�ɲɾ�����ӯ�����һ��ˣ��������С���˴��ͣ�������P���ҹ��ñ˽��ά�Բ��������˸߸ԣ�������ơ��ҹ��ñ�����ά�Բ���ˡ���˳^�ӣ������ӡ� ���ͯj�ӣ��ƺ���ӣ� ? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!trust-extract-compat000075500000000423152525210310010577 0ustar00#!/usr/bin/bash set -e if test "$UID" != "0"; then echo "p11-kit: the 'extract-trust' command must be run as root" >&2 exit 2 fi if test $# -gt 1; then echo "p11-kit: no additional arguments are supported for this command" >&2 exit 2 fi exec /usr/bin/update-ca-trust p11-kit-remote000075500000071660152525210310007157 0ustar00ELF> @k@8 @@@@hh8M8M [[ [ p [[ [   DDStd Ptd D D DttQtdRtd[[ [ /lib64/ld-linux-x86-64.so.2GNUGNUGNUb'S >O*0r7BD! BDEBE|qX2)E@P"V *^/T| -  erVqH>`j< }"7#` 6b *`  ` 0(` libp11-kit.so.0_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTablep11_kit_remote_serve_modulep11_kit_remote_serve_tokensp11_kit_be_loudp11_kit_module_loadp11_kit_module_releaselibdl.so.2dlclosedlerrorlibc.so.6__printf_chkstrncmpoptindstrrchrmmap64closedirstrncpyputs__stack_chk_failputcharreallocabortstrpbrkgetpidprogram_invocation_namestrdup__assert_failstrtolisattycallocstrlen__errno_locationopen64__fxstat64__fprintf_chkstdoutfputcmemcpy__vsnprintf_chkmallocrealpathopendir__ctype_b_locgetenvoptargstderrmunmap__snprintf_chkgetopt_longgetauxvalfwritestrerror_lstrchr__vfprintf_chkprogram_invocation_short_namereaddir64__cxa_finalizegetrlimit64strcmp__libc_start_maindirfdsetenvsysconffree__progname__progname_full_edata__bss_start_endGLIBC_2.2.5LIBP11_KIT_1.0GLIBC_2.16GLIBC_2.6GLIBC_2.14GLIBC_2.3GLIBC_2.4GLIBC_2.3.4$ORIGIN/    ui ; hG Vii akii vii ti ui ;[  [  [  [ @[ CP[ |C`[ Cp[ C[ C[ r@[ C` 9_ _  _  _ _ "_ &_ /_ ;_ =_ >_ A ` E(` F] ^ ^ ^ ^  ^ (^ 0^  8^  @^  H^ P^ X^ `^ h^ p^ x^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^  ^ !^ #^ $^ %^ '_ (_ )_ *_ + _ ,(_ -0_ .8_ 0@_ 1H_ 2P_ 3X_ 4`_ 6h_ 7p_ 8x_ 9_ :_ <_ >_ ?_ @HHiI HtH5rG %sG hhhhhhhhqhah Qh Ah 1h !h hhhhhhhhhhqhahQhAh1h!hhhh h!h"h#h$h%h&h'qh(ah)Qh*Ah+1h,!h-h.h/h0h1h2h3h4h5% D D%D D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%C D%}C D%uC D%mC D%eC D%]C D%UC D%MC D%EC D%=C D%5C D%-C D%%C D%C D%C D% C D%C D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%B D%}B D%uB D%mB D%eB Df.AUfE1ATIUSHdH%(H$1H|$h)D$H\$`)D$ )D$0HD$PD$(p)D$@HH"D$xvHD$`H"H$H H$H HD$Hq DŽ$hDŽ$DŽ$pHD$0HLtlht ~puPL-A ?tH|$H*1H$dH3 %(mH[]A\A]v4"HcyA )݅1M$ܺH5I$HuFM1LHHtfHcA1HLH߉D$ D$ BuXH1HHt$1H$H߉D$ D$ 1H=1H= 1H=HcA11LH \H5H=4f.D1I^HHPTL&H H=(? H=? H? H9tHf? Ht H=? H5? H)HHH?HHtHU? HtfD=? u+UH=:? Ht H=^: Id]? ]wATUSH H5HH1kH1H5UHHt?HL% HHSHt%:tHKL1HHSHu[HH5S]1A\@AWAVAUATUSHHoHdIIE<$E]I]HE;}IE fDH D;xtHIHuE1+IcH01fN dHHH51HAMtFAFt>IL$HHg!H5HHDHHHE1AAD)AH= @AH3 AFE H2HtyLxH1LH5BAH)LMuIIl$HH[]A\A]A^A_HH51IDIl$HnHI(Il$HR뫿 ADEHAHH5m1AwIcHfH AEE1H5E11AJMAWI@AVAUIATUSHh|$ Hl$ HdH%(HD$X1I}I] Ld$I@D$H H{t`HcsIfq t@t$@tܺLHSuH5HH H{u|$ HT$ E1LLHgH|$XdH3<%(uJHh[]A\A]A^A_H5H=1H SH5H=fDAWIAVIAUATUSHHt$9LCMHDE11H$*@HHL$HcIHL;<$I:-HuB<-3H=Wt HH=QH=SHH==HHN1HH=Uf.HIL;<$5Z HI>E1Hu"HII>Ht?uMII>HuMHt$ID$HH[]A\A]A^A_AuBEtPLnILI0IHI9t@HkEt4A8uLH)L9r$LLHuHH[]A\A]A^A_1ff.Ht7UHSHHHHHtHHHHHH[]1Hf.UHH~SHHHHtHHHHHH[]AUATUSHXHt$(HT$0HL$8LD$@LL$HdH%(HD$1H$$HD$HD$ HD$H HHl$I$ƒH$H:Ht/LI$/vHT$H:HBHD$HuI|$IHH$$LHD$HD$ HD$DHT$H$Ht:H3HHHI"$L/vHT$HHBHD$HuEH5H="1E1HL$dH3 %(LuEHX[]A\A]ÿHHuE1H$$IHD$HD$ HD$SHHu H[p1[ff.AVAUIATIH=USH dH%(HD$1HHHHHtsHx HH$IH$Ht΀8uHA9tDLAAƅtHHL$dH3 %(DuoH []A\A]A^@E1Hu7Hl$Ht,~1fDLAAƅu9uE1D%DOW Bff.fOWBf.AWH=xAVAUATUSH2Ht 8TH=D IHdH=DHÀۅH= HÀۅ(1H5LyIHLL%& L)L=H=&IMt?ID$LHD$LL|$H9uHLUuA \$IMuA>t p11-kit remote [-p ] ...false && "this code should not be reached"specify a module or tokens to remotethe 'remote' tool is not meant to be run from a terminalonly one module can be specifiedmainusage: %s command ... Common %s commands are: %-15s %s ...=%s -%c, --%s --%s -%c%s<%s>%.*s../common/tool.clist-modules--no command specified--verbosetoolP11_KIT_DEBUG--quiet--helpunknown global option: %sunknown global option: -%c See '%s --help' for more information p11-kit: shouldn't be reached at %s longopts[i].has_arg != optional_argument'%s' is not a valid command. See '%s --help'p11_tool_getoptp11_tool_getoptbuffer->frealloc != NULLp11-kit: '%s' not true at %s !(flags & P11_BUFFER_FAILED)buffer != NULLp11_buffer_ok (buffer)buffer->size < SIZE_MAX / 2at != NULLSIZE_MAX - (terminator + length) > buffer->lenp11_buffer_addp11_buffer_appendp11_buffer_stealp11_buffer_uninitp11_buffer_init_fullbuffer_realloc../common/compat.cname/proc/self/exe/proc/self/fdstrconcatgetprognameconflibP11_KIT_STRICTallSupported debug values::;, (p11-kit:%d) Unknown error %duriproxytrustrpcp11-kit: %s message: %s%s: %s;p-d4D$PTldTD(dX0dPDD0tPd$ 4Ld <Ttdt4 zRx `/D$4pFJ w?:*3$"\`<tXFND C(G (A ABBD (BAA KIH,iFBB B(A0A8D@u 8A0A(B BBBA H,PZFJB E(A0A8D 8A0A(B BBBA xdFEE B(A0A8FP 8C0A(B BBBJ  8A0A(B BBBG n 8C0A(B BBBA 4p~AAD n AAJ [ CAA 4DHD\0LplTJfH_|b%,FAA  ABE 8fFDD j DBJ AOI4$8EAD b AAB w EAC \'HQ G F@|RFJE D(I0G 0A(A BBBD AEW L TH FBB B(A0A8G@] 8D0A(B BBBA (,PFJDJ bDAA$Xt@EHG fDA<FBA A(Di (A ABBA  $EV E C @+FBE K(A0DP 0A(A BBBE 8LHd#FIB B(A0A8DPS 8A0A(B BBBJ (EAJ AAD 0FAD I  AABC <K A zRx  t\ (pEDG V AAH ,PeEAG3 AAF 4|FDA G `  AABA   ,$H[DHRD\eFEE E(H0H8G@n8A0A(B BBB [ C|CCCC r@@C P H>[ [ o0 h  ] @@ oo@oo o [  0@P`p 0@P`p 0@P`p9GA$3a1P/ GA$3p1113@=GA*GA$annobin gcc 8.5.0 20210514GA$plugin name: gcc-annobinGA$running gcc 8.5.0 20210514GA*GA*GA! GA*FORTIFYGA+GLIBCXX_ASSERTIONS GA*GOW*GA*cf_protectionGA+omit_frame_pointerGA+stack_clashGA!stack_realignGA*EGA$3a10 U> GA$3p1113(E>GA*GA$annobin gcc 8.5.0 20210514GA$plugin name: gcc-annobinGA$running gcc 8.5.0 20210514GA*GA*GA! GA*FORTIFYGA+GLIBCXX_ASSERTIONSGA*cf_protectionGA+omit_frame_pointerGA+stack_clashGA!stack_realign GA*GOW*(9 GA*GOW*=E> GA*FORTIFY 5>GA+GLIBCXX_ASSERTIONS GA*FORTIFY(=GA+GLIBCXX_ASSERTIONSp11-kit-remote-0.23.22-2.el8.x86_64.debug$I7zXZִF!t/=]?Eh=ڊ2Nsdh6D4CiyIK|öN&;@J04Jsu7$!]kbMD&/Nc0?o.'Yq5D xA,xAi Mߝf@`/ն ⽷dffذWCf,$ջ96Xs#{],Ӥ7J(\8owP"2[馭!Ԏ5@zHlS@>9۟-xt/r)y7_A jQwN, a<#5n?[T0#^ o oRJaȿJ cH%f89NHy {!|5B}gFv[(_az&t}U:MU+|=Ҿ>;Do?aB"`jU.*nKq(O7:";N{ZMÊGzj.C̼+ 7FFa2NhM{PB-DEe1w;q Fʥ:5iNB>ThJsI^Ξ:Ӄu1mMAe۲r6Ry59x [i=q!*{zdxLI gP6;*_<>7XS< %fѧSGN(a^nncΞ#8ovX fbRhޫOmKJ(Q,NӴ׎ytD 7ZK6ŀkv >t"YNf/ayNq+9Gw2:^L?byaV}~5~"Yx כ}o)ZImJ-rnTvj gV;%HeYw )ٕ8g %ZPd/EJԑiWJ>lI8}0)z 䭓PG| mC)Ⱥf>j<7aaŦf!M9Kc6%'_wNGS-T5k~7M} [4_l_zY;s,(/9+ԢX"XztB\ZTejMl c$o^`ScoKtМTXj0F5kr D*`^7!c~ 3иx1ޥހc G8z<fn7kրn`C2n7TzX9q*,;-I|PX~ +pgYZ.shstrtab.interp.note.gnu.property.note.ABI-tag.