New release checklist 🕴

[hug-dev]

We are approaching the first release of Parsec following an established process. The release will be 0.8.0 and is planned for early september.

This is a discussion space to gather the items to be done during the code freeze period and just after the release. Please feel free to comment and I will keep this page updated. I will also update it as we go through the process of making a release. Some of the information here will also be used to update the Parsec Release Process.

Date of the code freeze period

01/08/2021

During the code freeze period

• Pull in the latest git dependencies in the crates they are going to be used to make sure using the latest release would work
• Publish new versions of all managed crates. See this guide
• Execute the normal e2e tests on real hardware:
  • Nitrokey HSM (@paulhowardarm volunteered)
  • Raspberry Pi with TPM (@hug-dev volunteered)
  • Trusted Services on a supported board (@ionut-arm volunteered if possible)
• Execute fuzz testing for some time
• Ask the Linux distributions packagers to try the tagged version
• Ask the Parsec Yocto maintainers to try the tagged version
• Ask any interested people to try the tagged version
• Review the book and make sure all pages are up-to-date. In particular make sure the Threat Model is up to date.
• Make sure all the markdown pages (like the README) are looking good.
• Make sure the rustdoc pages (on docs.rs) are looking good (before and after the release).
• If there are any bugs reported, make new MINOR or PATCH tags (that would be 0.8.x for this release)
• When everything is OK (or at the end of the maximum code freeze time, one month), make a GitHub release out of the last tag which includes its changelog, ask maintainers to release this version of Parsec

After the release

• Close issues fixed in the release and the past milestone
• Make a new issue milestone for the next release
• Publish the new quickstart bundle and update the quickstart guide with it
• Update the Parsec Release Process with what we learnt
• Update the Parsec Tool demo
• Profit 🥂

[ionut-arm]

For the 2nd point above, I'll try to test our integration with the Trusted Services on real hardware as soon as I get my hands on a supported board.

[hug-dev]

@nullr0ute @ggardet @anta5010 I am kindly notifying you that Parsec version 0.8.0 is now available (as a git tag). We would really appreciate if you could test its packaging in respectively Fedora, openSUSE and Yocto to make sure everything is ok!
Our intention is to publish 0.8.x fixes with the problems that we find during packaging and testing on real hardware. Hopefully none! We hope to publish the final release in around a month's time.

You can see the full changelog here but in short there are the following new things:

• More operations added to the TS and CryptoAuthLib providers
• First release with stability checks
• Support of ECC keys in the PKCS11 provider
• SPIFFE-based authenticator
• Cross-compilation available for more targets

[hug-dev]

When the trusted-service-provider feature is activated, Parsec will try to link with the Trusted Service (TS) library. A dependency probably does not already exist for that so I guess people would have to build the library manually.

It might be fine to first release without that provider though.

[ggardet]

openSUSE Tumbleweed build is fine without trusted-service-provider.
openSUSE Leap 15.3 build is fine without trusted-service-provider and without jwt-svid-authenticator (SPIFFE-based authenticator).

Regarding Trusted Service (TS) library, having git submodule "trusted-services-vendor" is not enough?

[anta5010]

No, it's not enough. TS provider requires libts from https://git.trustedfirmware.org/TS/trusted-services.git

[ggardet]

No, it's not enough. TS provider requires libts from https://git.trustedfirmware.org/TS/trusted-services.git

Which is cloned already as git submodule trusted-services-vendor. So, it is a bit weird to clone it here, but still requiring some part to be external, with the risk of a version mismatch. I would expect it to be all external or all internal (or having the choice), but not a mix.

[hug-dev]

openSUSE Tumbleweed build is fine without trusted-service-provider.
openSUSE Leap 15.3 build is fine without trusted-service-provider and without jwt-svid-authenticator (SPIFFE-based authenticator).

Well that's good to know! On our side it would be fine to release with just those features. The main providers are TPM, PKCS11 and Mbed Crypto at the moment. It is fine for now to exclude the TS one and add it in the future when it becomes more mainstream.

[wiktor-k]

Hi folks!

I started testing parsec on my Yubikey and get many tests failing. I don't think this is related to this release but I'll post the details anyway for forensics.

