Shared storage infrastructure and provider capability routing for certificate management by ChansAlive · Pull Request #160 · eclipse-score/inc_security_crypto

ChansAlive · 2026-08-13T09:51:45Z

Foundational groundwork for the certificate management daemon component.

Shared deployment storage (daemon/common/storage/) extracted from key_management — reusable KV loader/writer and atomic file I/O primitives backed by score::filesystem baselibs.
Provider capability selection extended to route certificate context types to the correct provider (software-first for kCertManagement).
Certificate API types and contexts promoted from api/future/ to stable namespaces.

Closes #162

github-actions · 2026-08-13T09:53:11Z

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: 0a333bf3-cf6d-42d6-a45e-ed281fcd7e0b
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
WARNING: For repository 'score_bazel_platforms', the root module requires module version score_bazel_platforms@0.1.2, but got score_bazel_platforms@1.1.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'score_process_description', the root module requires module version score_process_description@2.1.1, but got score_process_description@2.1.2 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 20.032s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

github-actions · 2026-08-13T09:54:41Z

The created documentation from the pull request is available at: docu-html

OliverHeilwagen

Approve with suggestions.

OliverHeilwagen · 2026-09-29T20:23:43Z

+        "//score/crypto/src/api/objects:cert_objects",
        "//score/crypto/src/api/future/common:future_common",
+
        "//score/crypto/src/backend:active_pkcs11_backend",


Not changed by this PR but i would assume we can simply have //score/crypto/src/daemon:crypto_daemon and do not specify subcomponents or selected backends, these should come automatic.

I can try it in #197

OliverHeilwagen · 2026-09-29T22:38:54Z

+    /// @param sha256_fingerprint 32-byte SHA-256 fingerprint of the certificate to remove
+    virtual score::Result<std::monostate> RemoveCertificateFromTrustStore(
+        const CryptoResourceId& trust_store,
+        score::cpp::span<const uint8_t> sha256_fingerprint) = 0;


Why not const std::array<uint8_t, kSha256FingerprintSize>&? This way we should be able to skip some validity checks, same applies to other APIs which use fingerprint.

I will explore in the implementation PR #251

ChansAlive · 2026-09-30T08:03:22Z

@masc2023 or @PandaeDo :
The PR is reviewed already, could you kindly approve and if possible merge the same?
Thanks in advance.

cc: @OliverHeilwagen @ugeshmunirjulu @sunildevda

ChansAlive had a problem deploying to workflow-approval August 13, 2026 09:51 — with GitHub Actions Failure

ChansAlive requested a review from OliverHeilwagen August 13, 2026 09:51

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from d8c0760 to 3806c91 Compare August 13, 2026 20:40

ChansAlive had a problem deploying to workflow-approval August 13, 2026 20:40 — with GitHub Actions Failure

ChansAlive had a problem deploying to workflow-approval August 14, 2026 10:24 — with GitHub Actions Failure

ChansAlive marked this pull request as ready for review August 14, 2026 10:24

ChansAlive requested a review from sunildevda August 14, 2026 10:25

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from a425c7b to 60c98d8 Compare August 19, 2026 07:31

ChansAlive had a problem deploying to workflow-approval August 19, 2026 07:31 — with GitHub Actions Failure

ChansAlive had a problem deploying to workflow-approval August 19, 2026 08:00 — with GitHub Actions Failure

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from a0b9c2c to 186e256 Compare August 24, 2026 21:10

ChansAlive had a problem deploying to workflow-approval August 24, 2026 21:10 — with GitHub Actions Failure

ChansAlive had a problem deploying to workflow-approval August 25, 2026 10:21 — with GitHub Actions Failure

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from 03e9354 to 9d4bc98 Compare August 25, 2026 11:08

ChansAlive had a problem deploying to workflow-approval August 25, 2026 11:08 — with GitHub Actions Failure

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from 9d4bc98 to cee8b32 Compare August 25, 2026 11:27

ChansAlive had a problem deploying to workflow-approval August 25, 2026 11:27 — with GitHub Actions Failure

ChansAlive had a problem deploying to workflow-approval August 25, 2026 12:37 — with GitHub Actions Failure

ChansAlive added 27 commits September 29, 2026 17:51

Formatting fix

0cf89d1

Added two more file io fn

196d0d5

Use baselibs for filesystem IO

23c5993

Minor doc update

65cf7d2

Make dependancy explicit in keym

af8ecb5

Minor code doc fix

8a065b4

Cert APIs update and config entry rename

6552c37

Fix name inconsistancy in config

88e0fb3

Minor fix on the file write

d3ad5f6

API update for cert management

f7e1a33

Fix coverage workflow

54b966d

Refactor types to common, cert and keys

291ddc3

Separate trust store mgmt ctx

01e2984

Storage refactor

661ad0b

Mediator provider capability fix

16937ef

Crl inspect and more verify evidence

57d0fe5

Doc update

6d11ac8

Trust store object refactor

36e4cf6

Remove redundant header

7784dd6

Minor doc update

a0b9547

Review fix: provider manager

07df584

Review fix: deployment validator

da07426

Review fix: Minor daemon code refactor

7f0f432

Review fix: UT file rename

38cabd6

Review fix: API adaptations

8bbd075

Test fix for qnx variant

f7a3588

R-Fix: change keymgmnt ctx to be scoped

72e4cf5

OliverHeilwagen approved these changes Sep 29, 2026

View reviewed changes

PandaeDo approved these changes Sep 30, 2026

View reviewed changes

Navigation Menu

Repository navigation

Shared storage infrastructure and provider capability routing for certificate management - #160

Shared storage infrastructure and provider capability routing for certificate management#160
PandaeDo merged 34 commits into
eclipse-score:mainfrom
etas-contrib:feature/cert_api_and_common_refactor

ChansAlive commented Aug 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

OliverHeilwagen left a comment

Uh oh!

OliverHeilwagen Sep 29, 2026

Uh oh!

ChansAlive Sep 30, 2026

Uh oh!

OliverHeilwagen Sep 29, 2026

Uh oh!

ChansAlive Sep 30, 2026

Uh oh!

ChansAlive commented Sep 30, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

ChansAlive commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

License Check Results

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

OliverHeilwagen left a comment

Choose a reason for hiding this comment

Uh oh!

OliverHeilwagen Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

OliverHeilwagen Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ChansAlive commented Aug 13, 2026 •

edited

Loading

github-actions Bot commented Aug 13, 2026 •

edited

Loading

ChansAlive commented Sep 30, 2026 •

edited

Loading