Skip to content
This repository was archived by the owner on May 18, 2026. It is now read-only.

Add Rust hlkx-sign tool for signing HLKX packages with PKCS#11#2

Draft
Copilot wants to merge 18 commits into
masterfrom
copilot/port-hlkx-signing-tool-to-rust
Draft

Add Rust hlkx-sign tool for signing HLKX packages with PKCS#11#2
Copilot wants to merge 18 commits into
masterfrom
copilot/port-hlkx-signing-tool-to-rust

Conversation

Copy link
Copy Markdown

Copilot AI commented May 12, 2026

  • Understand current PKCS#11 URI parsing and slot iteration
  • Update pkcs11.rs:
    • Replaced extract_label() with Pkcs11Uri struct that parses object=, token=, and pin-value= in one pass
    • token_label_matches() helper calls pkcs11.get_token_info(slot) to compare trimmed token labels
    • In load_certificate_der and pkcs11_sign: skip slots that don't match token=; call maybe_login only on matching slots with the pin-value= from the URI
    • Removed pin parameter from both public functions
    • 4 unit tests for URI parser
  • Update main.rs: removed --pkcs11-pin flag and all related pin-passing code
  • Update README.md: removed --pkcs11-pin references, added pin-value= URI example, added timestamp flags to options table, updated object identification section
  • Fix CodeQL false positive: use byte-level MSB masking for nonce instead of bitmask constant
  • 6 tests pass
  • Run parallel_validation

Chrono doesn't support %.1f, only %.3f. To fix it, we just hardcode .0 instead.
@roblabla roblabla force-pushed the copilot/port-hlkx-signing-tool-to-rust branch from 2726131 to 6505929 Compare May 13, 2026 15:33
@roblabla roblabla force-pushed the copilot/port-hlkx-signing-tool-to-rust branch from 6505929 to 79b5a7f Compare May 13, 2026 15:41
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants