PKCS #11 modules can be packaged into JAR files that support automatic +installation onto the filesystem and into the security module database. +The JAR file should contain: +
If the +JAR file is to be run by a server, modutil, or any other program that +doesn't interpret Javascript, a special information file must be included +in the format described in this document. + +
Pkcs11_install_script. Meta-information is put in the manifest
+file by putting it in a file which is passed to
+Signtool. For example,
+suppose the PKCS #11 installer script is in the file pk11install.
+In Signtool's metainfo file, you would have a line like this:
++ +++ Pkcs11_install_script: pk11install +
+ForwardCompatible { IRIX:6.2:mips Solaris:5.5.1:sparc }
+Platforms {
+ WINNT::x86 {
+ ModuleName { "Fortezza Module" }
+ ModuleFile { win32/fort32.dll }
+ DefaultMechanismFlags{0x0001}
+ DefaultCipherFlags{0x0001}
+ Files {
+ win32/setup.exe {
+ Executable
+ RelativePath { %temp%/setup.exe }
+ }
+ win32/setup.hlp {
+ RelativePath { %temp%/setup.hlp }
+ }
+ win32/setup.cab {
+ RelativePath { %temp%/setup.cab }
+ }
+ }
+ }
+ WIN95::x86 {
+ EquivalentPlatform {WINNT::x86}
+ }
+ Solaris:5.5.1:sparc {
+ ModuleName { "Fortezza UNIX Module" }
+ ModuleFile { unix/fort.so }
+ DefaultMechanismFlags{0x0001}
+ CipherEnableFlags{0x0001}
+ Files {
+ unix/fort.so {
+ RelativePath{%root%/lib/fort.so}
+ AbsolutePath{/usr/local/netscape/lib/fort.so}
+ FilePermissions{555}
+ }
+ xplat/instr.html {
+ RelativePath{%root%/docs/inst.html}
+ AbsolutePath{/usr/local/netscape/docs/inst.html}
+ FilePermissions{555}
+ }
+ }
+ }
+ IRIX:6.2:mips {
+ EquivalentPlatform { Solaris:5.5.1:sparc }
+ }
+}
+
+--> valuelist
+
+valuelist --> value valuelist
+ <null>
+
+value --> key_value_pair
+ string
+
+key_value_pair --> key { valuelist }
+
+key --> string
+
+string --> simple_string
+ "complex_string"
+
+simple_string --> [^ \t\n\""{""}"]+ (no whitespace, quotes, or braces)
+
+complex_string --> ([^\"\\\r\n]|(\\\")|(\\\\))+ (quotes and backslashes must be escaped with a backslash, no newlines or carriage returns are allowed in the string)
+ForwardCompatible
+Platforms (required)
+
+
+- AIX (rs6000)
+
- BSDI (x86)
+
- FREEBSD (x86)
+
- HPUX (hppa1.1)
+
- IRIX (mips)
+
- LINUX (ppc, alpha, x86)
+
- MacOS (PowerPC)
(Note: NSPR actually defines the OS as
+"Mac OS". The
+space makes the name unsuitable for being embedded in identifiers. Until
+NSPR changes, you will have to add some special code to deal with this case.
+)
+- NCR (x86)
+
- NEC (mips)
+
- OS2 (x86)
+
- OSF (alpha)
+
- ReliantUNIX (mips)
+
- SCO (x86)
+
- SOLARIS (sparc)
+
- SONY (mips)
+
- SUNOS (sparc)
+
- UnixWare (x86)
+
- WIN95 (x86)
+
- WINNT (x86)
+
+
+Examples of valid platform strings: IRIX:6.2:mips, Solaris:5.5.1:sparc,
+Linux:2.0.32:x86, WIN95::x86.
+Platforms list.
+ModuleName (required)
+ModuleFile (required)
+Files (required)
+DefaultMechanismFlags
+DefaultMechanismFlags
+entry is omitted, the value will default to 0x0.
+++RSA: 0x0000 0001 +DSA: 0x0000 0002 +RC2: 0x0000 0004 +RC4: 0x0000 0008 +DES: 0x0000 0010 +DH: 0x0000 0020 +FORTEZZA: 0x0000 0040 +RC5: 0x0000 0080 +SHA1: 0x0000 0100 +MD5: 0x0000 0200 +MD2: 0x0000 0400 +RANDOM: 0x0800 0000 +FRIENDLY: 0x1000 0000 +OWN_PW_DEFAULTS: 0x2000 0000 +DISABLE: 0x4000 0000 +
CipherEnableFlags
+CipherEnableFlags entry is omitted, the
+value will default to 0x0.
+++FORTEZZA: 0x0000 0001 +
EquivalentPlatform
+Files list. At least one of RelativePath and
+AbsolutePath must be specified. If both are specified, the
+relative path will be tried first and the absolute path used only if no
+relative root directory is provided by the installer program.
+RelativePath
+setup.exe installation program, a help file, and a .cab file
+containing compressed information. All these files could be installed into the
+temporary directory. Files destined for the temporary directory are guaranteed
+to be in place before any executable file is run, and will not be deleted
+until all executable files have finished.
+AbsoluteDir
+Executable
+setup.exe.
+More than one file can be specified as executable, in which case they will
+be run in the order they are specified in the script file.
+FilePermissions
++Some platforms may not understand these permissions. They will only be +applied insofar as makes sense for the current platform. If this attribute +is omitted, a default of 777 is assumed. + + ++user read: 400 +user write: 200 +user execute: 100 +group read: 040 +group write: 020 +group execute: 010 +other read: 004 +other write: 002 +other execute: 001 +