Bug 1448555

Adding the details from the original bug, where we started discussing this issue:

Coolkey is picking up the label not from PKCS#15 structures, but from the CN of the certificate itself.

Browsing through the code, it is implemented in src/coolkey/object.cpp:2525

    /* if we didn't get a label, set one based on the CN */

This can be useful feature worth implementing in OpenSC, but it does not look like something that would be a blocker for RHEL7.4. If you consider this a test blocker/regression, please add a appropriate keyword and I will have a look at this, otherwise I would be for postponing it for 7.5.

Cross-reference the github pull request which should resolve the issue:
https://github.com/OpenSC/OpenSC/pull/1045

This has been fixed upstream so there is nothing blocking us from accepting this change in RHEL.

This is the difference I see between coolkey and opensc:

[root@dhcp129-107 ~]# p11tool --provider /usr/lib64/opensc-pkcs11.so --list-all
Object 0:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=4790%20Unknown;serial=9050377271970069;token=pkiuser1%20%28pkiuser1%29;id=%00;type=public
	Type: Public key
	Label: 
	Flags: CKA_WRAP/UNWRAP; 
	ID: 00

Object 1:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=4790%20Unknown;serial=9050377271970069;token=pkiuser1%20%28pkiuser1%29;id=%00;object=encryption%20key%20for%20pkiuser1;type=cert
	Type: X.509 Certificate
	Label: encryption key for pkiuser1
	ID: 00

[root@dhcp129-107 ~]# pkcs11-switch coolkey

WARNING: Performing this operation while the browser is running could cause
corruption of your security databases. If the browser is currently running,
you should exit browser before continuing this operation. Type 
'q <enter>' to abort, or <enter> to continue: 

Module "CoolKey PKCS #11 Module" added to database.
Module "OpenSC PKCS #11 Module" deleted from database.
[root@dhcp129-107 ~]# p11tool --provider /usr/lib64/pkcs11/libcoolkeypk11.so --list-all
Object 0:
	URL: pkcs11:model=50377271970069a5;manufacturer=4790;serial=970069a5;token=pkiuser1;id=%00;object=encryption%20key%20for%20pkiuser1;type=cert
	Type: X.509 Certificate
	Label: encryption key for pkiuser1
	ID: 00

Object 1:
	URL: pkcs11:model=50377271970069a5;manufacturer=4790;serial=970069a5;token=pkiuser1;id=%00;object=encryption%20key%20for%20pkiuser1;type=public
	Type: Public key
	Label: encryption key for pkiuser1
	Flags: CKA_WRAP/UNWRAP; 
	ID: 00

Object 2:
	URL: pkcs11:model=50377271970069a5;manufacturer=4790;serial=970069a5;token=pkiuser1;id=%00;object=encryption%20key%20for%20pkiuser1;type=private
	Type: Private key
	Label: encryption key for pkiuser1
	Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_SENSITIVE; 
	ID: 00

Sigh ... it looks like I mixed up the patches. This bug should get the patch from PR 1088 [1], which is clearly not in the tree. I will respin the package also with this change.

[1] https://github.com/OpenSC/OpenSC/pull/1088

This is finally also in the last build.

[root@dhcp129-107 ~]# rpm -qi opensc
Name        : opensc
Version     : 0.16.0
Release     : 8.20170227git777e2a3.el7
Architecture: x86_64
Install Date: Mon 08 Jan 2018 12:11:28 PM EST
Group       : System Environment/Libraries
Size        : 3260567
License     : LGPLv2+
Signature   : RSA/SHA256, Wed 03 Jan 2018 08:15:09 AM EST, Key ID 199e2f91fd431d51
Source RPM  : opensc-0.16.0-8.20170227git777e2a3.el7.src.rpm
Build Date  : Wed 03 Jan 2018 07:51:51 AM EST
Build Host  : x86-034.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : https://github.com/OpenSC/OpenSC/wiki
Summary     : Smart card library and applications

All the labels are listed as expected:

root@dhcp129-107 ~]# p11tool --provider /usr/lib64/opensc-pkcs11.so --list-all
Object 0:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=4090%20GemAlto%20%28Infineon%29;serial=90614575c1240e03;token=kdcuser2%20%28kdcuser2%29;id=%01;object=signing%20key%20for%20kdcuser2;type=public
	Type: Public key
	Label: signing key for kdcuser2
	ID: 01

Object 1:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=4090%20GemAlto%20%28Infineon%29;serial=90614575c1240e03;token=kdcuser2%20%28kdcuser2%29;id=%01;object=signing%20key%20for%20kdcuser2;type=cert
	Type: X.509 Certificate
	Label: signing key for kdcuser2
	ID: 01

Object 2:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=4090%20GemAlto%20%28Infineon%29;serial=90614575c1240e03;token=kdcuser2%20%28kdcuser2%29;id=%02;object=encryption%20key%20for%20kdcuser2;type=public
	Type: Public key
	Label: encryption key for kdcuser2
	Flags: CKA_WRAP/UNWRAP; 
	ID: 02

Object 3:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=4090%20GemAlto%20%28Infineon%29;serial=90614575c1240e03;token=kdcuser2%20%28kdcuser2%29;id=%02;object=encryption%20key%20for%20kdcuser2;type=cert
	Type: X.509 Certificate
	Label: encryption key for kdcuser2
	ID: 02

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0987