On Tue, 2014-03-18 at 13:40 +0100, Kamil Dudka wrote:
> - in CreateObject with CKO_PRIVATE_KEY, don't reset
> the nickname back to filename contents, seems wrong
As already discussed off-list, the above line was added on purpose to fix
(or work around?) a real bug:
https://bugzilla.redhat.com/show_bug.cgi?id=689031#c66
It might be no longer necessary with up2date versions of packages using NSS,
but we should be careful when removing the line. In particular, we should
double-check that the patch in question does not reintroduce the above bug.
Ok, thanks, I've added it back:
https://git.fedorahosted.org/cgit/nss-pem.git/commit/
If I understand correctly, all nicknames in PEM must be unique. But the
code doesn't attempt to enforce them to be unique. Instead, the code
simply hopes that using the full path of a nickname will be unique.
It would be better to have code that looks at the list of existing
nicknames, and if a duplicate exists, modifies the nickname (e.g. by
appending a number, and increasing the number), until a unique nickname
is found.
Do you agree?
Kai