Incorporate the latest changes for the ICSF token and the pkcsicsf tool
into the README.icsf_stdll.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
For better scripting capabilities, the SO PIN and the RACF password can
optionally be supplied via options -R and -S. If not specified you are
prompted for them.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
If -slot is specified then create the new ICSF token at the given slot number.
Otherwise the next free slot is used.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Since SASL authentication does not require unlocking the token master key
to obtain an RACF password, public sessions (sessions opened without a
prior User or SO login) are supported for accessing and operating on public
objects when using SASL. In contrast, Simple authentication requires a User
or SO login before token operations can be performed because the RACF
password must be decrypted from disk using the token master key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
A few new files were added that require specific copyright notices to be
displayed (err.c and getopt_long.c). These files are specific to AIX and are
not used on any other platforms.
The readme has been updated as well, mentioning AIX-specific build instructions
and pitfalls where necessary. The CCA library dependencies have been updated
to reflect what the code now demands for AIX. The base version has been updated
from 5.x to 7.1, which effectively only leaves the 4769 card as the supported
card on AIX. The requirements for Linux are unchanged.
The coding guideline document has been updated as well to outline the required
formatting for preprocessor macros.
Signed-off-by: Akash Kulhalli <akash.kulhalli@ibm.com>
What to do when adding a new mechanism or key type to openCryptoki. This only
captures the part that is needed in the policy code such that the new
mechanism and/or key type is known to the policy. It does not capture the
code/part that is needed in the tokens to enforce the policy.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
These files will also be installed automatically via autotools into the
correct doc folder (typically /usr/share/doc/opencryptoki).
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
The pre-commit hook will help developers have their code changes checked
for indentation problems.
Documentation mentions how the hook can be set up.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
The '#include "slotmgr.h"' is not needed in the sample code, as well
as 'Slot_Mgr_Shr_t *shmp = NULL;'. File slotmgr.h is not installed
into /usr/include/opencryptoki, so compiling this sample would not
be possible outside of the source tree.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
This file was previously distributed as a PDF and was really outdated. We are
replacing it for an updated text (.md) file.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
The README.pkcscca_migrate document was outdated as it mentioned pkcsconf64
which is not present anymore and was integrated into pkcsconf.
Fixed some coding style and small spelling mistakes.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
OpenCryptoki-HOWTO.pdf is from 2005, really outdated, and we shouldn't have a
pdf in the package source. Another file will be written to take its place.
README-IBM_CCA_users was needed when pkcsconf didn't support 64 bits, so there
was a pkcsconf64 tool to help on that. But now this pkcsconf64 doesn't exist
anymore and pkcsconf works for 32 and 64bits.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
CONTRIBUTING file documents how to get started on developing for OpenCryptoki.
The conding style is a guideline about how you should write your code.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Since opencryptoki-3.0 the file pk_config_data was replaced by the
opencryptoki.conf file. The ock_tests.sh script was still depending
on the pk_config_data file to read slots number to execute.
This patch fixes GitHub issue #12
Signed-off-by: Paulo Vital <pvital@linux.vnet.ibm.com>
wrapped keys need to be unwrapped with the old mater key and wrapped with the
new master key. This patch extends the pkcscca tool to migrate wrapped keys.
Signed-off-by: Fionnuala Gunter <fin@linux.vnet.ibm.com>
Signed-off-by: Vineetha Pai <vpishar@us.ibm.com>
The following patch adds documentation on openCryptoki's handling of token data and adds it to the rpm specfile.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
doc/README.token_data | 99 +++++++++++++++++++++++++++++++++++++++++++++++++
rpm/opencryptoki.spec | 2 +-
2 files changed, 100 insertions(+), 1 deletions(-)
Documentation files were scattered across different places. Consolidate
them in doc/ to make packaging easier, while avoiding collisions.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
