Require key and certificate values at create and fix attribute getters

[aidangarske]

F-6660 - 330fdd0 - C_CreateObject now returns CKR_TEMPLATE_INCOMPLETE or CKR_ATTRIBUTE_VALUE_INVALID for a certificate with a missing or empty CKA_VALUE, except X.509 or WTLS certificates located by CKA_URL.

F-6661 - c7ed98b - C_CreateObject now rejects a secret key with a missing or empty CKA_VALUE.

F-11507 - 38fe9dc - C_CreateObject now requires the RSA modulus (or both primes for a private key) and exponent, the EC curve plus a point or value, and a secret key type for CKO_SECRET_KEY, and limits the attribute count to INT_MAX.

F-6662 - dcf6df3 - C_CreateObject no longer requires CKA_VALUE for data objects, and the value defaults to empty.

F-10382 - 2a064db - The EC, ML-DSA and ML-KEM attribute getters now return NOT_AVAILABLE_E with CK_UNAVAILABLE_INFORMATION as the length for attributes that are not available.

F-6955 - d739b7e - Certificate objects now return CKA_CERTIFICATE_CATEGORY from C_GetAttributeValue.

F-6956 - 3ce85b1 - CKA_SUBJECT is now readable on public and private keys, and CKA_ISSUER and CKA_SERIAL_NUMBER are limited to certificates and NSS trust objects.

F-6658 - 5d817fe - WP11_Object_Copy now copies the CKA_LOCAL bit.

F-4061 - cbc66a1 - GetMldsaParams now sets the output length on success.

F-4062 - 57f3b30 - GetTrustAttr now applies the certificate hash buffer size check only when a buffer is supplied, so a size query succeeds.

F-6235 - 7bf8456 - GetEcParams now sizes the encoded curve OID first and returns BUFFER_E when the buffer is smaller than the OID length plus 2.

[Copilot]

🟡 Changes recommended

Finalization can leave a mixed persisted snapshot, and some tests encode a non-conforming attribute return value.

4 open findings

• A storage error is reported only after WP11_Library_Final has already committed earlier… · New
• This fallback says the test is skipped but exits successfully, so Automake records a pass and… · New
• CK_UNAVAILABLE_INFORMATION is an attribute-length sentinel, not a valid CK_RV from… · New
• CK_UNAVAILABLE_INFORMATION is an attribute-length sentinel, not a valid CK_RV from… · New

What changed in this PR

This PR strengthens PKCS#11 object validation, attribute handling, operation lifecycle behavior, token persistence, and mechanism metadata.

Changes:

• Enforces required key/certificate attributes and immutable key material.
• Corrects attribute getters, mechanism flags, token metadata, and operation cancellation.
• Adds extensive validation, persistence, decoding, and failure-path tests.

File	Description
wolfpkcs11/​pkcs11.h	Adds operation-cancellation error constant.
wolfpkcs11/​internal.h	Adds limits and internal lifecycle helpers.
src/​wolfpkcs11.c	Updates finalization and information padding.
src/​slot.c	Corrects token information and mechanism metadata.
tests/​token_store_test.c	Tests storage failure and persistence behavior.
tests/​object_store_decode_test.c	Tests malformed stored-object handling.
tests/​key_material_update_test.c	Tests key-material immutability.
tests/​info_mech_table_test.c	Validates information and mechanism tables.
tests/​attribute_validation_test.c	Tests template and attribute validation.
tests/​pkcs11test.c	Updates core conformance expectations.
tests/​pkcs11mtt.c	Updates multithreaded test expectations.
tests/​pkcs11v3test.c	Updates read-only attribute tests.
tests/​include.am	Registers the new test programs.
.github/​workflows/​unit-test.yml	Adds TPM-debug and no-environment coverage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Frauschi]

Two comments, inline.

[Frauschi]

Thanks, looks good.

The merge-base changed after approval.