Introduce backend-agnostic provider configuration and provider manager factory by ChansAlive · Pull Request #92 · eclipse-score/inc_security_crypto

ChansAlive · 2026-07-17T14:37:34Z

This PR decouples the crypto daemon's provider layer from any specific cryptographic backend.

Previously, daemon manually wired OpenSSL and SoftHSM factories step by step, provider names were hardcoded, and a single factory failure aborted the entire startup. There was no stable seam between which backends are compiled in and how providers are registered and routed at runtime.

Key changes:

Introduced a backend abstraction layer (score/crypto/src/backend/) that contains all backend-specific knowledge — how to construct an OpenSSL provider, what default SoftHSM token entries look like, which backends are compiled in. The provider framework itself no longer imports any backend headers.
Introduced ProviderManagerFactory that replaces the multi-step factory wiring in daemon.cpp with a single Create(config) call, owning the full sequencing: parse config → create factories for enabled backends → register providers → initialize routing tables.
Made provider startup resilient: factory results now carry per-provider failure details instead of a single bool, so a single unavailable token no longer blocks all other providers from registering.
Added documentation for the backend configuration model and updated the component overview and provider architecture diagrams.

Out of scope:
Test reuse across providers.

Build impact:
Backends selected via compile-time flags; existing OpenSSL and SoftHSM defaults are preserved.

closes #94

github-actions · 2026-07-17T14:38:37Z

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: 24c8c07f-7b5d-4620-abe3-cb228871cd62
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 18.033s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

github-actions · 2026-07-17T15:00:51Z

The created documentation from the pull request is available at: docu-html

schreibwsag · 2026-07-20T14:58:36Z

I just checked whether I could integrate the NXP pkcs11-hse module using the mechanism
you implemented (backend_config.bzl/backend_exports.bzl). All was working as described.

ShoroukRamzy · 2026-07-22T10:58:30Z

Hi @ChansAlive, Thank you for the great PR. I would like to revisit the decision we took today with @sunildevda and @schreibwsag regarding the merge of Cryptoki PR first https://github.com/eclipse-score/inc_security_crypto/pull/49/changes#diff-d1c061eac386f8ea2f48819d2f3a6ba46b3d17d9ac16176816beaf2fbea1c681. Sorry for the confusion, in the meeting I was thinking this is a proposal PR for the architecture improvement not a ready implementation. In this case, I think merging this PR first then adapting cryptoki PR accordingly will be more convenient and will allow me to handle the cryptoki integration the correct way based on this current implementation. So those will be two steps. otherwise, I think this PR will need to handle the cryptoki integration as well to resolve some expected conflicts. What do you think @ChansAlive, @sunildevda and @schreibwsag?
Thanks!

ChansAlive · 2026-08-04T09:07:30Z

Integration of AFALG provider completed. As both use chases I checked (new pkcs11 backend and new score_provider) are working, the PR could be merged from my point of view.

@schreibwsag @ShoroukRamzy ,

Based on the review comments, I have modified the way to configure the backend providers.
More details on adding the provider is present in Readme. https://github.com/eclipse-score/inc_security_crypto/pull/92/changes#diff-b9bd4fabe749201c9f08d2150104206de4c59b3a556fb20be84b3855294bbb93

OliverHeilwagen

Review result.
Following topics are expected to be solved in follow up PRs:

#143
#144

OliverHeilwagen · 2026-08-04T10:42:43Z

+)
+
+bool_flag(
+    name = "score_crypto_openssl_enabled",


Suggested change

name = "score_crypto_openssl_enabled",

name = "score_crypto_score_openssl_enabled",

Please also updates description and readme accordingly

OliverHeilwagen · 2026-08-04T10:43:17Z

+)
+
+bool_flag(
+    name = "score_crypto_primula_enabled",


Suggested change

name = "score_crypto_primula_enabled",

name = "score_crypto_score_primula_enabled",

Please also updates description and readme accordingly

OliverHeilwagen · 2026-08-04T10:50:29Z

+
+## Score Provider Sub-Backends
+
+Score provider sub-backends live under `score_provider/<backend>/`. Each follows


Suggested change

Score provider sub-backends live under `score_provider/<backend>/`. Each follows

Score provider sub-backends live under `score/crypto/src/daemon/provider/score_provider/<backend>/`. Each follows

I understand the confusion here. I will try to rephrase here with absolute paths.
I have created a section to explain the two folder view of the provider families and what each exists for. The folder mentioned here is infact backend package folder

OliverHeilwagen · 2026-08-04T10:52:47Z

+
+## Adding a New Score Provider Backend
+
+1. Implement the provider under `score_provider/<backend>/`.


Please provide full path to score_provider as above.

Same as the comment for above

OliverHeilwagen · 2026-08-04T13:06:23Z

-            +Shutdown() : Result<void>
+            +Initialize(context : ProviderInitContext) : bool
+            +Shutdown() : void
+            +IsInitialized() : bool


It is expected that this method is not necessary (Initialize -> false -> provider is not initialized -> daemon terminates)

OliverHeilwagen · 2026-08-04T13:07:37Z


        interface provider::IProviderFactory {
-            +CreateAndRegister(manager) : bool
+            +CreateAndRegister(manager : ProviderManager&) : ProviderFactoryResult


Please change to Expected<void, error>

OliverHeilwagen · 2026-08-04T13:08:44Z

-            +RegisterFactory(factory)
            +Initialize() : bool
            +RegisterProvider(name, provider, type) : bool
+            +IsProviderRegistered(name) : bool


Should not be required (RegisterProvider -> false -> Provider could not be registered -> daemon terminates)

OliverHeilwagen · 2026-08-04T13:10:47Z

 title __Architecture overview__

 set namespaceSeparator ::
+top to bottom direction


plantuml preview in devconatiner does not longer work please check the file for errors.
May also be deffered to eclipse-score/inc_security_crypto#140

OliverHeilwagen · 2026-08-04T13:18:55Z

+               └── BuildTypeMappings(ProviderInitConfig.typeToProviderName)
+                 resolve registered names → runtime ProviderId
+
+On a later request, ``ProviderManager::GetProvider(...)`` checks


We should not allow a further defferred initialization. If the provider_manager->Initialize() fails the daemon should terminate and not try a deffered initialization on user application demand.

schreibwsag · 2026-08-04T14:19:53Z

I could integrate my pkcs11_dynload backend and my afalg provider using the new config method.
Only one cosmetic remark (active_backends_list.hpp)

// Include enabled backend adapters (controlled by BUILD file defines)
#ifdef SCORE_BACKEND_OPENSSL_ENABLED
#include "score/crypto/src/backend/score_provider/openssl/openssl_backend_adapter.hpp"
#endif

#ifdef SCORE_BACKEND_PRIMULA_ENABLED
#include "score/crypto/src/backend/primula/primula_backend_adapter.hpp"
#endif

For Primula it should also be:
#include "score/crypto/src/backend/score_provider/primula/primula_backend_adapter.hpp"

ChansAlive requested a deployment to workflow-approval July 17, 2026 14:37 — with GitHub Actions Waiting

ChansAlive force-pushed the backend_integration branch from 7ed0b22 to 3a2f4ac Compare July 17, 2026 14:39

ChansAlive requested a deployment to workflow-approval July 17, 2026 14:39 — with GitHub Actions Waiting

ChansAlive requested review from OliverHeilwagen and sunildevda July 17, 2026 14:41

ChansAlive requested a deployment to workflow-approval July 17, 2026 14:46 — with GitHub Actions Waiting

ChansAlive force-pushed the backend_integration branch from f04bdec to b45fefe Compare July 17, 2026 14:58

