On Friday, June 27, 2014 16:22:21 Kai Engert wrote:
> On Tue, 2014-03-18 at 13:40 +0100, Kamil Dudka wrote:
>>> - in CreateObject with CKO_PRIVATE_KEY, don't reset
>>>
>>> the nickname back to filename contents, seems wrong
>>
>> As already discussed off-list, the above line was added on purpose to fix
>> (or work around?) a real bug:
>>
>>
https://bugzilla.redhat.com/show_bug.cgi?id=689031#c66
>>
>> It might be no longer necessary with up2date versions of packages using
>> NSS, but we should be careful when removing the line. In particular, we
>> should double-check that the patch in question does not reintroduce the
>> above bug.
> Ok, thanks, I've added it back:
>
https://git.fedorahosted.org/cgit/nss-pem.git/commit/
>
> If I understand correctly, all nicknames in PEM must be unique. But the
> code doesn't attempt to enforce them to be unique. Instead, the code
> simply hopes that using the full path of a nickname will be unique.
>
> It would be better to have code that looks at the list of existing
> nicknames, and if a duplicate exists, modifies the nickname (e.g. by
> appending a number, and increasing the number), until a unique nickname
> is found.
>
> Do you agree?
I do not know whether nss itself requires the nicknames to be unique but
up2date libcurl has no assumptions about the nicknames assigned by nss-pem.
What does it mean to have the same cert/key in different tokens? If the
paths are the same, then shouldn't the existing token just be used? I
think that was on my mind, if not actually implemented.
rob