I'm running one test to keep the log to minimum:

$ PARSEC_SERVICE_ENDPOINT="unix:/tmp/parsec.sock" cargo test --features pkcs11-provider 'per_provider::normal_tests::key_attributes::wrong_usage_flags'
    Finished test [unoptimized + debuginfo] target(s) in 0.09s
     Running unittests (target/debug/deps/e2e_tests-9efeeb646720b3e8)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/mod.rs (target/debug/deps/mod-df923b6e50f9cab3)

running 1 test
test per_provider::normal_tests::key_attributes::wrong_usage_flags ... FAILED

failures:

---- per_provider::normal_tests::key_attributes::wrong_usage_flags stdout ----
thread 'per_provider::normal_tests::key_attributes::wrong_usage_flags' panicked at 'called `Result::unwrap()` on an `Err` value: PsaErrorCommunicationFailure', tests/per_provider/normal_tests/key_attributes.rs:103:14
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    per_provider::normal_tests::key_attributes::wrong_usage_flags

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 154 filtered out; finished in 0.24s

error: test failed, to rerun pass '--test mod'

The parsec service logs (intermixed with Yubico's PKCS#11 driver logs):

[INFO  parsec] Parsec started. Configuring the service...
[INFO  parsec_service::utils::service_builder] Creating a PKCS 11 Provider.
[INFO  parsec_service::providers::pkcs11] Building a PKCS 11 provider with library '/home/wiktor/src/pep/yubico-piv-tool/build/ykcs11/libykcs11.so'
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:118 (C_Initialize): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:202 (C_Initialize): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:318 (C_GetSlotList): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:387 (C_GetSlotList): Initializing slot 0 for 'Yubico YubiKey OTP+FIDO+CCID 00 00'
Connect reader 'Yubico YubiKey OTP+FIDO+CCID 00 00'.
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:409 (C_GetSlotList): Connected slot 0 to 'Yubico YubiKey OTP+FIDO+CCID 00 00'
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:470 (C_GetSlotList): token present is 1
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:471 (C_GetSlotList): number of slots is 1
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:475 (C_GetSlotList): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:318 (C_GetSlotList): In
Validate reader 'Yubico YubiKey OTP+FIDO+CCID 00 00'.
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:470 (C_GetSlotList): token present is 1
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:471 (C_GetSlotList): number of slots is 1
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:475 (C_GetSlotList): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:523 (C_GetTokenInfo): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:588 (C_GetTokenInfo): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:890 (C_OpenSession): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 86 slot 9a: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 86 slot 9a: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 0 slot 5fc105: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:959 (C_OpenSession): Created attestation for object 87 slot 9c
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 63, slot contains 1 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 87, slot contains 2 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 112, slot contains 3 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 511 bytes for object 1 slot 5fc10a
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 1, slot contains 4 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 38, slot contains 5 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 88 slot 9d: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 88 slot 9d: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 2 slot 5fc10b: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 89 slot 9e: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 89 slot 9e: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 3 slot 5fc101: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 90 slot 82: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 90 slot 82: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 4 slot 5fc10d: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 91 slot 83: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 91 slot 83: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 5 slot 5fc10e: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 92 slot 84: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 92 slot 84: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 6 slot 5fc10f: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 93 slot 85: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 93 slot 85: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 7 slot 5fc110: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 94 slot 86: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 94 slot 86: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 8 slot 5fc111: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 95 slot 87: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 95 slot 87: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 9 slot 5fc112: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 96 slot 88: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 96 slot 88: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 10 slot 5fc113: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 97 slot 89: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 97 slot 89: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 11 slot 5fc114: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 98 slot 8a: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 98 slot 8a: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 12 slot 5fc115: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 99 slot 8b: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 99 slot 8b: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 13 slot 5fc116: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 100 slot 8c: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 100 slot 8c: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 14 slot 5fc117: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 101 slot 8d: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 101 slot 8d: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 15 slot 5fc118: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 102 slot 8e: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 102 slot 8e: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 16 slot 5fc119: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 103 slot 8f: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 103 slot 8f: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 17 slot 5fc11a: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 104 slot 90: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 104 slot 90: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 18 slot 5fc11b: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 105 slot 91: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 105 slot 91: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 19 slot 5fc11c: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 106 slot 92: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 106 slot 92: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 20 slot 5fc11d: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 107 slot 93: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 107 slot 93: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 21 slot 5fc11e: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 108 slot 94: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 108 slot 94: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 22 slot 5fc11f: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 109 slot 95: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 109 slot 95: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 23 slot 5fc120: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 110 slot f9: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 110 slot f9: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 770 bytes for object 24 slot 5fff01