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.got.data.bss.gnu.build.attributes.gnu_debuglink.gnu_debugdata  & 4$Go008Q hhY  ao no@@}@B@@PPppp`@@!H>H> `>`> D DtEE[ [[ [ [ [ [ [ ] ] ` ` ` `` b`` d0/,ej>usr/bin/p11-kit000075500000112230152525245030007243 0ustar00ELF> @،@8 @@@@hhpqpq PzPz Pz  x{x{ x{   DDStd PtddddQtdRtdPzPz Pz /lib64/ld-linux-x86-64.so.2GNUGNUGNU(8 yV((yH@!HJKBE|qX3we`sL -{Qa"[!j49* #K- X:VcQAz9pX< "F'i~ `  T libp11-kit.so.0_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTablep11_kit_modules_load_and_initializep11_kit_be_quietp11_kit_module_get_namep11_kit_modules_finalize_and_releasep11_kit_be_loudp11_kit_strerrorp11_kit_space_strdupp11_kit_config_optionlibdl.so.2dlclosedlerrorlibc.so.6__printf_chkexecvstrncmpoptindstrrchrmmap64closedirstrncpyputs__stack_chk_failputcharreallocabortstrpbrkgetpidprogram_invocation_name__assert_failstrtolcallocstrlen__errno_locationopen64__fxstat64__fprintf_chkgetpwuid_rstdoutfputcmemcpy__vsnprintf_chkmallocrealpathopendir__ctype_b_locgetenvstderrmunmap__snprintf_chkgetuidgetopt_longgetauxvalfwritestrerror_lstrchr__vfprintf_chkprogram_invocation_short_namereaddir64__cxa_finalizegetrlimit64strcmp__asprintf_chk__libc_start_maindirfdsetenvsysconffree__progname__progname_full_edata__bss_start_endGLIBC_2.2.5GLIBC_2.16GLIBC_2.6GLIBC_2.14GLIBC_2.3GLIBC_2.8GLIBC_2.4GLIBC_2.3.4LIBP11_KIT_1.0$ORIGIN/     ui / ii ii ii ii ti ui  hPz !Xz @!`z `z z az az az az \z \z a{ \{ !{ ]{ ] { ,({ ]0{ &]8{ ,@{ ]H{ aP{ , F       % * 4 @ B C G K} } } } } } } }  }  }  ~ ~ ~ ~  ~ (~ 0~ 8~ @~ H~ P~ X~ `~ h~ p~ x~ ~ ~  ~ !~ "~ #~ $~ &~ '~ (~ )~ +~ ,~ -~ .~ /~ 0 1 2 3 5  6( 70 88 9@ ;H <P =X >` ?h Ap Cx D E FHHf HtH5d %d hhhhhhhhqhah Qh Ah 1h !h hhhhhhhhhhqhahQhAh1h!hhhh h!h"h#h$h%h&h'qh(ah)Qh*Ah+1h,!h-h.h/h0h1h2h3h4h5h6h7qh8ah9Qh:Ah;1%` D%` D%` D%` D%` D%` D%` D%` D%` D%` D%` D%` D%` D%}` D%u` D%m` D%e` D%]` D%U` D%M` D%E` D%=` D%5` D%-` D%%` D%` D%` D% ` D%` D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%_ D%}_ D%u_ D%m_ D%e_ D%]_ D%U_ D%M_ D%E_ D%=_ D%5_ D%-_ D%%_ D%_ D%_ D% _ Df.HeZ 1I^HHPTL7H o7H=^ H=9_ H2_ H9tH^ Ht H= _ H5_ H)HHH?HHtH^ HtfD=^ u+UH=^ Ht H=X d^ ]wAWH;=AVAUATUHH5=SH dH%(H$ 1H$(L$H$ H56L$ H LH$@HH6H<DŽ$8vH$H6H$H6DŽ$XqH$`DŽ$xlH$DŽ$hDŽ$vDŽ$qH$LHlt8?uCH$ dH3%(HĨ []A\A]A^A_Dqu#@hLL 1몃vpD9\ J1HD$HHMH8HD$ HD$`L=8HD$8HD$XHD$@HCHl$ H55IHD$(H}H #5H5HHD$0H55HEMIE1HEH|$8HD$PHHxLt$8 I~0bH5f5HH1HI~ 3H5T5HH1jH$1$H5:5?HT$@H$HD$HHD$HD$XP(HHH|$XH$@HD$HH@HhH=1H1 DH{PIf.H3H5^21RH3H5>21H$ fH2H521H$ H2H511YH$ H2H511,H$ yH2H511H$  WH2H5Z11H$ 0DH2H5.11H$ fH1H501vH$ fHw1H501FH$ YfH01H501H$  fH0H5n01H$ fH0H5>01H$ fH\0H501H$ vf${$zH511M $y$xH5911H/H5~/1H$ fHx/H5N/1H$ fH8/H5/1H$ nfH.H5.1fH$ 6fHH=-H1'1H=-$H i0H5^-H=/qf.fATIUHcS}HcHt]HHo0HLHHH{HHD+H;)H5H081H[]A\f1H1H5/H=/[]A\f.ATUHcH=0SHHHdH%(HD$1HH=/HH1HL4H/oH=/kH8Hk/HDH4$H11IHHHHH31H=/4H<${LsH\$dH3%(H[]A\ÐH/HHމf.1H570H=`/+@H.@@1H0H5.H=G.lDATUSH H5/HH1kH1H5/UHHt?HL%/ HHSHt%:tHKL1HHSHu[HH5s0]1A\@AWAVAUATUSHHoHdIIE<$E]I]HE;}IE fDH D;xtHIHuE1;IcH01fN dHHH5%/1HAMtFAFt>IL$H.HG2H5.HHDHH.HE1AAD)AHO @AH3 xAFE HHtyLxH1LH5z.AH)LMuIIl$HH[]A\A]A^A_HH5.1IDIl$HnHIIl$HR뫿 AXDEHAHH5-1AIcHfH AEE1H5}-11AJMAWI@AVAUIATUSHh|$ Hl$ HdH%(HD$X1I}I] Ld$I@D$H H{t`HcsIfq t@t$@tܺLHSuH5/HH H{u|$ HT$ E1LLHgH|$XdH3<%(uJHh[]A\A]A^A_H5-H=*1H S-H5!,H=,VfDAWIAVIAUATUSHHt$9LCMHDE11H$*@HHL$HcIHL;<$I:-HuB<-3H=+t HH=|+H=y+HH=c+HHN1HH=C+Uf.HIL;<$5Z HI>E1Hu"HII>Ht?uMII>HuMHt$ID$HH[]A\A]A^A_AuBEtPLnILIIHI9t@HkEt4A8uLH)L9r$LLHFuHH[]A\A]A^A_1ff.Ht7UHSHHHHHtHHHHHH[]1Hf.UHH~SHHHHtHHHHHH[]AUATUSHXHt$(HT$0HL$8LD$@LL$HdH%(HD$1H$$HD$HD$ HD$H HHl$I$ƒH$H:Ht/xLI$/vHT$H:HBHD$HuI|$IHH$$LHD$HD$ HD$DHT$H$Ht:HHHHI$L/vHT$HHBHD$HuEH5a"H=1E1HL$dH3 %(LuEHX[]A\A]ÿHHuE1H$$IHD$HD$ HD$cSHHu H[01[ff.AVAUIATIH=!USH dH%(HD$1HHHHHtsHx HH$IH$Ht΀8uHiA9tDLAAƅtHHL$dH3 %(DuoH []A\A]A^@E1Hsu7Hl$Ht,~1fDLAAƅu9uE1DDOW Bff.fOWBf.AWH=X AVAUATUSH2Ht 8TH=jhIHdH=$ HÀۅH=CHÀۅ(1H5LiIHLL%8 L)L=H=&IMt?ID$LHD$LL|$H9uHLuA \$IMuA>t7 HHBH81eHH*H$(dH3%(u'H[]DHH51bff.ATAUSHH$@H$HL$PL$Xt@)$`)$p)$)$)$)$)$)$dH%(H$(1Hl$ ILL$H$HHD$H$0H$ D$D$ 0HD$qEHHH=LHGºD 1H56 HtDHH1HHƄ$H=8H$(dH3%(u H[]A\T@5 @5 @HJ5 Ht 8HDHff.H5 HtHDAUATUSHHIII9txH-HI9t_sHHuI9tyHL-HI9tuLHtH)HHH[]A\A]fDH11H`H56H==H1[]A\A]L1fHt?/H1HH5H=C1HfAVAUATUSHPHt$(HT$0HL$8LD$@LL$HdH%(HD$1HH$H$HD$HD$ HD$8Hl$L`*DƒH$H:Ht0HI$/vHT$H:HBHD$HuI|$KIHKH$$E1HD$HD$ HD$fDH;/Hu6CMu... Common %s commands are: %-15s %s ...=%s -%c, --%s --%s -%c%s<%s>%.*s../common/tool.c--no command specified--verboseP11_KIT_DEBUG--quiet--helpunknown global option: %sunknown global option: -%c See '%s --help' for more information longopts[i].has_arg != optional_argument'%s' is not a valid command. See '%s --help'p11_tool_getoptp11_tool_getoptbuffer->frealloc != NULL!(flags & P11_BUFFER_FAILED)buffer != NULLp11_buffer_ok (buffer)buffer->size < SIZE_MAX / 2at != NULLSIZE_MAX - (terminator + length) > buffer->lenp11_buffer_addp11_buffer_appendp11_buffer_stealp11_buffer_uninitp11_buffer_init_fullbuffer_realloc../common/compat.cname/proc/self/exe/proc/self/fdstrconcatgetprognameconflibP11_KIT_STRICTallSupported debug values::;, (p11-kit:%d) Unknown error %duriproxyrpcp11-kit: %s message: %s%s: %s/built != NULL../common/path.cat + num < lenat < len.configXDG_CONFIG_HOMEparent != NULLstring != NULLprefix != NULLname != NULLp11_buffer_ok (&buf)couldn't lookup home directory for user %dabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_/\p11_path_encodep11_path_canonp11_path_prefixp11_path_parentp11_path_buildp11_path_buildp11_path_absolutep11_path_expandp11_path_base../common/url.cvalue <= endskip != NULLresult != NULLP11_KIT_URI_LOWERCASEp11_url_encodep11_url_decodep11_url_decode0123456789abcdef0123456789ABCDEF;<D̻\L,X\Ltl|0`<|8X\8Xl<\(T,  ElR1O\fo~Q#ʛ,D[ 0> *yxd &eGuibEPFY9qON'uf(? ʶUpb̖[SEo * [p mV(h6F’ gЧcCFo#p^8Y 3}< G g[Fj7O `W!h׮}Ǫ0 [ v~#jqAVm pTd+ ͽJTL7Lq7„Di ]-i3%<ǫWA[(r4:5XLN&SMUs=)8頿Yd]acpX9?%;@%*8ֆ |a” hn9 SY."Nc%c?09XAnk;u zm46~ = k2KdFv\f7pR_\>y' n|߈8{滍|1xQ& g 9h;Rdo+5wg1$˱X/A/ -c;x&Bۤ/[O0A~=Y( 3<7.W' r3E 0g~\GwBq3ng'drHsw\t^ʿ͑ݨD$ikFM $o-iKC-(ddeV%w#FvEgbCQxYdA:~ɭRM)PZVHr {L 9\z fzA)az;|*~c 0LϱgYZ.shstrtab.interp.note.gnu.property.note.ABI-tag.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.got.data.bss.gnu.build.attributes.gnu_debuglink.gnu_debugdata  & 4$Go004Q hh Y aono((}0B(( %8XX XX ddff Pz PzXz Xz`z `z x{ x{ } }P  @ ``  0(/X<>AUTHORS000064400000000044152526510750005622 0ustar00Stef Walter pkcs11.conf.example000064400000000606152526510750010161 0ustar00# This is an example /etc/pkcs11/pkcs11.conf file. Copy it into # place before use. # This setting controls whether to load user configuration from the # ~/.config/pkcs11 directory. Possible values: # none: No user configuration # merge: Merge the user config over the system configuration (default) # only: Only user configuration, ignore system configuration user-config: merge README000064400000003371152526510750005440 0ustar00# p11-kit [![Build Status](https://travis-ci.org/p11-glue/p11-kit.svg?branch=master)](https://travis-ci.org/p11-glue/p11-kit) [![Coverage Status](https://img.shields.io/coveralls/p11-glue/p11-kit.svg)](https://coveralls.io/r/p11-glue/p11-kit) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1627/badge)](https://bestpractices.coreinfrastructure.org/en/projects/1627) [![Total alerts](https://img.shields.io/lgtm/alerts/g/p11-glue/p11-kit.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/p11-glue/p11-kit/alerts/) [![Language grade: C/C++](https://img.shields.io/lgtm/grade/cpp/g/p11-glue/p11-kit.