Hi Yan, On 2026-10-23T09:06:06, yan wang <[email protected]> wrote: > binman: bintool: Add PKCS#11 HSM signing support > > Implement signing through pkcs11-tool using the PKCS#11 interface, > allowing binman to use private keys held by an HSM. > > The implementation: > - adds the public method find_slot_by_serial() to resolve an > HSM token serial number to its slot index; > - selects tokens by label or slot index; > - selects signing keys by label or object ID; > - verifies that the requested mechanism is supported; > - writes signatures through pkcs11-tool's output-file interface; > - passes the HSM PIN through BINMAN_PKCS11_PIN and references it as > env:BINMAN_PKCS11_PIN; > - requires a PIN and enables PKCS#11 login for signing. > > Add comprehensive unit tests covering token and key selection, > mechanism validation, signing failures, and successful signatures. > > Signed-off-by: yan wang <[email protected]> > > tools/binman/bintool.py | 8 +- > tools/binman/bintool_test.py | 497 > ++++++++++++++++++++++++++++++++++++++ > tools/binman/btool/pkcs11_tool.py | 339 +++++++++++++++++++++++++- > 3 files changed, 837 insertions(+), 7 deletions(-)
> diff --git a/tools/binman/bintool.py b/tools/binman/bintool.py > @@ -273,7 +273,7 @@ class Bintool: > - def run_cmd_result(self, *args, binary=False, raise_on_error=True): > + def run_cmd_result(self, *args, binary=False, raise_on_error=True, > env=None): Please can you add 'env' to the Args: section of the docstring, e.g. a dict of extra environment variables to set when running the tool. > diff --git a/tools/binman/btool/pkcs11_tool.py > b/tools/binman/btool/pkcs11_tool.py > @@ -22,6 +33,326 @@ class Bintoolpkcs11_tool(bintool.Bintool): > + Use pkcs11-tool's '--pin env:VAR' option (available in newer OpenSC > + versions) or a protected authentication path where possible. This reads as advice to the caller, but sign() now always uses env: so it is out of date. My question from v1 is still open: which OpenSC version added 'env:' support? I believe an older pkcs11-tool uses the literal string 'env:BINMAN_PKCS11_PIN' as the PIN, so each build counts as a failed login and could lock the token after a few attempts. Please can you find the minimum version and mention it here and in the pre-load documentation? > diff --git a/tools/binman/btool/pkcs11_tool.py > b/tools/binman/btool/pkcs11_tool.py > @@ -22,6 +33,326 @@ class Bintoolpkcs11_tool(bintool.Bintool): > + fd, digest_file = tempfile.mkstemp(prefix='binman_digest_') > + with os.fdopen(fd, 'wb') as dfd: > + dfd.write(digest) The pre-load entry never passes output_file, so the mkstemp()/unlink() handling is used every time, and the ECDSA digest adds another temporary file. Please can you make output_file a required argument and have the etype pass a name from tools.get_output_filename()? The digest could also go in the output directory, e.g. alongside the input file. Then the files are kept for debugging and the cleanup code (and the unlink-error test) can go. > diff --git a/tools/binman/btool/pkcs11_tool.py > b/tools/binman/btool/pkcs11_tool.py > @@ -22,6 +33,326 @@ class Bintoolpkcs11_tool(bintool.Bintool): > + run_env = None > + args += ['--pin', 'env:BINMAN_PKCS11_PIN', '--login'] The 'run_env = None' line can be dropped, since run_env is set two lines later. Regards, Simon