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 24, slot contains 6 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 61, slot contains 7 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 110, slot contains 8 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 135, slot contains 9 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 25 slot 5fc107: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 59 bytes for object 26 slot 5fc102
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 26, slot contains 10 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 28 slot 5fc106: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 18 bytes for object 31 slot 7e
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 31, slot contains 11 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 32 slot 5fc10c: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 35 slot 5fc122: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 36 slot 5fc123: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1030 (C_OpenSession): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1215 (C_Login): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1231 (C_Login): userType 1, pinLen 6
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1323 (C_Login): Successfully logged in
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1327 (C_Login): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1335 (C_Logout): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1365 (C_Logout): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1038 (C_CloseSession): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:85 (cleanup_session): Cleaning up session 1
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:90 (cleanup_slot): Cleaning up slot 0
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1079 (C_CloseSession): Out
[WARN  parsec_service::utils::service_builder] Direct authenticator has been set as the default one. It is only secure under specific requirements. Please make sure to read the Recommendations on a Secure Parsec Deployment at https://parallaxsecond.github.io/parsec-book/parsec_security/secure_deployment.html
[WARN  parsec_service::front::domain_socket] Removing the existing socket file at /tmp/parsec.sock.
[INFO  parsec] Parsec is ready.
[INFO  parsec_service::front::front_end] New request received without authentication
[INFO  parsec_service::front::front_end] Response sent back from request without authentication
[INFO  parsec_service::front::front_end] New request received without authentication
[INFO  parsec_service::front::front_end] Response sent back from request without authentication
[INFO  parsec_service::front::front_end] New request received from application name "root"
[INFO  parsec_service::front::front_end] Response for application name "root" sent back
[INFO  parsec_service::front::front_end] New request received from application name "root"
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:890 (C_OpenSession): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 86 slot 9a: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 86 slot 9a: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 0 slot 5fc105: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:959 (C_OpenSession): Created attestation for object 87 slot 9c
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 63, slot contains 1 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 87, slot contains 2 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 112, slot contains 3 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 511 bytes for object 1 slot 5fc10a
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 1, slot contains 4 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 38, slot contains 5 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 88 slot 9d: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 88 slot 9d: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 2 slot 5fc10b: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 89 slot 9e: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 89 slot 9e: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 3 slot 5fc101: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 90 slot 82: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 90 slot 82: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 4 slot 5fc10d: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 91 slot 83: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 91 slot 83: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 5 slot 5fc10e: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 92 slot 84: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 92 slot 84: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 6 slot 5fc10f: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 93 slot 85: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 93 slot 85: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 7 slot 5fc110: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 94 slot 86: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 94 slot 86: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 8 slot 5fc111: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 95 slot 87: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 95 slot 87: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 9 slot 5fc112: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 96 slot 88: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 96 slot 88: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 10 slot 5fc113: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 97 slot 89: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 97 slot 89: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 11 slot 5fc114: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 98 slot 8a: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 98 slot 8a: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 12 slot 5fc115: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 99 slot 8b: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 99 slot 8b: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 13 slot 5fc116: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 100 slot 8c: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 100 slot 8c: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 14 slot 5fc117: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 101 slot 8d: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 101 slot 