2.7.0 · softhsm SoftHSMv2 · Discussion #841 · GitHub

jschlyter
Jan 20, 2026
Maintainer

What's Changed

Issue Use after free on ENGINE_finish(rdrand_engine). #548: Don't clean up engines after OpenSSL has already shut down by @dwmw2 in Issue #548: Don't clean up engines after OpenSSL has already shut down #550
Fix OPENSSL_cleanup() detection without using our own atexit() handler by @dwmw2 in Fix OPENSSL_cleanup() detection without using our own atexit() handler #551
Fix advertised min and max mechanism sizes according to final PKCS#11 3.0 specification by @Jakuje in Fix advertised min and max mechanism sizes according to final PKCS#11 3.0 specification #522
Fix race condition between C_FindObjects and object creation (issue 573) by @rijswijk in Fix race condition between C_FindObjects and object creation (issue 573) #576
Fixing tests of other PKCS#11 implementations. by @larssilven in Fixing tests of other PKCS#11 implementations. #593
Add "objectstore.umask" configuration option for file/directory creation by @nomis in Add "objectstore.umask" configuration option for file/directory creation #566
Unbreak negative mechanism lists in slots.mechanisms + testcase by @Jakuje in Unbreak negative mechanism lists in slots.mechanisms + testcase #561
Add misc derivations by @realmfoo in Add misc derivations #571
Reduce the level of the log message when SoftHSM is already initialized by @nomis in Reduce the level of the log message when SoftHSM is already initialized #577
doc: Fix category title to reflect the actual option name by @Jakuje in doc: Fix category title to reflect the actual option name #580
Flush files before unlocking by @nomis in Flush files before unlocking #578
implement wrapping and unwrapping of Edwards curve-based private keys by @keldonin in implement wrapping and unwrapping of Edwards curve-based private keys #594
InfoTests::testGetMechanismNegativeListConfig() not working when testing by @larssilven in InfoTests::testGetMechanismNegativeListConfig() not working when testing #606
Fix CMake build by adding DEFAULT_UMASK by @rgerganov in Fix CMake build by adding DEFAULT_UMASK #617
Implement CKM_XXX_CBC_PAD wrapping and unwrapping mechanisms by @keldonin in Implement CKM_XXX_CBC_PAD wrapping and unwrapping mechanisms #600
fix check minimal Botan version by @agrandville in fix check minimal Botan version #629
softhsm2-util: add --show-config parameter by @alonbl in softhsm2-util: add --show-config parameter #611
Fix "Transaction in database is already active." bug by @ondergormez in Fix "Transaction in database is already active." bug #646
AES GCM without additional authenticated data crashes SoftHSM by @saper in AES GCM without additional authenticated data crashes SoftHSM #664
Fix broken if statement (fixes Null dereference in C_UnwrapKey #673) by @rijswijk in Fix broken if statement (fixes #673) #674
Amend PR 644 resolving conflicts and improvements by @halderen in Amend PR 644 resolving conflicts and improvements #717
CMake for windows platform refactored by @agrandville in CMake for windows platform refactored #644
Fix issue 585 by resetting en/decrypt op on input validation by @rijswijk in Fix issue 585 by resetting en/decrypt op on input validation #592
Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP… by @rijswijk in Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP… #591
Fix memory leak in SoftHSM::UnwrapKeySym. by @dcoombs in Fix memory leak in SoftHSM::UnwrapKeySym. #677
avoid unnecessary check for sqlite3 binary by @jluebbe in avoid unnecessary check for sqlite3 binary #694
Minor README.md fixes by @sarroutbi in Minor README.md fixes #744
Add GitHub Actions CI by @bjosv in Add GitHub Actions CI #733
Update Github actions by @jschlyter in Update Github actions #766
Upgrade github actions to macos-14 by @jschlyter in Upgrade github actions to macos-14 #769
Add code owners by @jschlyter in Add code owners #770
fix: Use CMAKE_SHARED_LIBRARY_SUFFIX instead of hardcode .so by @middagj in fix: Use CMAKE_SHARED_LIBRARY_SUFFIX instead of hardcode .so #762
Fix Botan build and test failures by @bjosv in Fix Botan build and test failures #771
Fix a typo in Mecahnisms by @wiktor-k in Fix a typo in Mecahnisms #760
Fix typo in Github actions by @jschlyter in Fix typo in Github actions #772
Replace obsolete macros in autoconf by @bjosv in Replace obsolete macros in autoconf #743
Fixes AES secret key import failing on newline characters by @ijsf in Fixes AES secret key import failing on newline characters #747
README: Minor update by @oej in README: Minor update #774
Correct build warnings on Linux and macOS by @bjosv in Correct build warnings on Linux and macOS #775
Fix severe peformance issue accessing keys by @nomis in Fix severe peformance issue accessing keys #681
Support import certificate using softhsm2-util by @alonbl in Support import certificate using softhsm2-util #612
Add configure option and code to disable OpenSSL engines by @bukka in Add configure option and code to disable OpenSSL engines #781
Replace CKR_GENERAL_ERROR with CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE upon decryption failure by @hansonchar in Replace CKR_GENERAL_ERROR with CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE upon decryption failure #690
Add -D_FILE_OFFSET_BITS=64 by @LawrenceHunter in Add -D_FILE_OFFSET_BITS=64 #799
No memory allocation for each C_DecryptUpdate. by @larssilven in No memory allocation for each C_DecryptUpdate. #643
Replace deprecated Github runner ubuntu-20.04 by @bjosv in Replace deprecated Github runner ubuntu-20.04 #802
Update tests to use OpenSSL legacy provider if OpenSSL 3.0 used by @bukka in Update tests to use OpenSSL legacy provider if OpenSSL 3.0 used #806
Implement CKM_RSA_AES_KEY_WRAP mechanism for key wrap/unwrap by @ruiliio in Implement CKM_RSA_AES_KEY_WRAP mechanism for key wrap/unwrap #794
Support for ECDSA with hashing by @MatthiasValvekens in Support for ECDSA with hashing #683
Use CPPUNIT_ASSERT_EQUAL instead of CPPUNIT_ASSERT by @bukka in Use CPPUNIT_ASSERT_EQUAL instead of CPPUNIT_ASSERT #807
Fix ECC OpenSSL cmake check on Windows by @bukka in Fix ECC OpenSSL cmake check on Windows #828
Allow OBJECT_OP_UNWRAP to modify attributes by @antoinelochet in Allow OBJECT_OP_UNWRAP to modify attributes #728
Update pkcs.h to 3.2.0 version and fix CK_RSA_AES_KEY_WRAP_PARAMS by @bukka in Update pkcs.h to 3.2.0 version and fix CK_RSA_AES_KEY_WRAP_PARAMS #827
Fix C_GetMechanismInfo to fail on non-allowed mechanisms by @Jakuje in Fix C_GetMechanismInfo to fail on non-allowed mechanisms #648
Change CI branches as new default branch is main by @bukka in Change CI branches as new default branch is main #830
Fixed PKCS#11 3.2 C_Decapsulate definition by @antoinelochet in Fixed PKCS#11 3.2 C_Decapsulate definition #831
Support RSA PSS for import in softhsm2-util by @bukka in Support RSA PSS for import in softhsm2-util #816
Check RSA-OAEP mechanims when decrypting by @Jakuje in Check RSA-OAEP mechanims when decrypting #671
Fix incorrect call to isMechanismPermitted by @bukka in Fix incorrect call to isMechanismPermitted #835
Prepare for release 2.7.0 by @bukka in Prepare for release 2.7.0 #836
Update NEWS for 2.7.0 release by @bukka in Update NEWS for 2.7.0 release #840

