0.7 does no recognize token-label

[FernandoJCabral]

Updating - 9h22min
Now I have something to ruminate. I kept running the same command again and again, trying to figure out what was going on.
Sometimes it would hang up for a long, long time (like 5, 10, 15 minutes) and then come back with the same error message.
But, after some tries, out of the blue, it started working again...
I am mystified, but the fact is that it is working again.
I'll let the issue as reported bellow, but for the time being, IT IS WORKING.

Thank you.

After installing pyhanko 0.7 the command line I've been using for a long time stop working with the following message:

[cut] 
 File "/home/fernando/.local/lib/python3.8/site-packages/pyhanko/cli.py", line 972, in addsig_pkcs11
    with pkcs11.PKCS11SigningContext(pkcs11_config) as signer:
  File "/home/fernando/.local/lib/python3.8/site-packages/pyhanko/sign/pkcs11.py", line 310, in __enter__
    self._session = session = open_pkcs11_session(
  File "/home/fernando/.local/lib/python3.8/site-packages/pyhanko/sign/pkcs11.py", line 72, in open_pkcs11_session
    raise PKCS11Error(
pkcs11.exceptions.PKCS11Error: No token with label FERNANDO JOSE CASTRO CABRAL:12436666687's AC VALID RFB v5 ID found

(I know this is a long and strange label, but that's what worked with previous versions.)

Command line:

pyhanko sign addsig --field "1/250,200,410,300/Fernando Cabral"  --style-name vereador pkcs11 --lib /usr/lib/libaetpkss.so --token-label "FERNANDO JOSE CASTRO CABRAL:12436666687's AC VALID RFB v5 ID" --cert-label "FERNANDO JOSE CASTRO CABRAL:12436666687's AC VALID RFB v5 ID"  "OF047-2021.pdf" "OF047-2021_assinado.pdf"

OS: Linux Mint 20.2, cinnamon edition

[MatthiasValvekens]

That's strange... I didn't change anything in the way PKCS#11 tokens are accessed recently, so I'm not sure what the problem could be. That routine in particular hasn't changed for over half a year, and doesn't call any other code in pyHanko.

Questions:

• Are you accessing the device over a network connection?
• Can you reproduce the behaviour with earlier versions?
• If not, how about a more minimal piece of PKCS#11 signing code that doesn't use PDF?
• Can you try looking up the slot number of the token (using something like pkcs11-tool) and pass it in via the --slot-no parameter? That bypasses the (possibly slow) search for matching tokens.

From the behaviour you describe, I'd assume that the problem is somewhere between the PKCS#11 module and the device, but I can't say for sure.

[FernandoJCabral]

Thank you, Matthias. As per the editing I did some minutes after opening the issue, pythanko started working again. I will presume, for the time being, that I had some hardware issue or perhaps a combination of some rare phenomena that interfered with the software. I would suspect my typing and my eyes if I were typing the command. But, since it is in a shell script that has not been changed, typing can not be issue.

Please, consider this to be a non-issue. If it happens again, I'll let you know.

Thank you again.

[MatthiasValvekens]

OK, that's good news. I'll close this issue for now, then. :)