Installing securesystemslib[hsm] is fragile:
- user has to install a pkcs11 module in a place where we can find it
- pykcs11lib does not provide binaries for basically any interesting platforms (not for linux and not for mac on arm): compiling pykcs11lib is known to be problematic so
pip install securesystemslib[hsm] can fail in very user hostile ways
I don't have great solutions. Listing some options here:
- Use
pyscard instead of pykcs11lib: This would support PIV as before, just not through PKCS11 making this a little simpler (the pkcs11 module would not longer be needed). Unfortunately the project is maintained in the same way as PyKCS11: binaries are mostly not available so pip install will still lead to compilation
- Use
python-pkcs11 instead of pykcs11lib: This is still PKCS11 (so the module needs to be available) but this project seems to generally provide binaries and the API seems more reasonable for our use case
- Use
fido2: this would be possible in pure Python but is not PIV at all and requires a custom signature format: this is not appealing at all due to the verification compatibility issues
Out of these python-pkcs11 looks most appealing on paper: the API matches our usage much better than PyKCS11lib does: I suspect our code would look significantly better afterwards and they seem to provide pre-built binaries. They also use softHSM for testing so I suspect our tests would just work.
CC @kommendorkapten
Installing
securesystemslib[hsm]is fragile:pip install securesystemslib[hsm]can fail in very user hostile waysI don't have great solutions. Listing some options here:
pyscardinstead ofpykcs11lib: This would support PIV as before, just not through PKCS11 making this a little simpler (the pkcs11 module would not longer be needed). Unfortunately the project is maintained in the same way as PyKCS11: binaries are mostly not available so pip install will still lead to compilationpython-pkcs11instead ofpykcs11lib: This is still PKCS11 (so the module needs to be available) but this project seems to generally provide binaries and the API seems more reasonable for our use casefido2: this would be possible in pure Python but is not PIV at all and requires a custom signature format: this is not appealing at all due to the verification compatibility issuesOut of these
python-pkcs11looks most appealing on paper: the API matches our usage much better than PyKCS11lib does: I suspect our code would look significantly better afterwards and they seem to provide pre-built binaries. They also use softHSM for testing so I suspect our tests would just work.CC @kommendorkapten