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/p11-glue/p11-kit/context:cpp) p11-kit aims to solve problems with coordinating the use of [PKCS #11] by different components or libraries living in the same process, by providing a way to load and enumerate PKCS #11 modules, as well as a standard configuration setup for installing PKCS #11 modules in such a way that they're discoverable. # Documentation * [Main site](https://p11-glue.github.io/p11-glue/p11-kit.html) * [Manual](https://p11-glue.github.io/p11-glue/p11-kit/manual/) # Building To build and install p11-kit, you can use the following commands: ```console $ meson _build $ ninja -C _build $ ninja -C _build test # ninja -C _build install ``` If you install it locally for testing purposes, you may want to specify `-Dsystemd=disabled -Dbash_completion=disabled`. # Releases Releases are made available via the [primary github site](https://github.com/p11-glue/p11-kit/releases). They are signed with the current maintainer's [OpenPGP key](https://keys.openpgp.org/search?q=462225C3B46F34879FC8496CD605848ED7E69871). [PKCS #11]: https://en.wikipedia.org/wiki/PKCS_11 NEWS000064400000041575152526510750005267 0ustar000.23.22 (stable) * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] 0.23.21 (stable) * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] 0.23.20 (stable) * Revert "Fix RPC when length-s are 0" changes [PR#276] 0.23.19 (stable) * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] 0.23.18 (stable) * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] 0.23.17 (stable) * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] 0.23.16 (stable) * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] 0.23.15 (stable) * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] 0.23.14 (stable) * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] 0.23.13 (stable) * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] 0.23.12 (stable) * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] 0.23.11 (stable) * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] 0.23.10 (devel) * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] 0.23.9 (devel) * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] 0.23.8 (devel) * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] 0.23.7 (devel) * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] 0.23.6 (devel) * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] 0.23.5 (devel) * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] 0.23.4 (devel) * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] 0.23.3 (devel) * Install private executables in libexecdir [#98817] * Fix link error of proxy module on macOS [#98022] * Use new PKCS#11 URI specification for URIs [#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [#87192 ...] 0.23.2 (devel) * Fix forking issues with libffi [#90289 ...] * Updated translations * Build fixes [#90827 #89081 #92434 #92520 #92445 #92551 #92843 #92842 #92807 #93211 ...] 0.23.1 (devel) * Use new PKCS#11 URI draft fields for URIs [#86474 #87582] * Add pem-directory-hash extract format * Build fixes 0.22.1 (stable) * Use SubjectKeyIdentifier for CKA_ID when available [#84761] * Allow 'BEGIN PuBLIC KEY' PEM blocks in .p11-kit files * Bump libtool library version * Build fixes [#84665 ...] 0.22.0 (stable) * Remove the 'isolated = yes' option due to unclear semantics replacement forth coming in later versions. * Use secure_getenv() where necessary * Run separate binary for 'p11-kit remote' command 0.21.3 (unstable) * New public pkcs11x.h header containing extensions [#83495] * Export necessary defines to lookup attached extensions [#83495] * Use term 'attached extensions' rather than 'stabled extensions' * Make proxy module respect 'critical = no' [#83651] * Show public-key-info in 'trust list --details' * Build fixes [#75674 ...] 0.21.2 (unstable) * Don't use invalid keys for looking up stapled extensions [#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings * Fix build against older pthread implementations [#82617] * Move to a non-recursive Makefile * Can now specify which tests to run on command line 0.21.1 (unstable) * Add new 'isolate' pkcs11 config option [#80472] * Add 'p11-kit remote' command for isolating modules [#54105] * Don't complain about C_Finalize after a fork * Other minor fixes 0.20.3 (stable) * Fix problems reinitializing managed modules after fork * Fix bad bookkeeping when fail initializing one of the modules * Fix case where module would be unloaded while in use [#74919] * Remove assertions when module used before initialized [#74919] * Fix handling of mmap failure and mapping empty files [#74773] * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions * Require automake 1.12 or later * Build fixes for Windows [#76594 #74149] 0.20.2 (stable) * Fix bug where blacklist didn't affect extracted ca-anchors if the anchor and blacklist were not in the same trust path (regression) [#73558] * Check for race in BasicConstraints stapled extension [#69314] * autogen.sh now runs configure as srcdir != builddir by default * Build fixes and cleanup 0.20.1 (stable) * Extract compat trust data after we've changes * Skip compat extraction if running as non-root * Better failure messages when removing anchors * Build cleanup 0.20.0 (stable) * Doc fixes 0.19.4 (unstable) * 'trust anchor' now adds/removes certificate anchors * 'trust list' lists trust policy stuff * 'p11-kit extract' is now 'trust extract' * 'p11-kit extract-trust' is now 'trust extract-compat' * Workarounds for working on broken zfsonlinux.org [#68525] * Add --with-module-config parameter to the configure script [#68122] * Add support for removing stored PKCS#11 objects in trust module * Various debugging tweaks 0.19.3 (unstable) * Fix up problems with automake testing * Fix a bunch of memory leaks in newly refactored code * Don't use _GNU_SOURCE and the unportability it brings * Testing fixes 0.19.2 (unstable) * Add basic 'trust anchor' command to store a new anchor * Support for writing out trust token objects * Port to use CKA_PUBLIC_KEY_INFO and updated trust store spec * Add option to use freebl for hashing * Implement reloading of token data * Fix warnings and possible minor bugs highlighted by code scanners * Don't load configs in home directories when running setuid or setgid * Support treating ~/.config as $XDG_CONFIG_HOME * Use $XDG_DATA_HOME/pkcs11 as default user config directory * Use $TMPDIR instead of $TEMP while testing * Open files and fds with O_CLOEXEC * Abort initialization if a critical module fails to load * Don't use thread-unsafe functions: strerror, getpwuid * Fix p11_kit_space_strlen() result when empty string * Refactoring of where various components live * Build fixes 0.19.1 (unstable) * Refactor API to be able to handle managed modules * Deprecate much of old p11-kit API * Implement concept of managed modules * Make C_CloseAllSessions function work for multiple callers * New dependency on libffi * Fix possible threading problems reported by hellgrind * Add log-calls option * Mark p11_kit_message() as a stable function * Use our own unit testing framework 0.18.3 (stable) * Fix reinitialization of trust module [#65401] * Fix crash in trust module C_Initialize * Mac OS fixes [#57714] 0.18.2 (stable) * Build fixes [#64378 ...] 0.18.1 (stable) * Put the external tools in $libdir/p11-kit * Documentation build fixes 0.18.0 (stable) * Fix use of trust module with gcr and empathy [#62896] * Further tweaks to trust module date parsing * Fix unaligned memory reads [#62819] * Win32 fixes [#63062, #63046] * Debug and logging tweaks [#62874] * Other build fixes 0.17.5 (unstable) * Don't try to guess at overflowing time values on 32-bit systems [#62825] * Test fixes [#927394] 0.17.4 (unstable) * Check for duplicate certificates in a token, warn and discard [#62548] * Implement a proper index so we have decent load performance 0.17.3 (unstable) * Use descriptive labels for the trust module tokens [#62534] * Remove the temporary built in distrust objects * Make extracted output directories and files read-only [#61898] * Don't export unnecessary ABI * Build fixes [#62479] 0.17.2 (unstable) * Fix build on 32-bit linux * Fix several crashers 0.17.1 (unstable) * Support a p11-kit specific PKCS#11 attribute persistence format [#62156] * Use the SHA1 hash of SPKI as the CKA_ID in the trust module by default [#62329] * Refactor a trust builder which builds objects out of parsed data [#62329] * Combine trust policy when extracting certificates [#61497] * The extract --comment option adds comments to PEM bundles [#62029] * A new 'priority' config option for ordering modules [#61978] * Make each configured path its own trust module token [#61499] * Use --with-trust-paths to configure trust module [#62327] * Fix bug decoding some PEM files * Better debug output for trust module lookups * Work around bug in NSS when doing serial number lookups * Work around broken strndup() function in firefox * Fix the nickname for the distrusted attribute * Build fixes 0.16.4 (stable) * Display per command help again [#62153] * Don't always print tools debug output [#62152] 0.16.3 (stable) * When iterating don't skip tokens without the CKF_TOKEN_INITIALIZED flag * Hardcode some distrust records for NSS temporarily * Parse global options better in the p11-kit command * Better debugging 0.16.2 (stable) * Fix regression in 'p11-kit extract --purpose' option [#62009] * Documentation updates * Build fixes [#62001, ...] 0.16.1 (stable) * Don't break when cA field of BasicConstraints is missing [#61975] * Documentation fixes and updates * p11-kit extract-trust is a placeholder script now 0.16.0 (stable) * Update the pkcs11.h header for new mechanisms * Fix build and tests on mingw64 (ie: win32) * Relicense LGPL code to BSD license * Documentation tweaks * Pull translations from Transifex [#60792] * Build fixes [#61739, #60894, #61740] 0.15.2 (unstable) * Add German and Finish translations * Better define the libtasn1 dependency * Crasher and bug fixes * Build fixes 0.15.1 (unstable) * Fix some memory leaks * Add a location for packages to drop module configs * Documentation updates and fixes * Add command line tool manual page * Remove unused err() function and friends * Move more code into common/ directory and refactor * Add a system trust policy module * Refactor how the p11-kit command