Cryptoki etas integration by oeweda · Pull Request #49 · eclipse-score/inc_security_crypto

oeweda · 2026-06-10T13:08:33Z

Key Changes:

Integrated the cryptoki module natively into the score_crypto.
Moved the cryptoki provider to score/crypto/daemon/provider/pkcs11/cryptoki.
Updated all Bazel build configurations, Cargo dependencies, and lockfiles to correctly map to the new path.
Verified that the daemon, integration tests, and multi-provider demos build and pass successfully with the new provider location.
Use a single source for openssl (ETAS provided version) found under third_party/openssl
Integrate SCORE Logger into Cryptoki code
closes Integrate PKCS11 (Cryptoki) to SCORE #29 (children tasks PKCS11 (Cryptoki) Integration with SCORE #31 and Integration of PKCS11 (Cryptoki) With ETAS Architecture #32)
closes Have only one version of OpenSSL on target #30 (child task Selecting One OpenSSL Version for the Security Code #33)

Your Reviews will be appreciated @ChansAlive @PandaeDo @masc2023 @schreibwsag @OliverHeilwagen

github-actions · 2026-06-10T13:09:13Z

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: ffa909e8-418a-4ba9-9876-994a1252787a
Computing main repo mapping: 
ERROR: Error computing the main repository mapping: Missing checksum for registry file https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_baselibs/0.2.9/MODULE.bazel not permitted with --lockfile_mode=error. Please run `bazel mod deps --lockfile_mode=update` to update your lockfile.

PandaeDo · 2026-06-15T07:41:10Z

80k lines. Sorry, but I'm not able to review that. Is it possible to create smaller, readable PR's?

ChansAlive · 2026-06-15T07:45:51Z

Kindly check the PR again and resolve the merge conflicts.
It may then reflect the actual changes that is being brought in.
It currently shows the source code that is already present in the main as incoming changes.
Thanks

schreibwsag · 2026-06-18T05:28:09Z

test_pkcs11_provider fails when compiled with USE_RUST_PKCS11 ("C_InitToken failed: 160").
test_pkcs11_provider tries to initialize the token which is apparently necessary for the SoftHSM2
case, but not for libcryptoki. Proposal: to get test_pkcs11_provider running, do the initialization
parts only if USE_RUST_PKCS11 is not defined. Then test_pkcs11_provider will run:

./bazel-bin/tests/provider_test/test_pkcs11_provider
[==========] Running 4 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 4 tests from Pkcs11ProviderHashTest
[ RUN ] Pkcs11ProviderHashTest.SHA256SingleShotHash
mw::log initialization error: Error No logging configuration files could be found. occurred with context information: Failed to load configuration files. Fallback to console logging.
mw::log initialization error: Error No logging configuration files could be found. occurred with context information: Failed to load configuration files. Fallback to console logging.
2026/06/18 05:17:33.9853564 2801418324 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.SHA256SingleShotHash (126 ms)
[ RUN ] Pkcs11ProviderHashTest.SHA256StreamingHash
2026/06/18 05:17:33.9853692 2801419597 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.SHA256StreamingHash (122 ms)
[ RUN ] Pkcs11ProviderHashTest.StreamStateViolation
2026/06/18 05:17:33.9853802 2801420698 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.StreamStateViolation (110 ms)
[ RUN ] Pkcs11ProviderHashTest.TrueConcurrentStreamingOnSeparateSessions
2026/06/18 05:17:33.9853925 2801421927 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.TrueConcurrentStreamingOnSeparateSessions (123 ms)
[----------] 4 tests from Pkcs11ProviderHashTest (482 ms total)

[----------] Global test environment tear-down
[==========] 4 tests from 1 test suite ran. (482 ms total)
[ PASSED ] 4 tests.

github-actions · 2026-06-22T09:47:01Z

The created documentation from the pull request is available at: docu-html

ChansAlive

Review done on the daemon changes as part of integrating the rust pkcs11 provider

ChansAlive · 2026-07-14T13:55:05Z

+    }
+    auto& km = km_result.value();
+
+    auto slot_result = ctx->ResolveResource("HMAC_SHA256_IntegrationTestKey_SoftHSM", ResourceType::kKeySlot);


Since we want to choose either softHSM or cryptoki, it may be better to rename the keyslot resourceId to have a generic name. Else it is bit confusing. The change requires updating the config json.

