-
Notifications
You must be signed in to change notification settings - Fork 339
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
p11-kit module file not installed #230
Comments
IMO this is packaging related recommendation that needs to be considered by individual package creators. If included in standard build procedure what would be the correct approach with more than one build of SoftHSM? I guess that distribution package would create |
Maybe I'm missing something, but ... IMHO the build should generate appropriate file for that particular version (with paths used by "configure" script). That way distros can simply use the file (assuming that distro allows to install only 1 version of library at time, which holds e.g. for all Fedora/RHEL/CentOS...). |
@pspacek Yes, that's fairly much how I imagined it would work. |
In order for well-behaved applications to discover and use the PKCS#11 provider module, we should install a p11-kit module file for it.
In order for well-behaved applications to discover and use the PKCS#11 provider module, we should install a p11-kit module file for it.
In order for well-behaved applications to discover and use the PKCS#11 provider module, we should install a p11-kit module file for it.
@pspacek I am not sure I understand. Are you saying that if I first build SoftHSM with Botan crypto backend and |
Yes. That is typically how things like this work, when they install/register themselves as "plugins" to be found automatically by another piece of software. |
So if your patch gets included and generated module file will be adopted by distributions then every local build will mess with the file created by the distribution package? |
Yes. Just like when I have a plugin for something like Pidgin, it installs itself to the correct directory so it gets used. And if I eschew the distribution's provided version of that plugin and rebuild my own for some reason, it installs over the distribution's one. We can make it optional though, if you prefer. |
Great idea. Please make it optional if you can. |
In order for well-behaved applications to discover and use the PKCS#11 provider module, we should install a p11-kit module file for it. Allow this to be disabled by configuring with --disable-p11-kit
Now with --disable-p11-kit to turn it off. Of course now it's optional perhaps I should look at also making it install the module to the system's configured |
Thank you for the patch. Should it also be possible to configure / override the p11_module_path? E.g. if you want to install in another location than the one given by p11-kit. |
In order for well-behaved applications to discover and use the PKCS#11 provider module, we should install a p11-kit module file for it. Allow this to be disabled by configuring with --disable-p11-kit, and do so in the Jenkins builds since they run as an unprivileged user and can't install to the standard p11-kit module directory.
Issue #230: Install p11-kit module file
Issue #230: Move configuration to an M4 script and update documentation
There's not a lot of point in installing to a location where p11-kit isn't going to find it :) I suppose p11-kit will look in |
- See also opendnssec/SoftHSMv2#230 PR: 212518 Submitted by: jaap@NLnetLabs.nl (maintainer) Reported by: dwmw2@infradead.org Tested by: w.schwarzenfeld@utanet.at git-svn-id: svn+ssh://svn.freebsd.org/ports/head@458409 35697150-7ecd-e111-bb59-0022644237b5
- See also opendnssec/SoftHSMv2#230 PR: 212518 Submitted by: jaap@NLnetLabs.nl (maintainer) Reported by: dwmw2@infradead.org Tested by: w.schwarzenfeld@utanet.at git-svn-id: svn+ssh://svn.freebsd.org/ports/head@458409 35697150-7ecd-e111-bb59-0022644237b5
- See also opendnssec/SoftHSMv2#230 PR: 212518 Submitted by: jaap@NLnetLabs.nl (maintainer) Reported by: dwmw2@infradead.org Tested by: w.schwarzenfeld@utanet.at
- See also opendnssec/SoftHSMv2#230 PR: 212518 Submitted by: jaap@NLnetLabs.nl (maintainer) Reported by: dwmw2@infradead.org Tested by: w.schwarzenfeld@utanet.at git-svn-id: svn+ssh://svn.freebsd.org/ports/head@458409 35697150-7ecd-e111-bb59-0022644237b5
- See also opendnssec/SoftHSMv2#230 PR: 212518 Submitted by: jaap@NLnetLabs.nl (maintainer) Reported by: dwmw2@infradead.org Tested by: w.schwarzenfeld@utanet.at
On systems with p11-kit (which should be all modern Linux distributions), PKCS#11 provider modules should be installing a module file which registers the provider with the system and automatically makes it available to well-behaved applications (which includes GnuTLS and the OpenSSL engine_pkcs11, and will soon include NSS too).
Please ensure that running
make install
installs an appropriate module file into the directory indicated bypkg-config --variable p11_module_configs p11-kit-1
The text was updated successfully, but these errors were encountered: