Add pkcs11 provider backend pkcs11_dynload

[schreibwsag]

This PR adds a new pkcs11 backend "pkcs11_dynload" to the S-CORE pkcs11 provider.

pkcs11_dynload loads a PKCS#11 module at runtime via dlopen(). It compiles against a selected pkcs11.h header set provided by one of several interchangeable PKCS#11 header providers. pkcs11_dynload is based on the backend integration mechanism introduced with PR92. pkcs11_dynload does not require changes of the S-CORE pkcs11 provider.

The main use case of pcks11_dynload is to enable the S-CORE pkcs11 provider to use a pkcs11 module coming from the platform, not from the S-CORE build. This may be necessary in cases where the pkc11 module is not fully open source, e.g., NXP pkcs11-hse.

More information on how to use pkcs11_dynload is available in third_party/pkcs11_dynload/README.md.

Simple example: use platform SoftHSMv2 (/usr/lib/softhsm/libsofthsm2.so):

bazel build //score/...
--copt=-DPKCS11_LIB=/usr/lib/softhsm/libsofthsm2.so
--//score/crypto/src/backend:pkcs11_backend=//third_party/pkcs11_dynload:pkcs11_dynload_shared

By default, pkcs11_dynload is compiled against pkcs11.h extracted from @softhsm_source//:all.

The location of the pkcs11 module to be loaded must be provided by

--copt=-DPKCS11_LIB=< path to pkcs11 module >

Without definition of PKCS11_LIB, pkcs11_dynload will not compile.

closes #134

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: db9ec513-864b-42b0-b56f-aa74d87281df
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'score_baselibs_rust+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-4kzcXcvGi9xBEEnrPOiSEvteITZMPKmK3MNgJXQIGtY="
DEBUG: Repository score_baselibs_rust+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'score_logging+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-/Q5+YfLkbMpz5PfvOkNS7qA3ehzth4emFhTcsk4q3zQ="
DEBUG: Repository score_logging+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
WARNING: For repository 'score_docs_as_code', the root module requires module version score_docs_as_code@6.0.0, but got score_docs_as_code@8.0.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'score_devcontainer', the root module requires module version score_devcontainer@1.10.0, but got score_devcontainer@1.11.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 10.249s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

[github-actions]

The created documentation from the pull request is available at: docu-html

[Copilot]

Pull request overview

This PR introduces a new PKCS#11 backend shim (pkcs11_dynload) intended to let the S-CORE PKCS#11 provider load an external/platform PKCS#11 module at runtime via dlopen(), while compiling against a selectable pkcs11.h header provider.

Changes:

• Adds a new third_party/pkcs11_dynload package with a C_GetFunctionList dynload shim and a Bazel build setting for selecting PKCS#11 header sources.
• Documents usage of the dynloader and header-provider abstraction in a new README.
• Updates MODULE.bazel.lock (lockfile regeneration).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
third_party/pkcs11_dynload/pkcs11_dynload.cpp	Adds the runtime dynloader shim exporting C_GetFunctionList() and loading the real module via dlopen().
third_party/pkcs11_dynload/BUILD	Defines build setting + targets for selecting header providers and building the dynload shim library.
third_party/pkcs11_dynload/provider.bzl	Adds a small Starlark helper for publishing PKCS#11 headers in a uniform shape.
third_party/pkcs11_dynload/README.md	Documents configuration/usage, including selecting header providers and setting the module path.
MODULE.bazel.lock	Lockfile delta from Bazel module dependency resolution.

Suppressed comments (1)

third_party/pkcs11_dynload/pkcs11_dynload.cpp:62

• After requiring PKCS11_LIB to be a string literal, initialize libPath directly from the macro (the current EXPANDTOSTRING(PKCS11_LIB) will no longer compile and is not needed).

    std::string libPath{EXPANDTOSTRING(PKCS11_LIB)};

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ChansAlive]

According to #134 , we are also supposed to document the AoU. Is at also part of this?
cc: @sunildevda

[ChansAlive]

Initial review points

[masc2023]

fine for now

[sunildevda]

thanks for the changes. looks good for me too.

[github-actions]

Documentation preview for this pull request is available at:
pr-168: https://eclipse-score.github.io/inc_security_crypto/pr-168/

[ChansAlive]

Minor doc fix.
Since no test is running in pipeline using the proposed backend, have tested it locally for the softhsm as the lib to be dynamically loaded. Test passed for pkcs11 provider test in linux.
For qnx, the path to the library had to be adapted to fit with the deployment. This however could be resolved when path is later obtained from the configuration.