ChansAlive · 2026-07-15T07:58:32Z

Are these patch files really required to be merged?

Hi @ChansAlive, Yes, these patches are required to compile successfully:

openssl_sys patch: Bypasses host filesystem scanning (which is blocked by Bazel's secure sandbox) to link directly to our built-in //third_party/openssl library.

Other patches: Fix outdated Rust syntax and Cargo workspace README paths so S-CORE compiles cleanly on modern stable toolchains

Hi @ShoroukRamzy ,
Thanks for the response.

Currently, if I understand correctly, the patch hardcodes the version to 3.4 and we already are using 3.6.1, shouldn't we check which version of openssl we are using and adapt the patch to maintain consistency?

Regarding the score_logging.patch, if this is some change that should ideally be present in the respective module, we should not be patching it here right? Probably if we are using a third_party exclusively used sources, it may be fine. But from the middleware perspective, considering the modules could be shared by multiple modules, how do we expect this patching to work?

Ideally we should try to reduce patches as this might cause issues in the reference integration.
cc: @OliverHeilwagen

Hi @ChansAlive,

Thank you for your feedback. Regarding the first point, Let me clarify some points:

OpenSSL (C++) vs openssl-sys (Rust): S-CORE compiles OpenSSL 3.6.1 (the actual C++ binary), but our Rust bindings crate openssl-sys has no 3.6.x or ossl360 flags in its source code; its highest defined 3.x flag is ossl350.

Why we patch (Bazel Sandbox): The unpatched crate’s script scans host paths (like /usr/include), which is blocked inside Bazel's secure sandbox. Our patch simply bypasses this scan to prevent a compile-time crash.

Backward Compatibility: If the unpatched script could scan our 3.6.1 dynamically, it would automatically fall back to ossl350. OpenSSL strictly guarantees ABI backward compatibility, making this 3.5.0 compiled subset 100% compatible and safe to run against S-CORE's compiled 3.6.1 binary at runtime.

To maintain perfect consistency, we have updated the patch to output ossl350 and version number 30500000 (3.5.0 fallback).

@ShoroukRamzy,
I agree with the reason for patching the openssl-sys crate. Please check if all other patches are necessary.

The open point I have is on how to maintain consistency with openssl-sys crate patch and the openssl what we are building automatically. Else we might change (upgrade or downgrade) the openssl version without upgrading the patch.

It would be great if we have a possibility to patch with the maximum supported version of openssl (either of what is supported by crate or what we build) and throw necessary error in case of incompatibility.
Thanks.

@ChansAlive,
I removed all other patches, I tested without them and they are not needed

@ChansAlive, Regarding the openssl point, I fully agree with it and I updated the patch to maintain this consistency. Thanks!

@ChansAlive, Regarding the openssl point, I fully agree with it and I updated the patch to maintain this consistency. Thanks!

@ChansAlive, Done

@oeweda any update on the PR?

Co-authored-by: Copilot <copilot@github.com>

Fix the static library link order for OpenSSL (libssl before libcrypto) to resolve undefined symbols during linking. Additionally, apply missing Eclipse Foundation copyright headers to newly added Cryptoki source files to pass the copyright checker.

Refactor the openssl_sys_build_rs.patch build script to dynamically parse the compiled OpenSSL version number from S-CORE's opensslv.h header inside the sandboxed build environment.