New Contributors

@nomis made their first contribution in Add "objectstore.umask" configuration option for file/directory creation #566
@realmfoo made their first contribution in Add misc derivations #571
@keldonin made their first contribution in implement wrapping and unwrapping of Edwards curve-based private keys #594
@rgerganov made their first contribution in Fix CMake build by adding DEFAULT_UMASK #617
@ondergormez made their first contribution in Fix "Transaction in database is already active." bug #646
@saper made their first contribution in AES GCM without additional authenticated data crashes SoftHSM #664
@dcoombs made their first contribution in Fix memory leak in SoftHSM::UnwrapKeySym. #677
@sarroutbi made their first contribution in Minor README.md fixes #744
@bjosv made their first contribution in Add GitHub Actions CI #733
@middagj made their first contribution in fix: Use CMAKE_SHARED_LIBRARY_SUFFIX instead of hardcode .so #762
@wiktor-k made their first contribution in Fix a typo in Mecahnisms #760
@ijsf made their first contribution in Fixes AES secret key import failing on newline characters #747
@oej made their first contribution in README: Minor update #774
@bukka made their first contribution in Add configure option and code to disable OpenSSL engines #781
@hansonchar made their first contribution in Replace CKR_GENERAL_ERROR with CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE upon decryption failure #690
@LawrenceHunter made their first contribution in Add -D_FILE_OFFSET_BITS=64 #799
@ruiliio made their first contribution in Implement CKM_RSA_AES_KEY_WRAP mechanism for key wrap/unwrap #794
@MatthiasValvekens made their first contribution in Support for ECDSA with hashing #683
@antoinelochet made their first contribution in Allow OBJECT_OP_UNWRAP to modify attributes #728

Full Changelog: 2.6.1...2.7.0

This discussion was created from the release 2.7.0.

Replies: 0 comments

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment