confium_store_pkcs11/
lib.rs

1#![allow(rustdoc::broken_intra_doc_links)]
2#![allow(rustdoc::bare_urls)]
3#![allow(rustdoc::redundant_explicit_links)]
4#![allow(rustdoc::private_intra_doc_links)]
5#![allow(rustdoc::invalid_html_tags)]
6
7//! Confium Store PKCS#11 backend.
8//!
9//! Wraps the [PKCS#11] standard via the [`cryptoki`] Rust crate
10//! (Apache-2.0), giving Confium a hardware-backed `StoreBackend` for
11//! HSMs (YubiHSM, Thales, Utimaco), smartcards, and software tokens
12//! such as [SoftHSM2].
13//!
14//! The backend implements [`confium_store::backend::StoreBackend`] and
15//! registers itself at link time under the wire name `"pkcs11"`. It is
16//! a drop-in replacement for the filesystem and memory backends that
17//! ship in `confium-store` — same Rust API, different storage.
18//!
19//! # Configuration
20//!
21//! Open-time options (passed via
22//! [`confium_store::backend::Options`]):
23//!
24//! | key              | meaning                                            |
25//! |------------------|----------------------------------------------------|
26//! | `pkcs11_module`  | filesystem path to the PKCS#11 `.so` / `.dylib`    |
27//! | `slot_id`        | HSM slot, as a decimal `u64`                       |
28//! | `pin`            | user PIN (prompted at runtime if absent)           |
29//! | `token_label`    | token label for slot discovery (optional)          |
30//!
31//! # Status
32//!
33//! This is a skeleton crate. The factory loads and initializes the
34//! PKCS#11 module, resolves the configured slot, and opens a logged-in
35//! R/W session. The actual HSM object operations (`put_secret`,
36//! `get_secret`, …) return
37//! [`confium_store::error::Error::NotImplemented`]. Filling them in is
38//! tracked in `TODO.roadmap/18-hardware-keystore-backends.md`.
39//!
40//! # Tests
41//!
42//! Integration tests exercise a real HSM via SoftHSM2; they are skipped
43//! automatically when the `TEST_PKCS11_MODULE` environment variable is
44//! unset (so CI environments without an HSM do not spuriously fail).
45//!
46//! [PKCS#11]: https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
47//! [SoftHSM2]: https://www.opendnssec.org/softhsm/
48
49pub mod backend;
50pub mod config;
51pub mod error;
52pub mod instance;
53
54pub use backend::Pkcs11Backend;
55pub use config::{Config, OPT_PIN, OPT_PKCS11_MODULE, OPT_SLOT_ID, OPT_TOKEN_LABEL};
56pub use instance::Pkcs11Instance;
confium_store_pkcs11/lib.rs

confium_store_pkcs11/
lib.rs