8d: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 15 slot 5fc118: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 102 slot 8e: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 102 slot 8e: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 16 slot 5fc119: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 103 slot 8f: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 103 slot 8f: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 17 slot 5fc11a: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 104 slot 90: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 104 slot 90: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 18 slot 5fc11b: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 105 slot 91: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 105 slot 91: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 19 slot 5fc11c: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 106 slot 92: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 106 slot 92: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 20 slot 5fc11d: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 107 slot 93: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 107 slot 93: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 21 slot 5fc11e: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 108 slot 94: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 108 slot 94: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 22 slot 5fc11f: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 109 slot 95: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 109 slot 95: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 23 slot 5fc120: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:974 (C_OpenSession): Failed to create attestation for object 110 slot f9: Argument error
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:991 (C_OpenSession): Failed to fetch metadata for object 110 slot f9: Not supported
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 770 bytes for object 24 slot 5fff01
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 24, slot contains 6 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 61, slot contains 7 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 110, slot contains 8 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 135, slot contains 9 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 25 slot 5fc107: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 59 bytes for object 26 slot 5fc102
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 26, slot contains 10 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 28 slot 5fc106: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1001 (C_OpenSession): Fetched 18 bytes for object 31 slot 7e
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/objects.c:1339 (add_object): Added object 31, slot contains 11 objects
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 32 slot 5fc10c: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 35 slot 5fc122: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:998 (C_OpenSession): Failed to fetch object 36 slot 5fc123: Invalid object
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1030 (C_OpenSession): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1215 (C_Login): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1231 (C_Login): userType 1, pinLen 6
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1323 (C_Login): Successfully logged in
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1327 (C_Login): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:3403 (C_GenerateKeyPair): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:3444 (C_GenerateKeyPair): Trying to generate a key pair with mechanism 0
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:3446 (C_GenerateKeyPair): Found 10 attributes for the public key and 10 attributes for the private key
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/mechanisms.c:644 (check_pubkey_template): Bad CKA_ID
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:3458 (C_GenerateKeyPair): Invalid public key template
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:3557 (C_GenerateKeyPair): Out
[ERROR parsec_service::providers::pkcs11::key_management] Generate key status; Error: PKCS11 error: An invalid value was specified for a particular attribute in a template.  See Section 4.1 for more information.
[ERROR parsec_service::providers::pkcs11::utils] Error converted to PsaErrorCommunicationFailure; Error: An invalid value was specified for a particular attribute in a template.  See Section 4.1 for more information.
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1335 (C_Logout): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1365 (C_Logout): Out
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1038 (C_CloseSession): In
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:85 (cleanup_session): Cleaning up session 1
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:90 (cleanup_slot): Cleaning up slot 0
debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/ykcs11.c:1079 (C_CloseSession): Out
[INFO  parsec_service::front::front_end] Response for application name "root" sent back
```</details>

Thank you in advance for help! :bow: 

[ionut-arm]

Seems the problem is:

debug: /home/wiktor/src/pep/yubico-piv-tool/ykcs11/mechanisms.c:644 (check_pubkey_template): Bad CKA_ID

Coming from here - I'll dig a bit.

[ionut-arm]

Seems if you give it a CKA_ID they check both for public and private part of keys if they already have one (expecting one to be there). So maybe we shouldn't generate our own ID and let the token generate it for us? That would mean after generating we make a call to get the attributes and see what the ID is. I really wish the spec would be more clear what is set by whom...... 🙄

[hug-dev]

I have investigated a bit more and it fails because this check fails. It checks that the key ID entered in the template is contained in between 1 and 25. I believe that maps to all the available slots here.
In the case of Parsec that fails because we assign the key IDs randomly.
I am wondering if the key generation will succeed even after because we only log in as a regular user and not SO user in Parsec.

Before we go into ways to solve this, I was generally wondering if the YKCS11 library is really made to make the Yubikey a general HSM product? It seems, from what I have been reading from the docs, that it is mainly made to be used via the PIV tool. I am not sure if it is made to be used by itself by consumers of PKCS11 like Parsec?
Maybe for Parsec a better candidate would be the YubiHSM2 and its YubiHSM PKCS#11 Module?

[wiktor-k]

Understood. Yes, maybe Yubikeys are not a good fit for Parsec. I guess this should be documented somehow that a fully compatible PKCS11 interface is required.

I'm not sure about the YKCS being used solely for PIV it's rather for compatibility with some apps that interface with keys via PKCS#11 but I'm not sure and I'd like to refrain from putting words in Yubico's mouths :)

[hug-dev]

@nullr0ute parallaxsecond/rust-psa-crypto#93 was merged, hope it helped somehow. Anything more we can do to help?

We decided yesterday (during the community meeting) that we will make the 0.8.0 release at the end of August. We can make patch releases afterwards to fix the remaining bugs.