CVS commit: pkgsrc/security/pkcs11-provider

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   riastradh
Date:           Tue Nov  3 20:22:42 UTC 2026

Modified Files:
        pkgsrc/security/pkcs11-provider: Makefile distinfo
Added Files:
        pkgsrc/security/pkcs11-provider/patches: patch-tests_tdemoca
            patch-tests_thkdf

Log Message:
security/pkcs11-provider: Wire up tests to softhsm and nss softokn.

Otherwise they don't really test anything!  Need at least one PKCS#11
library to test this with.  softhsm and softokn from nss are the two
ones supported by the pkcs11-provider tests that I found in pkgsrc;
another, kryoptic, is not currently packaged (and pulls in Rust), so
I left it out for now.

With this, I get:

> Ok:                55
> Fail:              0
> Skipped:           71


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 pkgsrc/security/pkcs11-provider/Makefile
cvs rdiff -u -r1.2 -r1.3 pkgsrc/security/pkcs11-provider/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/security/pkcs11-provider/patches/patch-tests_tdemoca \
    pkgsrc/security/pkcs11-provider/patches/patch-tests_thkdf

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/pkcs11-provider/Makefile
diff -u pkgsrc/security/pkcs11-provider/Makefile:1.4 pkgsrc/security/pkcs11-provider/Makefile:1.5
--- pkgsrc/security/pkcs11-provider/Makefile:1.4        Tue Nov  3 15:04:06 2026
+++ pkgsrc/security/pkcs11-provider/Makefile    Tue Nov  3 20:22:42 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.4 2026/11/03 15:04:06 wiz Exp $
+# $NetBSD: Makefile,v 1.5 2026/11/03 20:22:42 riastradh Exp $
 
 DISTNAME=      pkcs11-provider-1.3.0
 CATEGORIES=    security
@@ -10,7 +10,7 @@ HOMEPAGE=     https://github.com/openssl-pro
 COMMENT=       OpenSSL provider for PKCS\#11 modules
 LICENSE=       apache-2.0
 
-USE_TOOLS+=    bash:test pkg-config
+USE_TOOLS+=    bash:test gsed:test pkg-config
 
 MESON_ARGS+=   ${${USE_BUILTIN.openssl} == "yes":?-Dmodules_dir=${PREFIX:Q}/lib/ossl-modules:}
 
@@ -66,6 +66,15 @@ SUBST_FILES.bash+=   tests/test-wrapper
 SUBST_STAGE.bash=      post-configure
 SUBST_MESSAGE.bash=    Fixing path to bash.
 
+TEST_DEPENDS+= nss>=0:../../devel/nss
+TEST_DEPENDS+= softhsm2>=0:../../security/softhsm2
+
+# XXX Should derive this from BUILDLINK_PREFIX.nss but don't want to
+# pull in DEPENDS for something used only in test.  This will do for
+# now.  This is LOCALBASE, not PREFIX, because it's about the prefix
+# where _other_ packages are installed, not where _this_ package is
+# installed (though they will coincide in this case).
+TEST_ENV+=     SOFTOKNPATH=${LOCALBASE:Q}/lib/nss
 
 .include "../../devel/meson/build.mk"
 .include "../../security/openssl/buildlink3.mk"

Index: pkgsrc/security/pkcs11-provider/distinfo
diff -u pkgsrc/security/pkcs11-provider/distinfo:1.2 pkgsrc/security/pkcs11-provider/distinfo:1.3
--- pkgsrc/security/pkcs11-provider/distinfo:1.2        Tue Nov  3 14:47:35 2026
+++ pkgsrc/security/pkcs11-provider/distinfo    Tue Nov  3 20:22:42 2026
@@ -1,7 +1,9 @@
-$NetBSD: distinfo,v 1.2 2026/11/03 14:47:35 riastradh Exp $
+$NetBSD: distinfo,v 1.3 2026/11/03 20:22:42 riastradh Exp $
 
 BLAKE2s (pkcs11-provider-1.3.0.tar.xz) = 496732ebac367453eb4181ffc6897f3103b300fbb2a985fcd4b20b269859f411
 SHA512 (pkcs11-provider-1.3.0.tar.xz) = 5a2af2ab09cf8088ea05b07f6feed90b9df57ec6201a64f9c06cde447d3f9faf532a07094b5f62617163374bb03f974d62b11e27b48ba2a83e4459339d32b157
 Size (pkcs11-provider-1.3.0.tar.xz) = 236628 bytes
 SHA1 (patch-meson.build) = 593eadd43114cc3b01f096dd575d7c6c31e7f2b8
 SHA1 (patch-meson__options.txt) = a7cac9b4c61ed7d6b88ca932b793ad14c7ad2886
+SHA1 (patch-tests_tdemoca) = 1abbec08fd929c6eda2805b67fb725de4b39dfb0
+SHA1 (patch-tests_thkdf) = fba4b1cb7b65a9732cb29ee26d160df28bc22830

Added files:

Index: pkgsrc/security/pkcs11-provider/patches/patch-tests_tdemoca
diff -u /dev/null pkgsrc/security/pkcs11-provider/patches/patch-tests_tdemoca:1.1
--- /dev/null   Tue Nov  3 20:22:42 2026
+++ pkgsrc/security/pkcs11-provider/patches/patch-tests_tdemoca Tue Nov  3 20:22:42 2026
@@ -0,0 +1,19 @@
+$NetBSD: patch-tests_tdemoca,v 1.1 2026/11/03 20:22:42 riastradh Exp $
+
+Bypass pkgsrc's proxy blocking when running tests that talk to a
+temporary local daemon.  Otherwise the OCSP tests fail cryptically
+with:
+
+> Error querying OCSP responder
+> 00E890263E700000:error:10080002:BIO routines:BIO_lookup_ex:system lib:crypto/bio/bio_addr.c:767:No address associated with hostname
+
+--- tests/tdemoca.orig 2026-11-03 17:54:05.610335279 +0000
++++ tests/tdemoca
+@@ -191,6 +191,7 @@ fi
+ ossl '
+ ocsp -CAfile ${DEMOCA}/cacert.pem -issuer ${DEMOCA}/cacert.pem
+      -cert ${DEMOCA}/cert.pem -resp_text -noverify
++     -no_proxy 127.0.0.1
+      -url http://127.0.0.1:${PORT}' $helper_emit
+ output="$helper_output"
+ FAIL=0
Index: pkgsrc/security/pkcs11-provider/patches/patch-tests_thkdf
diff -u /dev/null pkgsrc/security/pkcs11-provider/patches/patch-tests_thkdf:1.1
--- /dev/null   Tue Nov  3 20:22:42 2026
+++ pkgsrc/security/pkcs11-provider/patches/patch-tests_thkdf   Tue Nov  3 20:22:42 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-tests_thkdf,v 1.1 2026/11/03 20:22:42 riastradh Exp $
+
+Portability: use POSIX od(1), not GNU xxd(1).
+
+--- tests/thkdf.orig   2026-11-03 17:54:05.660151599 +0000
++++ tests/thkdf
+@@ -78,7 +78,7 @@ diff "${TMPPDIR}/hkdf3-out-pkcs11.bin" "
+ 
+ 
+ title PARA "HKDF Derivation: Expand only"
+-PRK_HEX=$(xxd -p -c 256 "${TMPPDIR}/hkdf3-out-pkcs11.bin")
++PRK_HEX=$(od -t x1 -An -v "${TMPPDIR}/hkdf3-out-pkcs11.bin" | tr -d '[:space:]')
+ export PRK_HEX
+ export HKDF_SALT="I'm a Salt!"
+ ossl '