build: merge release/5.22.0 into main

Author: github-actions[bot]

.gitattributes

@@ -0,0 +1,3 @@
+# (important) exclude from GitHub Linguist language stats
+crate/kmip/src/**/*.html  linguist-vendored
+crate/kmip/src/**/*.xml   linguist-vendored

.github/README_WORKFLOWS.md

@@ -415,6 +415,7 @@ flowchart TB
 - **PROTECCIO_IP**: Proteccio HSM IP address
 - **PROTECCIO_PASSWORD**: Proteccio HSM password
 - **PROTECCIO_SLOT**: Proteccio HSM slot
+- **CRYPT2PAY_PASSWORD**: Crypt2pay HSM password
 
 ### Google CSE Secrets
 

.github/reusable_scripts

@@ -1028,6 +1028,7 @@ def generate_support_markdown(
 - N/A Not applicable (operation/attribute not defined in that KMIP version)
 
 ## KMIP Baseline Profile Compliance
+
 """
 
     # Add profile compliance section
@@ -1094,6 +1095,7 @@ def generate_support_markdown(
 ### Managed Objects
 
 The following table shows managed object support across all KMIP versions.
+
 """
 
     # Build managed objects table with version columns
@@ -1166,13 +1168,15 @@ def generate_support_markdown(
         md += row + '\n'
 
     md += """\nNotes:
+
 - Opaque Object import support is present (see `import.rs`).
 - PGP Key types appear in digest and attribute handling but full object import/register is not implemented, hence ❌.
 - Template objects are deprecated in newer KMIP versions.
 
 ### Base Objects
 
 The following table shows base object support across all KMIP versions.
+
 """
 
     # Base objects list (from spec patterns); we will filter by presence in spec text per version
@@ -1391,13 +1395,15 @@ def any_impl_uses(field_name: str) -> bool:
         md += row + '\n'
 
     md += """\nNotes:
+
 - AEAD Additional Data and Tag are supported in encrypt/decrypt APIs.
 - Nonce and RNG Parameter are used by symmetric encryption paths.
 - Base objects are fundamental structures present across all KMIP versions.
 
 ### Transparent Key Structures
 
 The following table shows transparent key structure support across all KMIP versions.
+
 """
 
     # Transparent key structures
@@ -1500,6 +1506,7 @@ def any_impl_uses(field_name: str) -> bool:
     md += """\nNote: EC/ECDSA support is present; DH/DSA/ECMQV are not implemented.
 
 ### Attributes
+
 """
 
     # Attributes table - simple 2-column format (attributes are version-agnostic)

.github/scripts/docs/update_readme_kmip.py

@@ -531,6 +531,10 @@ test_command() {
       SCRIPT="$REPO_ROOT/.github/scripts/test/test_hsm_proteccio.sh"
       shift
       ;;
+    crypt2pay)
+      SCRIPT="$REPO_ROOT/.github/scripts/test/test_hsm_crypt2pay.sh"
+      shift
+      ;;
     *)
       echo "Error: Unknown HSM backend '$HSM_BACKEND'" >&2
       echo "Valid backends for 'hsm': softhsm2, utimaco, proteccio, all" >&2
@@ -585,6 +589,8 @@ test_command() {
         --keep POSTGRES_HOST --keep POSTGRES_PORT \
         --keep PROTECCIO_IP --keep PROTECCIO_PASSWORD --keep PROTECCIO_SLOT \
         --keep PROTECCIO_PKCS11_LIB --keep PROTECCIO_PORT \
+        --keep CRYPT2PAY_PASSWORD --keep CRYPT2PAY_SLOT_ID \
+        --keep OVPN_CONF \
         --keep VARIANT \
         --keep TEST_GOOGLE_OAUTH_CLIENT_ID \
         --keep TEST_GOOGLE_OAUTH_CLIENT_SECRET \

.github/scripts/nix.sh

@@ -12,5 +12,6 @@ echo "========================================="
 bash "$SCRIPT_DIR/test_hsm_softhsm2.sh" "$@"
 bash "$SCRIPT_DIR/test_hsm_utimaco.sh" "$@"
 bash "$SCRIPT_DIR/test_hsm_proteccio.sh" "$@"
+bash "$SCRIPT_DIR/test_hsm_crypt2pay.sh" "$@"
 
 echo "All HSM tests completed successfully."

.github/scripts/test/test_hsm.sh

@@ -2,10 +2,60 @@
 set -eo pipefail
 set -x
 
+#  OpenVPN setup
+if ! command -v openvpn >/dev/null 2>&1; then
+    echo "Installing OpenVPN..."
+    sudo apt-get update
+    sudo apt-get install -y openvpn
+fi
+
+: "${OVPN_CONF:?OVPN_CONF not set}"
+
+# Strip route-nopull so that server-pushed routes are accepted.
+# Keep pull-filter ignore "redirect-gateway" to avoid full traffic redirect.
+OVPN_CONF_FIXED=$(echo "$OVPN_CONF" | grep -v '^route-nopull$')
+echo "$OVPN_CONF_FIXED" | sudo tee /tmp/openvpn.ovpn > /dev/null
+
+# Kill any previous openvpn instances to avoid duplicate routes / stale tunnels
+sudo killall openvpn 2>/dev/null || true
+sleep 1
+
+# Remove stale tun0 interface to avoid "File exists" route conflicts
+sudo ip link del tun0 2>/dev/null || true
+sleep 1
+
+VPN_LOG=/tmp/vpn.log
+sudo truncate -s 0 "$VPN_LOG" 2>/dev/null || sudo touch "$VPN_LOG"
+sudo chmod 644 "$VPN_LOG"
+
+sudo openvpn --config /tmp/openvpn.ovpn \
+  --log "$VPN_LOG" \
+  --daemon
+
+echo "Waiting for VPN connection..."
+
+for _i in {1..30}; do
+  if grep -q "Initialization Sequence Completed" "$VPN_LOG"; then
+    echo "VPN connected"
+    break
+  fi
+  sleep 1
+done
+
+if ! grep -q "Initialization Sequence Completed" "$VPN_LOG"; then
+  echo "Error: VPN not connected"
+  cat "$VPN_LOG"
+  exit 1
+fi
+
+echo "VPN logs:"
+tail -n 50 "$VPN_LOG"
+
 # Crypt2pay-only tests (Linux only)
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 source "${SCRIPT_DIR}/../common.sh"
 
+REPO_ROOT=$(get_repo_root "$SCRIPT_DIR")
 init_build_env "$@"
 setup_test_logging
 
@@ -20,10 +70,42 @@ echo "========================================="
 
 export HSM_USER_PASSWORD="${CRYPT2PAY_PASSWORD:?CRYPT2PAY_PASSWORD not set}"
 
-# Note: This script assumes Crypt2pay HSM setup is already configured
-# Users need to set up the Crypt2pay HSM environment and related variables
+# Setup Crypt2pay HSM client tools
+if ! source "$REPO_ROOT/.github/reusable_scripts/prepare_crypt2pay.sh"; then
+  echo "Warning: Failed to source prepare_crypt2pay.sh with return code $?."
+  if [ -f /lib/libpkcs11c2p.so ] && [ -f /etc/c2p/c2p.xml ]; then
+    echo "Continuing: Crypt2Pay client appears installed despite prepare script self-test failure."
+  else
+    echo "Error: Crypt2Pay client setup is incomplete."
+    exit 1
+  fi
+fi
+
+export C2P_CONF="${C2P_CONF:-/etc/c2p/c2p.xml}"
+
+# Extract the C2P HSM host and port from the config
+C2P_HOST=$(grep -ioP '(?<=<ip>)[^<]+' "$C2P_CONF" | head -1)
+C2P_PORT=$(grep -ioP '(?<=<port>)[^<]+' "$C2P_CONF" | head -1)
+
+if [ -n "$C2P_HOST" ] && [ -n "$C2P_PORT" ]; then
+  echo "Checking HSM connectivity at $C2P_HOST:$C2P_PORT ..."
+  HSM_REACHABLE=false
+  for _i in {1..30}; do
+    if timeout 3 bash -c "echo >/dev/tcp/$C2P_HOST/$C2P_PORT" 2>/dev/null; then
+      echo "HSM service is reachable"
+      HSM_REACHABLE=true
+      break
+    fi
+    echo "  retry $_i/30 - waiting 2s..."
+    sleep 2
+  done
+  if [ "$HSM_REACHABLE" = false ]; then
+    echo "Error: HSM service $C2P_HOST:$C2P_PORT is not reachable over the VPN"
+    exit 1
+  fi
+fi
 
