LICENSE

@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

Library/token-manipulation/lib.sh

@@ -0,0 +1,348 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   lib.sh of /CoreOS/opencryptoki/Library/token-manipulation
+#   Description: provides basic function for token manipulation
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   library-prefix = pkcs
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+true <<'=cut'
+=pod
+
+=head1 NAME
+
+opencryptoki/token-manipulation - provides basic function for token manipulation
+
+=head1 DESCRIPTION
+
+The library provides basic function for manipulation with
+opencryptoki tokens, like initialization, cleanup etc.
+
+=cut
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   Variables
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+true <<'=cut'
+=pod
+
+=head1 VARIABLES
+
+Below is the list of global variables. When writing a new library,
+please make sure that all global variables start with the library
+prefix to prevent collisions with other libraries.
+
+=over
+
+=item pkcsUSER_PIN
+
+USER PIN to be used when initializing a token. By default 01234567.
+
+=item pkcsSO_PIN
+
+SO PIN to be used when initializing a token. By default 76543210.
+
+=item pkcsFACTORY_SO_PIN
+
+Default (factory) SO PIN of a token. Initialized as 87654321.
+
+=back
+
+=cut
+
+export pkcsUSER_PIN
+[ -n "$pkcsUSER_PIN" ] || pkcsUSER_PIN="01234567"
+
+export pkcsSO_PIN
+[ -n "$pkcsSO_PIN" ] || pkcsSO_PIN="76543210"
+
+export pkcsFACTORY_SO_PIN
+[ -n "$pkcsFACTORY_SO_PIN" ] || pkcsFACTORY_SO_PIN="87654321"
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   Functions
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+true <<'=cut'
+=pod
+
+=head1 FUNCTIONS
+
+=head2 pkcsGetTokenSlot
+
+Return slot number for a token with specified type.
+
+    pkcsGetTokenSlot type
+
+=over
+
+=item type
+
+Token type to be used. Available options are matching
+dynamic library suffixes from /etc/opencryptoki/opencryptoki.conf,
+in particular : sw, tpm, ica, cca, ep11
+
+=back
+
+Returns 0 when the initialization was successfull, non-zero otherwise.
+
+=cut
+
+
+pkcsGetTokenSlot() {
+    local TYPE=$1
+    local CONF=/etc/opencryptoki/opencryptoki.conf
+    local SLOT
+    [ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1
+    if grep -q "stdll = libpkcs11_$TYPE.so" $CONF; then
+        SLOT=$( egrep "(^slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' )
+	echo $SLOT
+    else
+        echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" >&2
+        echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" >&2
+        cat $CONF >&2
+        echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" >&2
+        return 1
+    fi
+}
+
+true <<'=cut'
+=pod
+
+=head2 pkcsInitToken
+
+Initialize token specified using slot number and sets up
+new SO PIN and USER PIN.
+
+    pkcsInitToken type|slot [CURRENT_SO_PIN]
+
+=over
+
+=item type
+
+Token specification using the token type.
+Available options are: sw, tpm, ica, cca, ep11.
+
+=item slot
+
+Token specification using the slot number.
+
+
+=back
+
+Returns 0 when the initialization was successfull, non-zero otherwise.
+
+=cut
+
+pkcsInitToken() {
+
+    local SLOT
+    local LABEL="$2"
+    [ -z $1 ] && echo "Error: pkcsInitToken: No token type specified"
+    # if token specified using slot number
+    if echo "$1" | grep -qE '^[0-9]+$'; then
+        SLOT=$1
+    else  # specified using token type
+        SLOT=$( pkcsGetTokenSlot $1 ) || return 1
+    fi
+    echo SLOT: $SLOT
+    # if label not specified, use the current value
+    [ -z "$LABEL" ] && LABEL=`pkcsconf -t -c $SLOT | grep 'Label:' | sed 's/^.*Label: //'`
