On 2026-07-28T11:35:30, Sergio Prado <[email protected]> wrote: > binman: x509_cert: support PKCS11_PIN environment variable > > Signing an x509 certificate entry with a key held in an HSM needs the > token PIN. It can be put in openssl.cnf via pkcs11-module-token-pin, or > in the PKCS#11 URI itself as a pin-value attribute, but both mean writing > the PIN into a file which is part of the build. That is not > user-friendly in CI, where the PIN typically arrives as a secret in the > environment. > > Read the PIN from the PKCS11_PIN environment variable and append it to > the URI as a percent-encoded pin-value attribute, as described by RFC > 7512. The rewritten URI, not the original, is what reaches > 'openssl -key'. > > PKCS11_PIN is a fallback. A URI which already has a pin-value or a > pin-source attribute is passed through untouched, since the PIN named by > the URI is the one OpenSSL uses; appending a second pin-value would > silently override it, as the last occurrence wins. > > Note that PKCS11_PIN keeps the PIN out of the build files but not off the > openssl command line, where it is visible via 'ps' and may be recorded in > build logs. Configuring the PIN in openssl.cnf remains the option which > avoids that, and this is documented alongside the variable. > > Signed-off-by: Sergio Prado <[email protected]> > > tools/binman/binman.rst | 11 +++++ > tools/binman/etype/x509_cert.py | 31 ++++++++++++ > tools/binman/ftest.py | 105 > ++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 147 insertions(+)
Reviewed-by: Simon Glass <[email protected]>
