sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-23 22:09:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Test the PKCS#11 build against SoftHSM in CI and warn once where the build has no driver

Browse Source
This commit is contained in:
Viktor Liu
2026-10-02 12:44:17 +02:00
parent 07cf08230c
commit 0ed3eb6139
7 changed files with 100 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/certproof/README.md
+4 -2
View File
@@ -197,8 +197,10 @@ The module is loaded at runtime without cgo, through `purego`, which means the b
dynamically linked against libc. The store is therefore compiled in only with `-tags pkcs11`
on linux/amd64 and linux/arm64: the deb and rpm packages are built that way, since they
target glibc distributions, while the release tarballs and the Alpine-based container
images keep the fully static build. Without the tag, setting `NB_TPM_PIN` logs that
the build lacks the support.
images keep the fully static build. The arm and 386 packages carry the tag too but have
no driver, so they behave like the static build. A build without support logs one warning
when a token is configured and keeps reading the PEM directory. The "Client PKCS#11 /
Unit" CI job builds with the tag and signs with a SoftHSM token.
To exercise the path without hardware, initialise a SoftHSM token and run the end-to-end
test, which imports a key and certificate itself: