trust pem file misparsed about p11-kit HOT 4 CLOSED

I would say this is an expected behavior. The trust module recognizes the file format in the following order: the p11-kit persistent file format, DER, and PEM. So if it found the marker ([p11-kit-object-v1]), it treats the entire file as a p11-kit persistent file.

Re warning message: it was turned off by f992eb6. You can still see it when you set P11_KIT_DEBUG=all. We can certainly make trust list more verbose, but it's not trivial because the message comes from the trust module.

from p11-kit.

ueno commented

I would say this is an expected behavior. The trust module recognizes the file format in the following order: the p11-kit persistent file format, DER, and PEM. So if it found the marker ([p11-kit-object-v1]), it treats the entire file as a p11-kit persistent file.

Afaict this behavior does not match the documentation:

Files in the following formats are supported for loading by the trust policy module:

• X.509 certificates | X.509 certificates in raw DER format. [...]
• PEM certificates | X.509 certificates in PEM format. These have a BEGIN CERTIFICATE header. [...]
• OpenSSL trust certificates | OpenSSL specific certificates in PEM format that contain trust information. These have a BEGIN TRUSTED CERTIFICATE PEM header. [...]

from p11-kit.

I know. I meant that it could be only fixed by updating the documentation.

from p11-kit.

After a second thought, it is actually possible to fall back to PEM blobs if the file is not parsable as p11-kit persistent format. I have updated the linked PR to cover this.

from p11-kit.