On Tue, 2014-03-18 at 13:40 +0100, Kamil Dudka wrote:
> > - in CreateObject with CKO_PRIVATE_KEY, don't reset
> >
> > the nickname back to filename contents, seems wrong
>
> As already discussed off-list, the above line was added on purpose to fix
> (or work around?) a real bug:
>
>
https://bugzilla.redhat.com/show_bug.cgi?id=689031#c66
>
> It might be no longer necessary with up2date versions of packages using
> NSS, but we should be careful when removing the line. In particular, we
> should double-check that the patch in question does not reintroduce the
> above bug.
Ok, thanks, I've added it back:
https://git.fedorahosted.org/cgit/nss-pem.git/commit/
If I understand correctly, all nicknames in PEM must be unique. But the
code doesn't attempt to enforce them to be unique. Instead, the code
simply hopes that using the full path of a nickname will be unique.
It would be better to have code that looks at the list of existing
nicknames, and if a duplicate exists, modifies the nickname (e.g. by
appending a number, and increasing the number), until a unique nickname
is found.
Do you agree?
I do not know whether nss itself requires the nicknames to be unique but
up2date libcurl has no assumptions about the nicknames assigned by nss-pem.
Kamil