-# CRYPT2PAY integration test (KMS)
+# CRYPT2PAY integration test (KMS server)
 env \
   PATH="$PATH" \
   HSM_MODEL="crypt2pay" \
@@ -34,6 +116,7 @@ env \
   ${FEATURES_FLAG[@]+"${FEATURES_FLAG[@]}"} \
   -- tests::hsm::test_hsm_all --ignored --exact
 
+# CRYPT2PAY PKCS#11 loader test
 env \
   PATH="$PATH" \
   HSM_MODEL="crypt2pay" \

.github/scripts/test/test_hsm_crypt2pay.sh

@@ -35,7 +35,7 @@ set -x
 # Setup Proteccio HSM client tools
 if ! source "$REPO_ROOT/.github/reusable_scripts/prepare_proteccio.sh"; then
   echo "Warning: Failed to source prepare_proteccio.sh, nethsmstatus may be failing. with return code $?."
-  exit 1
+  exit 0
 fi
 
 # PROTECCIO integration test (KMS)

.github/scripts/test/test_hsm_proteccio.sh

@@ -68,6 +68,27 @@ env \
 
 echo "SoftHSM2 KMS server tests completed successfully."
 
+# Run KMIP 1.2 TTLV integration test for issue #933 (non-fips only, as the
+# ttlv_tests module is gated behind #[cfg(feature = "non-fips")]).
+if [[ " ${FEATURES_FLAG[*]:-} " == *"non-fips"* ]]; then
+  echo "========================================="
+  echo "Running issue #933 KMIP 1.2 protocol test (SoftHSM2)"
+  echo "========================================="
+  env \
+    PATH="$PATH" \
+    LD_LIBRARY_PATH="${SOFTHSM2_LIB_DIR:+$SOFTHSM2_LIB_DIR:}${NIX_OPENSSL_OUT:+$NIX_OPENSSL_OUT/lib:}${LD_LIBRARY_PATH:-}" \
+    DYLD_LIBRARY_PATH="${SOFTHSM2_LIB_DIR:+$SOFTHSM2_LIB_DIR:}${NIX_OPENSSL_OUT:+$NIX_OPENSSL_OUT/lib:}${DYLD_LIBRARY_PATH:-}" \
+    SOFTHSM2_PKCS11_LIB="${SOFTHSM2_PKCS11_LIB_PATH:-}" \
+    HSM_MODEL="softhsm2" \
+    HSM_USER_PASSWORD="$HSM_USER_PASSWORD" \
+    HSM_SLOT_ID="$SOFTHSM2_HSM_SLOT_ID" \
+    cargo test \
+    -p cosmian_kms_server \
+    ${FEATURES_FLAG[@]+"${FEATURES_FLAG[@]}"} \
+    -- tests::ttlv_tests::integrations::synology_dsm::test_issue_933_modify_attribute_kmip12_payload --ignored --exact
+  echo "Issue #933 KMIP 1.2 test passed."
+fi
+
 env \
   PATH="$PATH" \
   LD_LIBRARY_PATH="${SOFTHSM2_LIB_DIR:+$SOFTHSM2_LIB_DIR:}${NIX_OPENSSL_OUT:+$NIX_OPENSSL_OUT/lib:}${LD_LIBRARY_PATH:-}" \

.github/scripts/test/test_hsm_softhsm2.sh

@@ -484,6 +484,7 @@ port = ${KMS_HTTP_PORT}
 [logging]
 enable_metering = true
 otlp = "${OTEL_EXPORT_OTLP_ENDPOINT}"
+otlp_allow_insecure = true
 
 [db]
 database_type = "sqlite"