+    echo LABEL: $LABEL
+    local SOPIN=$2
+    [ -z $SOPIN ] && SOPIN=$pkcsFACTORY_SO_PIN
+
+    echo "pkcsInitToken: Initialize token"
+    cat <<EOF | expect
+spawn /usr/sbin/pkcsconf -c $SLOT -I
+expect "Enter the SO PIN: "
+sleep .1
+send "${SOPIN}\r"
+sleep .1
+expect "label: "
+sleep .1
+send "${LABEL}\r"
+sleep .1
+expect eof {} \
+"Incorrect PIN Entered." {exit 1}
+exit 0
+EOF
+
+    echo "pkcsInitToken: Changing SO PIN"
+    cat <<EOF | expect
+spawn /usr/sbin/pkcsconf -c $SLOT -P
+expect "Enter the SO PIN: "
+sleep .1
+send "${SOPIN}\r"
+sleep .1
+expect "Enter the new SO PIN: "
+sleep .1
+send "$pkcsSO_PIN\r"
+sleep .1
+expect "Re-enter the new SO PIN: "
+sleep .1
+send "$pkcsSO_PIN\r"
+sleep .1
+expect " " {exit 1}
+exit 0
+EOF
+    if [ $? -eq 0 ]; then
+        echo "pkcsInitToken: Succesfully changed SO PIN to $pkcsSO_PIN"
+    else
+        echo "Error: pkcsInitToken: Failed to change SO PIN"
+        return 1
+    fi
+
+    echo "pkcsInitToken: Changing USER PIN"
+    cat <<EOF | expect
+spawn /usr/sbin/pkcsconf -c $SLOT -u
+expect "Enter the SO PIN: "
+sleep .1
+send "$pkcsSO_PIN\r"
+sleep .1
+expect "Enter the new user PIN: "
+sleep .1
+send "$pkcsUSER_PIN\r"
+sleep .1
+expect "Re-enter the new user PIN: "
+sleep .1
+send "$pkcsUSER_PIN\r"
+sleep .1
+expect " " {exit 1}
+exit 0
+EOF
+    if [ $? -eq 0 ]; then
+        echo "pkcsInitToken: Succesfully changed USER PIN to $pkcsUSER_PIN"
+    else
+        echo "Error: pkcsInitToken: Failed to change USER PIN"
+        return 1
+    fi
+}
+
+true <<'=cut'
+=pod
+
+=head2 pkcsResetTokens
+
+Makes a backup of /var/lib/opencryptoki and resets all tokens 
+by removing all files from /var/lib/opencryptoki and shared 
+memory files from /dev/shm.
+
+=back
+
+Returns 0 if the backup and removal passed, non-zero otherwise.
+
+=cut
+
+
+pkcsResetTokens() {
+    local NAMESPACE=pkcslib
+    [ -n "$1" ] && NAMESPACE="$1"
+    rlFileBackup --clean --namespace ${NAMESPACE} /var/lib/opencryptoki && \
+    find /var/lib/opencryptoki/ -type f -exec rm {} \; && \
+    rm -f /dev/shm/var.lib.opencryptoki.*
+}
+
+true <<'=cut'
+=pod
+
+=head2 pkcsRestoreTokens
+
+Restores a backup of /var/lib/opencryptoki created in pkcsResetTokens().
+
+=back
+
+Returns 0 if the backup restore passed.
+
+=cut
+
+
+pkcsRestoreTokens() {
+    rlFileRestore --namespace pkcslib
+}
+
+true <<'=cut'
+=pod
+
+=head1 EXECUTION
+
+This library supports direct execution. When run as a task, phases
+provided in the PHASE environment variable will be executed.
+Supported phases are:
+
+=over
+
+=item Create
+
+Create a new empty file. Use FILENAME to provide the desired file
+name. By default 'foo' is created in the current directory.
+
+=item Test
+
+Run the self test suite.
+
+=back
+
+=cut
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   Verification
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   This is a verification callback which will be called by
+#   rlImport after sourcing the library to make sure everything is
+#   all right. It makes sense to perform a basic sanity test and
+#   check that all required packages are installed. The function
+#   should return 0 only when the library is ready to serve.
+
+pkcsLibraryLoaded() {
+    if rpm=$(rpm -q opencryptoki); then
+        rlLogDebug "Librar opencryptoki/token-manipulation running with $rpm"
+        return 0
+    else
+        rlLogError "Package opencryptoki not installed"
+        return 1
+    fi
+}
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#   Authors
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+true <<'=cut'
+=pod
+
+=head1 AUTHORS
+
+=over
+
+=item *
+
+Karel Srot <ksrot@redhat.com>
+
+=back
+
+=cut

Library/token-manipulation/main.fmf

@@ -0,0 +1,19 @@
+summary: provides basic function for token manipulation
+description: ''
+contact: Karel Srot <ksrot@redhat.com>
+component: []
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- expect
+duration: 5m
+enabled: true
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+extra-nitrate: TC#0607908
+extra-summary: '[pkcs] provides basic function for token manipulation (opencryptoki/token-manipulation)'
+extra-task: /CoreOS/opencryptoki/Library/token-manipulation

Library/token-manipulation/runtest.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Library/token-manipulation
+#   Description: provides basic function for token manipulation
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+PHASE=${PHASE:-Test}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport ./token-manipulation"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+    rlPhaseEnd
+
+    # Self test
+    if [[ "$PHASE" =~ "Test" ]]; then
+        rlPhaseStartTest "Test sw token initialization"
+	    rlServiceStop pkcsslotd
+            pkcsResetTokens
+	    rlServiceStart pkcsslotd
+            pkcsInitToken sw
+	    rlRun -s "pkcsconf -t"
+	    rlAssertGrep "USER_PIN_INITIALIZED" $rlRun_LOG
+	    rlServiceStop pkcsslotd
+            pkcsRestoreTokens
+	    rlServiceRestore pkcsslotd
+        rlPhaseEnd
+    fi
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

README.md

@@ -1,2 +1,3 @@
-Tests have been moved to a RH internal GitLab CEE instance
+# opencryptoki
-/rhel-tests/opencryptoki
+
+tests for the opencryptoki package

Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf

@@ -0,0 +1,24 @@
+summary: Test for BZ#1154647 (opencryptoki-libs should Requires(pre))
+description: |
+    Bug summary: opencryptoki-libs should Requires(pre) shadow-utils
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1154647
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+- opencryptoki-libs
+duration: 3m
+enabled: true
+tag:
+- TIPpass_Security
+- Tier3
+- Tier3security
+tier: '3'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1154647
+extra-nitrate: TC#0430383
+extra-summary: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre
+extra-task: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre

Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre
+#   Description: Test for BZ#1154647 (opencryptoki-libs should Requires(pre))
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2014 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+    rlPhaseEnd
+
+    rlPhaseStartTest
+	if rpm -q --scripts opencryptoki-libs | grep groupadd; then
+		rlPass "Just check that opencryptoki-libs are calling groupadd"
+		rlRun -s "rpm -qv --requires opencryptoki-libs"
+		rlAssertGrep 'pre: shadow-utils' $rlRun_LOG
+		rm $rlRun_LOG
+	else
+		rlLogInfo "This test is not relevant for opencryptoki-libs which does not call grupadd in scripts"
+	fi
+
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf

@@ -0,0 +1,26 @@
+summary: Tests if validation PIN is actually checked for correctness
+description: ''
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-libs
+- expect
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- TIPpass_Security
+- Tier2
+- Tier2security
+- TierCandidatesPASS
+tier: '2'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=415971
+extra-nitrate: TC#0067826
+extra-summary: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong
+extra-task: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong

Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp

@@ -0,0 +1,46 @@
+#!/usr/bin/expect
+set cmd [lrange $argv 0 0]
+
+log_user 1
+spawn $cmd -I -c 0
+expect "Enter the SO PIN: "
+sleep .1
+send "87654321\r"
+sleep .1
+expect "label: "
+sleep .1
+send "cryptotest\r"
+sleep .1
+expect eof
+
+spawn $cmd -u -c 0
+expect "Enter the SO PIN: "
+sleep .1
+send "87654321\r"
+sleep .1
+expect "Enter the new user PIN: "
+sleep .1
+send "test\r"
+sleep .1
+expect "Re-enter the new user PIN: "
+sleep .1
+send "test\r"
+sleep .1
+expect eof
+
+spawn $cmd -p -c 0
+expect "Enter user PIN: "
+sleep .1
+send "test\r"
+sleep .1
+expect "Enter the new user PIN: "
+sleep .1
+send "text\r"
+sleep .1
+expect "Re-enter the new user PIN: "
+sleep .1
+send "text1\r"
+sleep .1
+expect eof
+
+

Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong
+#   Description: Tests if validation PIN is actually checked for correctness
+#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+PKCSCONF="pkcsconf"
+
+TMP=`mktemp`
+
+function reset_tokens() {
+    rlLogInfo "Reseting tokens..."
+    rlServiceStop pkcsslotd
+    rlRun "find /var/lib/opencryptoki/ -type f -exec rm {} \\;"
+    rlServiceStart pkcsslotd
+    rlLogInfo "--- reset finished ---"
+}
+
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+	rlFileBackup --clean /var/lib/opencryptoki 
+	[ -d /etc/opencryptoki ] && rlFileBackup --clean /etc/opencryptoki
+	reset_tokens
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "./pkcsconf.exp $PKCSCONF 2>&1 | tee $TMP"    
+        rlAssertGrep "Invalid new user pin|New PINs do not match." $TMP -E
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf $TMP"
+	rlFileRestore
+	rlServiceRestore pkcsslotd
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf

@@ -0,0 +1,41 @@
+summary: Opencryptoki-session-object-performance-degradation
+description: |
+  Tests if overall performance of cryptographic operations degrades exponentially
+  with the number of objects per token or open sessions per process
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- gcc
+- automake
+- libtool
+- openssl-devel
+- expect
+- yum-utils
+- bzip2
+- rpm-build
+- libica-devel
+- systemd-devel
+duration: 20m
+enabled: true
+tag:
+- TIPpass_Security
+- Tier3
+- Tier3security
+- rhel8-buildroot
+- rhel9-buildroot
+tier: '3'
+adjust:
+-   enabled: false
+    when: arch == ia64
+    continue: false
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=612274
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=627560
+extra-nitrate: TC#0075518
+extra-summary: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation
+extra-task: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation

Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation
+#   Description: Tests if overall performance of cryptographic operations degrades exponentially with the number of objects per token or open sessions per process
+#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+PACKAGES="gcc automake libtool openssl-devel expect"
+TMPDIR=`mktemp -d`
+TMP=`mktemp`
+SRC="src.tbz"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        for PKG in $PACKAGES; do
+            rlAssertRpm  $PKG
+        done
+        PKGVER=`rpm -q --qf '%{VERSION}' opencryptoki`
+        rlServiceStart "pkcsslotd"
+        # use always software slot
+        # SLOT=$(($(pkcsconf -s | grep -B1 Soft | grep -o '#[0-9]' | tr -d '#')-1))
+        SLOT=$(pkcsconf -s | egrep -B1 '(Soft|Linux)' | grep -o '#[0-9]' | tr -d '#')
+        rlLog "Using slot $SLOT"
+        rlRun "pushd ."
+        rlRun "cd $TMPDIR"
+	rlFetchSrcForInstalled opencryptoki
+	rlRun "yum-builddep -y opencryptoki*src.rpm"
+	rlRun "rpm -i opencryptoki*src.rpm"
+
+	# opencryptoki version >= 3.11.0 needs to enable building test cases during the pkg build
+        rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec"
+	rlRun "rpmbuild -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Preparing builddir"
+	TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases`
+       	rlRun "pushd . && cd $TESTDIR"
+       	rlRun "sed -i 's/50000/10000/g' pkcs11/sess_perf.c" 0 "Adjusting testcase"
+	rlRun "rpmbuild -bc --short-circuit ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Building opencryptoki files"
+	popd
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        cd $TESTDIR
+	if [ -d driver ]; then
+       	rlRun "cd driver"
+       	rlRun "./sess_perf_tests -slot $SLOT | tee $TMP"
+	else
+		rlRun "cd pkcs11"
+       	rlRun "./sess_bench -slot $SLOT | tee $TMP"
+	fi
+        rlRun "cat $TMP | grep CKR" 1 "Checking for errors"
+        # Count the number occurrences when performance test time exceeds >10ms
+        # In buggy version this will happen a lot and the performance will degrade.
+        # The count (3) currently tested may need more adjustment.
+        COUNT=$(cat $TMP | grep Time | egrep -c '[0-9][0-9]+')
+        rlAssertGreater "Checking performance" 3 $COUNT
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -rf $TMPDIR $TMP"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf

@@ -0,0 +1,28 @@
+summary: Checks if root is not added to the pkcs11 group
+description:
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 15m
+enabled: true
+tag:
+- TIPpass_Security
+- Tier3
+- Tier3security
+tier: '3'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=732756
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=833828
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1013017
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=833818
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1058814
+extra-nitrate: TC#0111303
+extra-summary: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group
+extra-task: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group

Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group
+#   Description: Checks if root is not added to the pkcs11 group and opencryptoki works well in this case
+#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+ROOT=$(mktemp -d)
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        if rlIsFedora '>=22'; then
+            # dnf is not able to use system relesever when changing installroot (#1173107)
+            RELEASEVER=$(. /etc/os-release; echo $VERSION_ID)
+            rlRun -s "dnf -y install --nogpg --releasever=$RELEASEVER --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1"
+            rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG
+        else
+            rlRun -s "yum -y install --nogpg --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1"
+            rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartTest "pkcs11 group should exist but root should not be a member"
+        rlAssertGrep "^pkcs11"  "$ROOT/etc/group" -E
+        rlAssertNotGrep "^pkcs11.*root"  "$ROOT/etc/group" -E
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf $ROOT"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/PID-file-location/main.fmf

@@ -0,0 +1,30 @@
+summary: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/)
+description: |
+    Bug summary: pkcsslotd PIDfile below legacy directory /var/run/
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1974693
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - library(nvr/nvr)
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-tpmtok
+- opencryptoki-icsftok
+- opencryptoki-icatok
+- opencryptoki-ccatok
+duration: 2m
+enabled: true
+tag:
+- Tier1
+- CI-Tier-1
+adjust:
+-   enabled: false
+    when: "distro == rhel-7 or distro < rhel-8.9"
+    continue: false
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974693
+extra-nitrate: TC#0611070

Sanity/PID-file-location/runtest.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2014 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+UNITFILE="/usr/lib/systemd/system/pkcsslotd.service"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library"
+        rlAssertRpm $PACKAGE
+        rlAssertExists $UNITFILE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlServiceStop pkcsslotd
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        PIDFILE=/run/opencryptoki/pkcsslotd.pid
+        nvrTestPackage opencryptoki '<' 3.21.0 && PIDFILE=/run/pkcsslotd.pid
+
+        rlAssertGrep "PIDFile=$PIDFILE" $UNITFILE
+        rlServiceStart pkcsslotd
+        rlRun -s "journalctl -u pkcsslotd -S '-10s'"
+        #rlAssertGrep "PID File created" $rlRun_LOG
+        rlAssertGrep "Started (pkcsslotd.service)?.*Daemon" $rlRun_LOG -E
+        rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG
+        rlAssertExists $PIDFILE
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+
+rlJournalPrintText
+rlJournalEnd

Sanity/init-token-as-a-nonroot-user/main.fmf

@@ -0,0 +1,36 @@
+summary: basic token initialization as a nonroot user
+description: basic token initialization as a nonroot user
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- library(nvr/nvr)
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-tpmtok
+- opencryptoki-ccatok
+- opencryptoki-icsftok
+- opencryptoki-icatok
+- expect
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- NoRHEL4
+- NoRHEL5
+- TIPpass_Security
+- Tier1
+- Tier1security
+tier: '1'
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5
+    continue: false
+extra-nitrate: TC#0342770
+extra-summary: /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user
+extra-task: /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user

Sanity/init-token-as-a-nonroot-user/runtest.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user
+#   Description: basic token initialization as a nonroot user
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2014 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+USER="user$RANDOM"
+
+TESTDIR=`pwd`
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library"
+	# need to find out the library path so a user can import it too
+	rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library"
+	LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'`
+	echo "LIBPATH=$LIBPATH"
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+	rlRun "useradd -m $USER -G pkcs11"
+	rlRun -s "su $USER -c 'id'"
+	rlAssertGrep "pkcs11" $rlRun_LOG
+	rlServiceStop pkcsslotd
+	rlRun "pkcsResetTokens"
+	rlServiceStart pkcsslotd
+    rlPhaseEnd
+
+    rlPhaseStartTest "listing available tokens as a testuser"
+	rlRun "su $USER -c 'pkcsconf -t' &> query1.log"
+	cat query1.log
+    if nvrTestPackage opencryptoki '<' 3.14.0; then
+	    rlAssertGrep "Model: IBM SoftTok" query1.log
+    else
+        rlAssertGrep "Model: Soft " query1.log
+    fi
+    rlPhaseEnd
+
+  # initialize every token available
+  for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do
+
+    rlPhaseStartTest "initialize token #$SLOT"
+	rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'"
+	rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log"
+	cat query2.log
+	rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E
+    rlPhaseEnd
+
+  done
+
+    rlPhaseStartCleanup
+	rlServiceStop pkcsslotd
+	rlRun "pkcsRestoreTokens"
+	    rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlLog "Waiting 12 for systemd --user process to exit..."
+        sleep 15
+        rlRun "userdel -r $USER" || ps -ef
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/init-tokens-as-root/main.fmf

@@ -0,0 +1,39 @@
+summary: Initialize all available tokens as a root user
+description: |
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1122505
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- library(nvr/nvr)
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-tpmtok
+- opencryptoki-ccatok
+- opencryptoki-icsftok
+- opencryptoki-icatok
+- expect
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- NoRHEL4
+- NoRHEL5
+- TIPpass_FIPS
+- TIPpass_Security
+- Tier1
+- Tier1security
+- TierCandidatesPASS
+tier: '1'
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+extra-nitrate: TC#0470488
+extra-summary: /CoreOS/opencryptoki/Sanity/init-tokens-as-root
+extra-task: /CoreOS/opencryptoki/Sanity/init-tokens-as-root

Sanity/init-tokens-as-root/runtest.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Sanity/init-tokens-as-root
+#   Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2015 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+TESTDIR=`pwd`
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library"
+		rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+		rlServiceStop pkcsslotd
+        rlRun "pkcsResetTokens"
+        rlRun "id root | grep pkcs11" 1 "Verify that root is not in pkcs11 group"
+		rlServiceStart pkcsslotd
+    rlPhaseEnd
+
+    rlPhaseStartTest "listing available tokens as root"
+        rlRun "pkcsconf -t &> query1.log"
+        cat query1.log
+        if nvrTestPackage opencryptoki '<' 3.14.0; then
+            rlAssertGrep "Model: IBM SoftTok" query1.log
+        else
+            rlAssertGrep "Model: Soft " query1.log
+        fi
+    rlPhaseEnd
+
+  # initialize every token available
+  for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do
+
+    rlPhaseStartTest "initialize token #$SLOT as root"
+        rlRun "pkcsInitToken $SLOT"
+        rlRun "pkcsconf -t -c $SLOT &> query2.log"
+        cat query2.log
+        rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E
+    rlPhaseEnd
+  done
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+		rlServiceStop pkcsslotd
+        rlRun "pkcsRestoreTokens"
+        rlServiceRestore pkcsslotd
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/lock-files-are-persistent-across-system-reboot/main.fmf

@@ -0,0 +1,28 @@
+summary: Test for BZ#1054442 (lock files are not persistent after system reboot)
+description: |
+    Bug summary: lock files are not persistent after system reboot even though the lock files are entered in tmpfiles.d (opencryptoki)
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1054442
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-tpmtok
+- opencryptoki-icsftok
+- opencryptoki-icatok
+- opencryptoki-ccatok
+duration: 15m
+enabled: true
+tag:
+- TIPpass_FIPS
+- TIPpass_Security
+- TierCandidatesPASS
+- notier
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442
+extra-nitrate: TC#0336748
+extra-summary: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot
+extra-task: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot

Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot
+#   Description: Test for BZ#1054442 (lock files are not persistent after system reboot)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2014 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+	rlServiceStart pkcsslotd
+    rlPhaseEnd
+
+    rlPhaseStartTest
+	if arch | grep s390; then
+	    SUBDIRS="ccatok icsf lite swtok"
+	else
+	    SUBDIRS="icsf swtok"
+	fi
+	rlIsRHEL '<=8' && SUBDIRS="$SUBDIRS tpm"
+	for DIR in $SUBDIRS; do
+	    rlAssertExists /var/lib/opencryptoki/$DIR
+	done
+	rlAssertExists /var/lock/opencryptoki
+	rlAssertExists /var/lock/opencryptoki/LCK..APIlock
+        if [ ! -f /bz1054442-rebooted ]; then
+            touch /bz1054442-rebooted
+	    rlRun "rhts-reboot"
+        else
+	    rlRun "rm /bz1054442-rebooted"
+	fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+	rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf

@@ -0,0 +1,9 @@
+summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=ica
+environment:
+    TOKEN: ica
+adjust:
+-   enabled: false
+    when: arch != s390x
+    continue: false
+extra-nitrate: TC#0611373
+extra-summary: TOKEN=ICA /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool

Sanity/openCryptoki-PIN-conversion-tool/main.fmf

@@ -0,0 +1,41 @@
+summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool)
+description: |
+    Bug summary: [IBM 8.3 FEAT] openCryptoki: PIN conversion tool
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1780294
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-icatok
+- openssl
+- gnutls-utils
+- opensc
+- expect
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- NoRHEL4
+- NoRHEL5
+- NoRHEL6
+- NoRHEL7
+- Tier1
+tier: '1'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1964304
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1995919
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1987256
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    continue: false
+extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool

Sanity/openCryptoki-PIN-conversion-tool/runtest.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool
+#   Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+[ -n "$TOKEN" ] || TOKEN=sw
+[ "$TOKEN" == "sw" ] && STORE=/var/lib/opencryptoki/swtok
+[ "$TOKEN" == "ica" ] && STORE=/var/lib/opencryptoki/lite
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlFileBackup /etc/opencryptoki/opencryptoki.conf
+	[ -f /etc/opencryptoki/opencryptoki.conf_BAK ] && rlFileBackup /etc/opencryptoki/opencryptoki.conf_BAK && rlRun "rm -f /etc/opencryptoki/opencryptoki.conf_BAK"
+        rlServiceStop pkcsslotd
+        rlRun "pkcsResetTokens"
+        rlServiceStart pkcsslotd
+        sleep 1
+        rlRun "pkcsconf -t"
+        SLOT=$( pkcsGetTokenSlot $TOKEN )
+	MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' )
+        rlServiceStop pkcsslotd
+        rlRun "pkcsResetTokens"
+        rlRun "sed -i '/tokversion = 3.12/d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present"
+	# add token description to reproduce bz#1987256
+	TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."'
+	rlRun "sed -i 's/stdll = libpkcs11_$TOKEN.so/description = \\\"My Token\\\"\nmanufacturer = \\\"MyCompany Inc\\\"\nstdll = libpkcs11_$TOKEN.so/' /etc/opencryptoki/opencryptoki.conf"
+        rlServiceStart pkcsslotd
+        # initialize token
+        rlRun "pkcsInitToken $SLOT"
+        rlRun "pkcsconf -t"
+        rlRun "p11tool --generate-rsa  --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=${MODEL};manufacturer=IBM' --label id_rsa.pub"
+        rlAssertExists id_rsa.pub
+        rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so  --list-objects --slot 0x$SLOT"
+        rlAssertGrep "Public Key Object" $rlRun_LOG
+        rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Token migration"
+        rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1
+        rlAssertGrep "pkcstok_migrate: Please stop pkcsslotd before running this utility" $rlRun_LOG
+        rlServiceStop pkcsslotd
+        sleep 5
+        systemctl status pkcsslotd --no-pager
+        rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN"
+        rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG
+        grep -A 5 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf
+        rlRun "grep -A 5 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'"
+        rlServiceStart pkcsslotd
+        sleep 1
+        rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key"
+        rlAssertGrep "Public Key Object" $rlRun_LOG
+        rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+        rlLog "Exporting stored RSA key"
+        rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT"
+        rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format"
+        rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceStop pkcsslotd
+        rlRun "pkcsRestoreTokens"
+        rlFileRestore
+        rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf

@@ -0,0 +1,5 @@
+summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=sw
+environment:
+  TOKEN: sw
+extra-nitrate: TC#0607912
+extra-summary: TOKEN=sw /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool

Sanity/opencryptoki-files-ownership/main.fmf

@@ -0,0 +1,24 @@
+summary: verify correct file ownership
+description: verifies if important opencryptoki files have correct ownership
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-tpmtok
+- opencryptoki-ccatok
+- opencryptoki-icsftok
+- opencryptoki-icatok
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- Tier1
+tier: '1'
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
+    continue: false

Sanity/opencryptoki-files-ownership/runtest.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2025 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+TESTDIR=`pwd`
+
+function checkFile() {
+    MUSTEXIST=false
+    if [ "$1" == "-e" ]; then
+        MUSTEXIST=true
+        shift
+    fi
+    FILEPATH=$1
+    OWNER=$2
+    GROUP=$3
+    if "$MUSTEXIST" || [ -e "$FILEPATH" ]; then
+        rlRun "ls -ld $FILEPATH | grep -qE '$OWNER[ ]*$GROUP'"
+    fi
+}
+
+rlJournalStart
+    rlPhaseStartTest
+        rlServiceStart pkcsslotd
+        rlRun "systemctl status pkcsslotd" 0 "Confirm that pkcsslotd is running"
+        # verify user account
+        rlRun -s "id pkcsslotd"
+        rlRun "grep -E 'groups=.*pkcs11' $rlRun_LOG"
+        # check /etc/opencryptoki
+        checkFile -e /etc/opencryptoki/opencryptoki.conf root root
+        checkFile /etc/opencryptoki/p11sak_defined_attrs.conf root pkcs11
+        checkFile /etc/opencryptoki/strength.conf root pkcs11
+        # check /run files
+	checkFile -e /run/lock/opencryptoki/LCK..APIlock pkcsslotd pkcs11
+	checkFile -e /run/opencryptoki/pkcsslotd.pid pkcsslotd pkcs11
+	checkFile -e /run/opencryptoki/pkcsslotd.socket pkcsslotd pkcs11
+	checkFile -e /run/opencryptoki/pkcsslotd.admin.socket pkcsslotd pkcs11
+	# check /var/lib/opencryptoki
+	checkFile -e /var/lib/opencryptoki/HSM_MK_CHANGE root pkcs11
+	checkFile -e /var/lib/opencryptoki/swtok root pkcs11
+	checkFile -e /var/lib/opencryptoki/swtok/TOK_OBJ root pkcs11
+        if rpm -q opencryptoki-ep11tok; then
+	    checkFile -e /var/lib/opencryptoki/ep11tok root pkcs11
+	    checkFile -e /var/lib/opencryptoki/ep11tok/TOK_OBJ root pkcs11
+        fi
+        if rpm -q opencryptoki-icatok; then
+	    checkFile -e /var/lib/opencryptoki/lite root pkcs11
+	    checkFile -e /var/lib/opencryptoki/lite/TOK_OBJ root pkcs11
+        fi
+        if rpm -q opencryptoki-ccatok; then
+	    checkFile -e /var/lib/opencryptoki/ccatok root pkcs11
+	    checkFile -e /var/lib/opencryptoki/ccatok/TOK_OBJ root pkcs11
+        fi
+	rlServiceStop pkcsslotd
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/p11sak-key-management-tool-basic-functionality/main.fmf