Update openssl_sys_build_rs.patch to emit the ossl350 configuration flags and version number 30500000. This provides the correct backward-compatible fallback configuration for S-CORE's compiled OpenSSL 3.6.1.

masc2023 requested changes Jun 14, 2026

View reviewed changes

Comment thread docs/crypto/architecture/index.rst

Comment thread docs/crypto/architecture/index.rst Outdated

Comment thread docs/crypto/architecture/dynamic_architecture.rst Outdated

Comment thread docs/crypto/architecture/dynamic_architecture.rst Outdated

oeweda force-pushed the cryptoki_etas_integration branch 4 times, most recently from 4d92606 to cc51b96 Compare June 17, 2026 04:36

oeweda force-pushed the cryptoki_etas_integration branch 4 times, most recently from 4e95a25 to 0f08964 Compare June 22, 2026 09:41

ShoroukRamzy force-pushed the cryptoki_etas_integration branch 7 times, most recently from ab068a8 to 09800f7 Compare July 7, 2026 14:31

sunildevda requested a review from ChansAlive July 8, 2026 08:30

ChansAlive requested changes Jul 14, 2026

View reviewed changes

ChansAlive reviewed Jul 15, 2026

View reviewed changes

ShoroukRamzy force-pushed the cryptoki_etas_integration branch from 09800f7 to 2811e99 Compare July 16, 2026 09:12

ShoroukRamzy requested a deployment to workflow-approval July 16, 2026 14:45 — with GitHub Actions Waiting

ShoroukRamzy requested a deployment to workflow-approval July 16, 2026 16:02 — with GitHub Actions Waiting

ShoroukRamzy had a problem deploying to workflow-approval July 16, 2026 16:15 — with GitHub Actions Error

ChansAlive mentioned this pull request Aug 6, 2026

Guard backend-specific tests with target_compatible_with backend flags #150

Merged

oeweda and others added 29 commits August 10, 2026 13:00

Code Base For Cryptoki PKCS#11 Rust Implementaion

a402eb6

Code Base For Cryptoki PKCS#11 Rust Implementaion

66786b3

Added rust shell Rules to MODULE.bazel

68e23af

Fix bazel ci errors

44fa082

Fix Bazel Docs build issue

734a12c

Co-authored-by: Copilot <copilot@github.com>

Initial Cryptoki integration into ETAS

f2e36c2

Initial Cryptoki integration into ETAS

04de1a9

(CI) fix documents

5ef44f8

CI (fix docs)

c42504d

Fix BUILD alias conflict and apply codebase formatting

a66002b

skip SoftHSM token initialization when using Rust PKCS#11

281053b

Cryptoki: Migrate Rust PKCS#11 library to score/cryptoki

a88ac82

perf: introduce weak PIN hashing as a temporary optimization workaround

4f96676

checkpoint: working cryptoki state

32a4637

Cryptoki: Refactor PKCS#11 integration to use generic names

619209d

Test: Add Rust PKCS#11 library into the Docker integration sandbox

d231bbe

Test: Rename init_softhsm_token to generic init_pkcs11_token

fd28142

Build: Synchronize MODULE.bazel.lock with rebased dependencies

30b43be

update README

21ea412

Test: Support dynamic libcryptoki detection in sandbox

17a9297

CI: Trigger rebuild after network timeout

35761ad

Build: Make OpenSSL version parsing fully dynamic in patch

1533c46

Refactor the openssl_sys_build_rs.patch build script to dynamically parse the compiled OpenSSL version number from S-CORE's opensslv.h header inside the sandboxed build environment.

Build: Align OpenSSL patch with S-CORE version

3ea6978

Update openssl_sys_build_rs.patch to emit the ossl350 configuration flags and version number 30500000. This provides the correct backward-compatible fallback configuration for S-CORE's compiled OpenSSL 3.6.1.

Build: Clean up unused legacy patch files in patches directory

31b5c71

Build: clean up legacy score_logging patch

ffa0e22

Build: maintain consistency between openssl and openssl-sys versions

6b2fff5

fix MODULE.bazel

c19dcff

fix bazel issues

5cfe191

Uh oh!

Conversation

oeweda commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

License Check Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PandaeDo commented Jun 15, 2026

Uh oh!

ChansAlive commented Jun 15, 2026

Uh oh!

schreibwsag commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

ChansAlive left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

github-actions Bot commented Jun 10, 2026 •

edited

Loading