line tool works * Add p11-kit extract and extract-trust commands * Don't complain if we cannot access ~/.pkcs11/pkcs11.conf * Refuse to load the p11-kit-proxy.so as a registered module * Don't fail initialization if last initialized module fails 0.14 * Change default for user-config to merge * Always URI-encode the 'id' attribute in PKCS#11 URIs * Expect a .module extension on module configs * Windows compatibility fixes * Testing fixes * Build fixes 0.13 * Don't allow reading of PIN files larger than 4096 bytes * If a module is not marked as critical then ignore init failure * Use preconditions to check for input problems and out of memory * Add enable-in and disable-in options to module config * Fix the flags in pin.h * Use gcc extensions to check varargs during compile * Fix crasher when a duplicate module is present * Fix broken hashmap behavior * Testing fixes * Win32 build fixes * 'p11-kit -h' now works * Documentation fixes 0.12 * Build fix 0.11 * Remove automatic reinitialization of PKCS#11 after fork 0.10 * Build fixes, for windows, gcc 4.6.1 0.9 * p11-kit can't be used as a static library * Fix problems crashing when freeing TLS on windows * Add debug output to windows init and uninit of library * Build fixes, especially for windows 0.8 * Rename non-static functions to have a _p11_xxx prefix * No concurrent calling of C_Initialize and C_Finalize * Print more information in 'p11-kit -l' * Initial port to win32 * Build, testing fixes 0.7 * Expand p11-kit config variables correctly invarious build scenarios * Add test tool to print out error messages * Build fix on FreeBSD 0.6 * Add concept of a default module directory from which modules with relative paths are loaded. * Renamed pkg-config variables to make it clearer what's what. 0.5 * Fix crasher in p11_kit_registered_modules() * Add 'critical' setting for modules, which defaults to 'no' * Fix initialization issues in the proxy module 0.4 * Fix endless loop if module forks during initialization * Update PKCS#11 URI code for new draft of spec * Don't fail when duplicate modules are configured * Better debug output * Add example configuration documentation * Support whitespace in PKCS#11 URIs 0.3 * Rewrite hash table, and simplify licensing. * Correct paths for p11-kit config files. * Many build fixes and tweaks. 0.2 * List token labels in 'p11-kit -l' * Add API's for handing the pinfile part of URIs * Use /etc/pkcs11 by default instead of ${prefix}/etc/pkcs11 * Bug fixes 0.1 * Initial release modules/p11-kit-trust.module000064400000001606152527227170012005 0ustar00# See pkcs11.conf(5) to understand this file # This is a module config for the 'included' p11-kit trust module module: p11-kit-trust.so # This setting affects the order that trust policy and other information # is looked up when going across various modules. Other trust policy modules # need to specify the priority where they slot into things. priority: 1 # Mark this module as a viable source of trust policy information trust-policy: yes # This is for drop-in compatibility with glib-networking and gcr. Those # projects used this non-standard attribute to denote slots to use to # retrieve trust information. x-trust-lookup: pkcs11:library-description=PKCS%2311%20Kit%20Trust%20Module # Prevent this module being loaded by the proxy module disable-in: p11-kit-proxy # This will be overwritten by appending "verbose=yes", if the trust # command is called with the -v option. x-init-reserved: