Re: [PATCH v6 4/5] binman: x509_cert: support PKCS11_PIN environment variable

On 2026-07-28T11:35:30, Sergio Prado <[email protected]> wrote:
> binman: x509_cert: support PKCS11_PIN environment variable
>
> Signing an x509 certificate entry with a key held in an HSM needs the
> token PIN. It can be put in openssl.cnf via pkcs11-module-token-pin, or
> in the PKCS#11 URI itself as a pin-value attribute, but both mean writing
> the PIN into a file which is part of the build. That is not
> user-friendly in CI, where the PIN typically arrives as a secret in the
> environment.
>
> Read the PIN from the PKCS11_PIN environment variable and append it to
> the URI as a percent-encoded pin-value attribute, as described by RFC
> 7512. The rewritten URI, not the original, is what reaches
> 'openssl -key'.
>
> PKCS11_PIN is a fallback. A URI which already has a pin-value or a
> pin-source attribute is passed through untouched, since the PIN named by
> the URI is the one OpenSSL uses; appending a second pin-value would
> silently override it, as the last occurrence wins.
>
> Note that PKCS11_PIN keeps the PIN out of the build files but not off the
> openssl command line, where it is visible via 'ps' and may be recorded in
> build logs. Configuring the PIN in openssl.cnf remains the option which
> avoids that, and this is documented alongside the variable.
>
> Signed-off-by: Sergio Prado <[email protected]>
>
> tools/binman/binman.rst         |  11 +++++
>  tools/binman/etype/x509_cert.py |  31 ++++++++++++
>  tools/binman/ftest.py           | 105 ++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 147 insertions(+)

Reviewed-by: Simon Glass <[email protected]>