Re: [bulk] PKCS#11 platform integration

2015-05-09 Thread David Woodhouse
On Fri, 2015-05-08 at 15:00 -0700, Ryan Sleevi wrote: On Fri, May 8, 2015 6:09 am, David Woodhouse wrote: On Linux distributions it *is* the platform's mechanism of choice for configuring PKCS#11 tokens. NSS needs to support it if it wants to integrate with the platform properly. I'm

Re: [bulk] PKCS#11 platform integration

2015-05-08 Thread Wouter Verhelst
On 08-05-15 15:09, David Woodhouse wrote: On Fri, 2015-05-08 at 14:58 +0200, Wouter Verhelst wrote: In light of that, it would be great if firefox/libnss were to allow configuration of PKCS#11 modules externally -- not just on Linux, but on OSX and Windows too. Well, p11-kit does build on OSX

Re: [bulk] PKCS#11 platform integration

2015-05-08 Thread Wouter Verhelst
On 08-05-15 15:46, David Woodhouse wrote: FWIW on Linux your installer/package needs to be shipping a module file like the one in /usr/share/p11-kit/modules/opensc.module Well, since p11-kit is not found on the older distributions that we still support, and non-functional on some newer

Re: [bulk] PKCS#11 platform integration

2015-05-08 Thread David Woodhouse
On Fri, 2015-05-08 at 15:23 +0200, Wouter Verhelst wrote: On 08-05-15 15:09, David Woodhouse wrote: On Fri, 2015-05-08 at 14:58 +0200, Wouter Verhelst wrote: In light of that, it would be great if firefox/libnss were to allow configuration of PKCS#11 modules externally -- not just on

Re: [bulk] PKCS#11 platform integration

2015-05-08 Thread Wouter Verhelst
On 08-05-15 14:38, David Woodhouse wrote: Bug 248722¹ has been open since 2004 requesting a system-wide configuration for PKCS#11 modules. At the time, such a thing didn't exist. These days it does. Modern systems ship with p11-kit², which exists precisely to fill that gap and provide a

Re: [bulk] PKCS#11 platform integration

2015-05-08 Thread David Woodhouse
On Fri, 2015-05-08 at 14:58 +0200, Wouter Verhelst wrote: In light of that, it would be great if firefox/libnss were to allow configuration of PKCS#11 modules externally -- not just on Linux, but on OSX and Windows too. Well, p11-kit does build on OSX and Windows too but it doesn't have the

Re: [bulk] PKCS#11 platform integration

2015-05-08 Thread Ryan Sleevi
On Fri, May 8, 2015 6:09 am, David Woodhouse wrote: On Linux distributions it *is* the platform's mechanism of choice for configuring PKCS#11 tokens. NSS needs to support it if it wants to integrate with the platform properly. I'm sorry to continually push back on this, but you continue to