats [6]_ | ? [3]_          | Works        | Works             |
+|        +---------------------+--------------+-----------------+--------------+-------------------+
+|        | Sign/Verify (ECDSA) | Works [4]_   | ? [3]_          | Works        | Sign only [9]_    |
+|        +---------------------+--------------+-----------------+--------------+-------------------+
+|        | Derive key (ECDH)   | Works        | ? [3]_          | Works        | ?                 |
++--------+---------------------+--------------+-----------------+--------------+-------------------+
+| ML-DSA | Generate key pair   | Works        | ? [3]_          | Works        | N/A               |
+|        +---------------------+--------------+-----------------+--------------+                   |
+|        | Sign/Verify         | Works        | ? [3]_          | Works        |                   |
 +--------+---------------------+--------------+-----------------+--------------+-------------------+
 | Proprietary extensions       | N/A          | Not implemented | N/A          | N/A               |
 +------------------------------+--------------+-----------------+--------------+-------------------+
@@ -315,7 +319,7 @@ Tested Compatibility
 
 Python version:
 
-* >= 3.9
+* >= 3.10
 
 PKCS#11 versions:
 
@@ -323,6 +327,7 @@ PKCS#11 versions:
 * 2.20
 * 2.40
 * 3.1
+* 3.2
 
 Feel free to send pull requests for any functionality that's not exposed. The
 code is designed to be readable and expose the PKCS #11 spec in a

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/docs/conf.py

@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 #
 # Python PKCS#11 documentation build configuration file, created by
 # sphinx-quickstart on Sat May 20 11:47:34 2017.

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/extern/load_module.c

@@ -38,6 +38,7 @@ static P11_HANDLE* p11_open(PyObject *path_str) {
              result = (P11_HANDLE*) PyMem_Malloc(sizeof(P11_HANDLE));
              result->lib_handle = handle;
              result->get_function_list_ptr = ptr;
+             result->get_interface_ptr = GetProcAddress(handle, "C_GetInterface");
         }
     }
     return result;
@@ -85,6 +86,7 @@ static P11_HANDLE* p11_open(PyObject *path_str) {
              result = (P11_HANDLE*) PyMem_Malloc(sizeof(P11_HANDLE));
              result->lib_handle = handle;
              result->get_function_list_ptr = ptr;
+             result->get_interface_ptr = dlsym(handle, "C_GetInterface");
         }
     }
     return result;

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/extern/load_module.h

@@ -12,7 +12,8 @@ typedef void *LIB_HANDLE;
 #ifndef P11_HANDLE
 typedef struct P11_HANDLE {
     LIB_HANDLE lib_handle;
-    void * get_function_list_ptr;
+    void *get_function_list_ptr;
+    void *get_interface_ptr;  /* C_GetInterface direct export; NULL for v2.0 libs */
 } P11_HANDLE;
 #endif
 

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/extern/pkcs11.h

@@ -1,17 +1,14 @@
-/*
- * PKCS #11 Specification Version 3.1
- * OASIS Standard
- * 23 July 2023
- * Copyright (c) OASIS Open 2023. All Rights Reserved.
- * Source: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/include/pkcs11-v3.1/
- * Latest stage of narrative specification: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/pkcs11-spec-v3.1.html
- * TC IPR Statement: https://www.oasis-open.org/committees/pkcs11/ipr.php 
+/* Copyright (c) OASIS Open 2016,2019,2024. All Rights Reserved./
  * /Distributed under the terms of the OASIS IPR Policy,
- * [https://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
+ * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
  * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
  * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
  */
 
+/* Latest version of the specification:
+ * http://docs.oasis-open.org/pkcs11/pkcs11-base/v3.2/pkcs11-base-v3.2.html
+ */
+
 #ifndef _PKCS11_H_
 #define _PKCS11_H_ 1
 
@@ -72,7 +69,7 @@ extern "C" {
  *   CK_VOID_PTR pReserved
  * );
  *
- * If you're using Windows to declare a function in a Win32 Cryptoki .dll, 
+ * If you're using Windows to declare a function in a Win32 Cryptoki .dll,
  * it might be defined by:
  *
  * #define CK_DECLARE_FUNCTION(returnType, name) \
@@ -208,6 +205,21 @@ extern "C" {
 #define CK_PKCS11_FUNCTION_INFO(name) \
   __PASTE(CK_,name) name;
 
+/* Create the 3.2 Function list */
+struct CK_FUNCTION_LIST_3_2 {
+
+  CK_VERSION    version;  /* Cryptoki version */
+
+/* Pile all the function pointers into the CK_FUNCTION_LIST. */
+/* pkcs11f.h has all the information about the Cryptoki
+ * function prototypes.
+ */
+#include "pkcs11f.h"
+
+};
+
+#define CK_PKCS11_3_0_ONLY 1   /* don't include the 3.2 and later functions */
+
 /* Create the 3.0 Function list */
 struct CK_FUNCTION_LIST_3_0 {
 
@@ -221,7 +233,9 @@ struct CK_FUNCTION_LIST_3_0 {
 
 };
 
-#define CK_PKCS11_2_0_ONLY 1
+#undef CK_PKCS11_3_0_ONLY
+
+#define CK_PKCS11_2_0_ONLY 1   /* don't include the 3.0 and later functions */
 
 /* Continue to define the old CK_FUNCTION_LIST */
 struct CK_FUNCTION_LIST {
@@ -246,4 +260,5 @@ struct CK_FUNCTION_LIST {
 }
 #endif
 
-#endif /* _PKCS11_H_ */
+#endif /* _PKCS11_H_ */
+

{python_pkcs11-0.9.4 → python_pkcs11-0.10.0}/extern/pkcs11f.h

@@ -1,17 +1,14 @@
-/*
- * PKCS #11 Specification Version 3.1
- * OASIS Standard
- * 23 July 2023
- * Copyright (c) OASIS Open 2023. All Rights Reserved.
- * Source: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/include/pkcs11-v3.1/
- * Latest stage of narrative specification: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/pkcs11-spec-v3.1.html
- * TC IPR Statement: https://www.oasis-open.org/committees/pkcs11/ipr.php 
+/* Copyright (c) OASIS Open 2016, 2019, 2024. All Rights Reserved./
  * /Distributed under the terms of the OASIS IPR Policy,
- * [https://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
+ * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
  * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
  * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
  */
 
+/* Latest version of the specification:
+ * http://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.2/pkcs11-spec-v3.2.html
+ */
+
 /* This header file contains pretty much everything about all the
  * Cryptoki function prototypes.  Because this information is
  * used for more than just declaring function prototypes, the
@@ -1196,4 +1193,138 @@ CK_PKCS11_FUNCTION_INFO(C_MessageVerifyFinal)
 );
 #endif
 
-#endif /* CK_PKCS11_2_0_ONLY */
+#ifndef CK_PKCS11_3_0_ONLY
+CK_PKCS11_FUNCTION_INFO(C_EncapsulateKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR pMechanism,   /* the encapsulation mechanism */
+  CK_OBJECT_HANDLE hPublicKey,   /* the encapsulating key */
+  CK_ATTRIBUTE_PTR pTemplate,    /* new key template */
+  CK_ULONG ulAttributeCount,     /* template length */
+  CK_BYTE_PTR pCiphertext,       /* the wrapped key */
+  CK_ULONG_PTR pulCiphertextLen, /* the wrapped key size */
+  CK_OBJECT_HANDLE_PTR phKey     /* the encapsulated key */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_DecapsulateKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR pMechanism,   /* the decapsulation mechanism */
+  CK_OBJECT_HANDLE hPrivateKey,  /* the decapsulating key */
+  CK_ATTRIBUTE_PTR pTemplate,    /* new key template */
+  CK_ULONG ulAttributeCount,     /* template length */
+  CK_BYTE_PTR pCiphertext,       /* the wrapped key */
+  CK_ULONG ulCiphertextLen,      /* the wrapped key size */
+  CK_OBJECT_HANDLE_PTR phKey     /* the decapsulated key */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_VerifySignatureInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR pMechanism,   /* the verification mechanism */
+  CK_OBJECT_HANDLE hKey,         /* verification key */
+  CK_BYTE_PTR pSignature,        /* signature */
+  CK_ULONG ulSignatureLen        /* signature length */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_VerifySignature)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_BYTE_PTR pData,             /* signed data */
+  CK_ULONG ulDataLen             /* length of signed data */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_VerifySignatureUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_BYTE_PTR pPart,             /* signed data */
+  CK_ULONG ulPartLen             /* length of signed data */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_VerifySignatureFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+   CK_SESSION_HANDLE hSession    /* the session's handle */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_GetSessionValidationFlags)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,             /* the session's handle */
+  CK_SESSION_VALIDATION_FLAGS_TYPE type,  /* which state of flags */
+  CK_FLAGS_PTR pFlags                     /* validation flags */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_AsyncComplete)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,      /* the session's handle */
+  CK_UTF8CHAR_PTR pFunctionName,   /* pkcs11 function name */
+  CK_ASYNC_DATA_PTR pResult        /* operation result */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_AsyncGetID)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_UTF8CHAR_PTR pFunctionName, /* pkcs11 function name */
+  CK_ULONG_PTR pulID             /* persistent operation id */
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_AsyncJoin)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_UTF8CHAR_PTR pFunctionName, /* pkcs11 function name */
+  CK_ULONG ulID,                 /* persistent operation id */
+  CK_BYTE_PTR pData,             /* location for the data */
+  CK_ULONG ulData
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_WrapKeyAuthenticated)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,
+  CK_MECHANISM_PTR pMechanism,
+  CK_OBJECT_HANDLE hWrappingKey,
+  CK_OBJECT_HANDLE hKey,
+  CK_BYTE_PTR pAssociatedData,
+  CK_ULONG ulAssociatedDataLen,
+  CK_BYTE_PTR pWrappedKey,
+  CK_ULONG_PTR pulWrappedKeyLen
+);
+#endif
+
+CK_PKCS11_FUNCTION_INFO(C_UnwrapKeyAuthenticated)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,
+  CK_MECHANISM_PTR pMechanism,
+  CK_OBJECT_HANDLE hUnwrappingKey,
+  CK_BYTE_PTR pWrappedKey,
+  CK_ULONG ulWrappedKeyLen,
+  CK_ATTRIBUTE_PTR pTemplate,
+  CK_ULONG ulAttributeCount,
+  CK_BYTE_PTR pAssociatedData,
+  CK_ULONG ulAssociatedDataLen,
+  CK_OBJECT_HANDLE_PTR phKey
+);
+#endif
+
+#endif /* CK_PKCS11_3_0_ONLY */
+#endif /* CK_PKCS11_2_0_ONLY */