ChansAlive requested a deployment to workflow-approval July 17, 2026 14:58 — with GitHub Actions Waiting

ChansAlive mentioned this pull request Jul 20, 2026

Cryptoki etas integration #49

Open

ChansAlive force-pushed the backend_integration branch from b45fefe to 24d32c3 Compare July 20, 2026 14:40

ChansAlive requested a deployment to workflow-approval July 20, 2026 14:40 — with GitHub Actions Waiting

ChansAlive force-pushed the backend_integration branch from 24d32c3 to ec72296 Compare July 21, 2026 07:36

ChansAlive requested a deployment to workflow-approval July 21, 2026 07:36 — with GitHub Actions Waiting

anmittag added this to SEC - Security FT Jul 21, 2026

github-project-automation Bot moved this to Backlog in SEC - Security FT Jul 21, 2026

anmittag assigned ChansAlive Jul 21, 2026

ChansAlive requested a deployment to workflow-approval July 22, 2026 14:14 — with GitHub Actions Waiting

ChansAlive force-pushed the backend_integration branch from a0cd28f to e87c58d Compare July 28, 2026 13:27

ChansAlive requested a deployment to workflow-approval July 28, 2026 13:27 — with GitHub Actions Waiting

ChansAlive added 10 commits August 3, 2026 14:26

Test for backend config

c80f674

Fix format and copyrights

8cf14c0

Fix doc build

c35cdce

Minor doc and Readme fix

0eb66a8

Route Pkcs11 API calls via functionlist

ff62355

Minor code quality fix

7278083

Minor fix after rebase

93ace6e

Update component overview

72f9406

Review Fix: Simplify pvdr factory cfg

43eb77a

Review Fix: Refactor Pvdr factory and mgr

ca1c914

ChansAlive force-pushed the backend_integration branch from 0eae5bd to ca1c914 Compare August 3, 2026 12:26

ChansAlive requested a deployment to workflow-approval August 3, 2026 12:26 — with GitHub Actions Waiting

ChansAlive added 2 commits August 3, 2026 15:22

Review Fix: Target rename and doc fix

994ad05

Review Fix: Moveand fix provider test

52be87c

ChansAlive requested a deployment to workflow-approval August 3, 2026 13:43 — with GitHub Actions Waiting

Review Fix: Add config flag

956f728

ChansAlive requested a deployment to workflow-approval August 3, 2026 20:58 — with GitHub Actions Waiting

ChansAlive added 2 commits August 4, 2026 09:39

Review Fix: Reduce clang tidy warning

9aa2a0d

Reverted the warning removal

6fe6f6b

ChansAlive deployed to workflow-approval August 4, 2026 07:53 — with GitHub Actions Active

ChansAlive temporarily deployed to workflow-approval August 4, 2026 07:53 — with GitHub Actions Inactive

Moved the provider manager ut near src

5097de8

ChansAlive requested a deployment to workflow-approval August 4, 2026 10:22 — with GitHub Actions Waiting

OliverHeilwagen suggested changes Aug 4, 2026

View reviewed changes

	name = "score_crypto_openssl_enabled",
	name = "score_crypto_score_openssl_enabled",

	name = "score_crypto_primula_enabled",
	name = "score_crypto_score_primula_enabled",


		## Score Provider Sub-Backends

		Score provider sub-backends live under `score_provider/<backend>/`. Each follows


		## Adding a New Score Provider Backend

		1. Implement the provider under `score_provider/<backend>/`.

Uh oh!

Conversation

ChansAlive commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

License Check Results

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

schreibwsag commented Jul 20, 2026

Uh oh!

ShoroukRamzy commented Jul 22, 2026

Uh oh!

ChansAlive commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

OliverHeilwagen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ChansAlive Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

schreibwsag commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ChansAlive commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading

ChansAlive commented Aug 4, 2026 •

edited

Loading

ChansAlive Aug 4, 2026 •

edited

Loading