Changelog

Copy Markdown View Source

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.5.0] - 2026-08-08

Added

  • p11ex: Add support for CKF_OS_LOCKING_OK flag during module initialization to allow PKCS#11 library to use OS-level locking mechanisms for improved thread safety
  • p11ex: Add P11ex.Token, representing a single PKCS#11 token in a single slot. It owns login state and session bookkeeping for that slot, and keeps an internal control session open once logged in so further sessions opened for the token don't need to log in themselves.

Changed

  • p11ex: start P11ex.Session with genserver ref to module
  • p11ex: run all NIFs on dirty I/O scheduler to prevent blocking normal schedulers during HSM operations
  • p11ex: Breaking. Login and session-open/close state moved from P11ex.Module to the new P11ex.Token. open_session/3, close_session/2, register_login/2, and login_type/1 are removed from P11ex.Module; P11ex.Session.start_link/1 now takes token: (a running P11ex.Token) instead of module: + slot_id:. Login state was previously tracked per loaded library, so a second token sharing the same P11ex.Module could have its real C_Login silently skipped once the first token had logged in, leaving it authenticated in p11ex's bookkeeping but not on the actual PKCS#11 token; login is now tracked per token, so tokens sharing one module authenticate independently.
  • p11ex_cli: bench-aes-encrypt-block's session pool now shares the P11ex.Token obtained through its initial session instead of opening its own module:/slot_id: pair, and no longer logs in per pool worker (login is already token-wide).

Fixed

  • p11ex: fix trap exit for module genserver to finalize
  • p11ex: fix trap exit for session genserver to close underlying PKCS#11 session and keep track of open session count
  • packaging: include some missing files in hex package
  • p11ex: fix warnings about parentheses to fetch map field
  • p11ex: fix cannot login again after session logout

[0.4.1] - 2026-07-09

Fixed

  • packaging: Download PKCS#11 header files as part of Makefile.
  • packaging: Include Makefile in Hex package files.

[0.4.0] - 2026-06-12

Added

  • p11ex: Add function P11ex.Session.session_handle/1 to get session handle for a P11ex.Session server.
  • p11ex: Add support for EdDSA key generation and signing (Ed25519, Ed448).
  • p11ex: Add P11ex.Session.generate_key_pair/5 with explicit timeout parameter.
  • p11ex_cli: Log error messages and warnings to stderr.
  • p11ex_cli: Add command export-pubk to export public keys.
  • p11ex_cli: Add command sign to sign data with RSA, EC, or EdDSA algorithms.
  • p11ex_cli: Support exporting EdDSA public keys via export-pubk command.

Changed

  • p11ex_cli: Improve documentation for ECDSA and EdDSA signatures.
  • ci: Migrate from GitHub to Codeberg, adapt release workflow accordingly.
  • ci: Restrict Renovate to run Tue, Thu, and Sat at 02:00 UTC.

Fixed

  • p11ex_cli: Correct invalid Erlang version strings in CI workflow.
  • ci: Fix version calculation in build process.
  • ci: Fix trailing whitespace in workflow files.

[0.3.1] - 2025-10-27

Added

  • p11ex_cli: Add sub command bench-aes-encrypt-block.
  • p11ex_cli: Also read token label from environment variable P11EX_TOKEN_LABEL.

Fixed

  • p11ex: Make search for slot by label more robust.
  • p11ex_cli: Fix error message if AES key generation is not supported.
  • p11ex_cli: Fix error messages in case slot can't be found.
  • p11ex_cli: Read attributes carefully, increase compatibility.

[0.3.0] - 2025-10-25

Added

  • Add key-wrap and key-unwrap commands to p11ex_cli.
  • Add kcv-gen command to p11ex_cli to compute the fingerprint of secret keys .