feat(engine): HSM lifecycle, logging, and provider-aligned OBK/MOBK by walterchris · Pull Request #532 · Azure/azihsm-sdk

walterchris · 2026-07-10T07:25:19Z

Adds the HSM lifecycle + logging layer to the OpenSSL 1.1.x engine, on top of the resiliency toolkit and azihsm_crypto's 1.1.x support.

engine/src/context.rs — EngineData (parked in ENGINE ex_data) owns a lazily-opened HsmContext (partition + session). HsmContext::open performs the full device bring-up, mirroring the 3.x provider:
- list partitions → open the first at its max API revision;
- partition.init with the plaintext OBK; on a warm device (Bk3AlreadyInitialized) retry with the caller-persisted MOBK, and persist the freshly-derived MOBK on cold init;
- POTA endorsement signed via azihsm_crypto (caller source) or delegated to the platform TPM (tpm source);
- open_session.
- Credentials + resiliency settings come from the environment; key material is zeroized.
engine/src/logging.rs — env-gated tracing_subscriber (stderr and/or file), installed at bind.
engine/src/lib.rs — registers the ex_data slot and parks an empty EngineData at bind. The open is lazy — nothing opens a session yet; the trigger arrives with key-loading / algorithm callbacks in a follow-up.

No behavior change for current users: openssl engine -t still only binds; it does not touch a device.

For manual testing with TPM:

export AZIHSM_CREDENTIALS_ID=<32 hex chars>
export AZIHSM_CREDENTIALS_PIN=<32 hex chars>
export AZIHSM_RESILIENCY_ENABLED=1
export AZIHSM_RESILIENCY_STORAGE_DIR=/run/azihsm/resiliency   # must be mode 0700
export AZIHSM_POTA_SOURCE=tpm
export AZIHSM_OBK_SOURCE=tpm

Copilot

Pull request overview

Adds a lazily-initialized HSM lifecycle layer and env-driven tracing for the OpenSSL 1.1.x engine, aligning OBK/MOBK + POTA flows with the provider while keeping openssl engine -t as bind-only.

Changes:

Introduces EngineData / HsmContext stored in ENGINE ex_data to support on-demand partition init + session open.
Adds env-gated tracing_subscriber setup for engine logging (stderr and/or file).
Wires engine bind to register/destroy ex_data and install logging; updates crate/workspace deps to support new functionality.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
plugins/ossl_engine/engine/src/logging.rs	Adds env-controlled tracing subscriber installation for stderr/file logging.
plugins/ossl_engine/engine/src/lib.rs	Registers cached ex_data slot, parks `EngineData`, installs logging at bind, and adds destroy handler.
plugins/ossl_engine/engine/src/context.rs	Implements lazy HSM open path (partition init + OBK/MOBK handling + POTA + session open) with mock-feature tests.
plugins/ossl_engine/engine/Cargo.toml	Adds dependencies/features needed for lifecycle/logging + mock tests.
Cargo.toml	Adds `engine-resiliency` workspace member and `tracing-appender` dependency.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Wire the cdylib: EngineData parked in ENGINE ex_data; HsmContext opens the partition/session via env-configured credentials + resiliency. Provider-aligned OBK/MOBK init (mirrors azihsm_ossl_hsm.c): try the plaintext OBK first, fall back to the cached MOBK on Bk3AlreadyInitialized, persist mobk_vec() after a cold init. Adds env-gated tracing_subscriber logging. Signed-off-by: Christian Walter <christian.walter@9elements.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

+    let installed = tracing_subscriber::registry()
+        .with(layers)
+        .with(filter)
+        .try_init()
+        .is_ok();


+    #[serial]
+    fn open_hsm_with_resiliency_succeeds() {
+        let scratch = Scratch::new("open");
+        fs::create_dir_all(scratch.0.join("res")).unwrap();


+    #[serial]
+    fn open_hsm_is_idempotent() {
+        let scratch = Scratch::new("idem");
+        fs::create_dir_all(scratch.0.join("res")).unwrap();


open_from_env_smoke drives EngineData::open_hsm_from_env() — the full partition open + init + session — using the ambient AZIHSM_* environment, so a provisioned HSM host can validate a configuration end to end (e.g. the TPM OBK/POTA sources, which the mock cannot exercise). Compiled only in non-mock builds and #[ignore]d, so it never runs in the mock CI cell; run it explicitly on hardware with the AZIHSM_* env set. Signed-off-by: Christian Walter <christian.walter@9elements.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

+        let scratch = Scratch::new("open");
+        fs::create_dir_all(scratch.0.join("res")).unwrap();
+


+        let scratch = Scratch::new("idem");
+        fs::create_dir_all(scratch.0.join("res")).unwrap();
+


Copilot AI review requested due to automatic review settings July 10, 2026 07:25

Copilot started reviewing on behalf of walterchris July 10, 2026 07:25 View session

walterchris force-pushed the engine/pr4-lifecycle branch from a5812db to ce32596 Compare July 10, 2026 07:30