MIME-Version: 1.0
In-Reply-To: <rt-3.8.6-32481-1393533314-95.35465-5-0@isc.org>
References: <RT-Ticket-35465@isc.org> <530E0424.1030407@redhat.com> <rt-3.8.6-32481-1393533314-95.35465-5-0@isc.org>
Message-ID: <53107FF3.3030202@redhat.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Organization: Red Hat
Subject: Re: [ISC-Bugs #35465] --enable-native-pkcs11 doesn't work with SoftHSM
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
Date: Fri, 28 Feb 2014 13:24:19 +0100
To: bind9-bugs@isc.org
Content-Transfer-Encoding: 7bit
From: Petr Spacek <pspacek@redhat.com>
RT-Message-ID: <rt-3.8.6-32481-1393590276-1189.35465-0-0@isc.org>
Content-Length: 1123

On 27.2.2014 21:35, Francis Dupont via RT wrote:
> On Wed Feb 26 15:11:58 2014, pspacek@redhat.com wrote:
>> I'm trying to test BIND 9.10.0b1 with SoftHSM 1.3.3-4.fc20.x86_64
>> and it doesn't work.
>
> => it can't work: SoftHSM v1 (vs v2) doesn't implement
> some required PKCS#11 mechanisms.
> BTW the pkcs11-tokens application was created to check
> this point.
Great! I think this deserves *big fat* note in release notes.

>> The same version of SoftHSM works with pkcs11-list from BIND 9.9.4-P2:
>
> => BIND 9.9.4 has no native PKCS#11 support so
> can't be wrongly configured with a too incomplete
> PKCS#11 provider...
This could be also mentioned in release notes...

> A question: do you believe we should covert
> the failure into a warning for PKCS#11 tools?
> It could be more user friendly but at another hand
> if someone ignores the warning it won't change the
> fact that *all* other tools will fail...

Personally, I like verbose error messages. I think that it is not necessary to 
hide the underlying error code etc. Simply some additional text would help.

Thank you for your time!

-- 
Petr^2 Spacek