WIP: lmp-el2go-auto-register: fix PKCS#11 slot initialization

[mwasilew]

This patch fixes the potential issues when running the auto-registration script on the device:

1. 1st slot gets overwritten If the 1st slot is not labeled 'aktualizr' and lmp-el2go-auto-register can't log into it with it's default PIN it would overwrite it. This might mean data loss for some othe deamon which initialized the slot

2. Objects not stored in proper slots When writing to pkcs#11 lmp-el2go-auto-register was not using the slot label consistently. This means that some objects were written in proper slot while some other not. This would only happen if the 1st slot (0x0) was initialized with default PIN.

3. has_labels method doesn't use slot label For this reason it would always try to access 1st slot (0x0) and ignore the label. If slot with label 'aktualizr' was initialized in different position this would mean the certificate/key objects would not be stored properly.

Signed-off-by: Milosz Wasilewski [email protected]

[mwasilew]

This is still WIP. When testing I discovered that aklite also has similar assumptions. Aklite needs to be fixed before this patch can be merged to avoid regressions.

[mwasilew]

@rsalveti @ldts could you take a look?

[ricardosalveti]

PKCS#11 logic seems correct. I know it is a bit of a pain to depend and parse the tooling output, but this should improve quite a bit from what we have now.

Ideally we should be using the pkcs11 interface directly, and same for lmp-device-register (foundriesio/lmp-device-register#20), but this would be for another day.

[mwasilew]

lmp-device-register suffers from the same issue as lmp-el2go-auto-register. It will initialize token in the 1st slot and potentially overwrite the token that is already there.

[doanac]

Ideally we should be using the pkcs11 interface directly

Also - the ssscli code turns out to be a python project. So we could probably use its lib directly and do some big cleanups here.