@@ -0,0 +1,35 @@
+summary: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool)
+description: |
+    Bug summary: [IBM 8.3 FEAT] openCryptoki key management tool: list keys function
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1800549
+contact: Karel Srot <ksrot@redhat.com>
+component:
+  - openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - library(nvr/nvr)
+  - url: https://src.fedoraproject.org/tests/opencryptoki.git
+    name: /Library/token-manipulation
+recommend:
+  - opencryptoki
+  - opencryptoki-swtok
+  - expect
+duration: 5m
+enabled: true
+tag:
+  - CI-Tier-1
+  - Tier1
+  - customer_scenario
+tier: '1'
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    continue: false
+extra-nitrate: TC#0607944
+extra-summary: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality
+extra-task: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality
+id: 065dda66-85f0-4142-83d3-b4104d359d41

Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh

@@ -0,0 +1,200 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality
+#   Description: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+[ -n "$SLOT" ] || SLOT=sw
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library"
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlFileBackup /etc/opencryptoki/opencryptoki.conf
+        rlServiceStop pkcsslotd
+        rlRun "pkcsResetTokens"
+        rlServiceStart pkcsslotd
+        sleep 1
+        rlRun "pkcsconf -t | grep 'Soft'"
+	SLOT=$( pkcsGetTokenSlot $SLOT )
+        rlRun "pkcsInitToken $SLOT"
+        rlRun "pkcsconf -t"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test key generation and listing"
+        rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E
+            rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG
+	else
+            rlAssertGrep 'Successfully generated a AES key with label "aes_key".' $rlRun_LOG
+        fi
+        rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E
+
+        rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E
+            rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG
+        else
+            rlAssertGrep 'Successfully generated a 3DES key with label "3des_key".' $rlRun_LOG
+        fi
+        rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep '3DES | "?3des_key"?' $rlRun_LOG -E
+
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key"
+            rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG
+            rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG
+        else
+            rlRun -s "p11sak gen-key rsa 2048 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key"
+            rlAssertGrep 'Successfully generated a RSA key pair with labels "rsa_key:pub":"rsa_key:prv".' $rlRun_LOG
+        fi
+        rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep 'public RSA | "?rsa_key:pub"?' $rlRun_LOG -E
+        rlAssertGrep 'private RSA | "?rsa_key:prv"?' $rlRun_LOG -E
+
+        rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG
+        else
+            rlAssertGrep 'Successfully generated a EC key pair with labels "ec_key:pub":"ec_key:prv".' $rlRun_LOG
+        fi
+        rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep 'Label: "?aes_key"?' $rlRun_LOG -E
+        rlAssertGrep 'Label: "?3des_key"?' $rlRun_LOG -E
+        rlAssertNotGrep 'Label: "?rsa_key"?' $rlRun_LOG -E
+
+        rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep 'Label: "?rsa_key:prv"?' $rlRun_LOG -E
+        rlAssertNotGrep 'Label: "?rsa_key:pub"?' $rlRun_LOG -E
+    rlPhaseEnd
+
+if nvrTestPackage opencryptoki '>=' 3.17.0; then
+    rlPhaseStartTest "Test p11sak_defined_attrs.conf adjustment"
+        rlFileBackup /etc/opencryptoki/p11sak_defined_attrs.conf
+	rlRun "cat >> /etc/opencryptoki/p11sak_defined_attrs.conf <<_EOF
+attribute {
+   name = CKA_PRIME_1
+   id = 0x00000124
+   type = CK_BYTE
+}
+
+_EOF"
+        rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+	    rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG
+        else
+            rlAssertGrep "CKA_PRIME_1: \[sensitive\]" $rlRun_LOG
+        fi
+    rlPhaseEnd
+fi
+
+if nvrTestPackage opencryptoki '>=' 3.15.0; then
+    rlPhaseStartTest "Test key removal"
+        rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG
+        else
+            rlAssertGrep "1 key object(s) skipped." $rlRun_LOG
+        fi
+	rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN"
+	rlAssertGrep "aes_key" $rlRun_LOG
+
+        rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep "Skip deleting Key" $rlRun_LOG
+        else
+            rlAssertGrep "1 key object(s) skipped." $rlRun_LOG
+        fi
+	rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN"
+	rlAssertGrep "aes_key" $rlRun_LOG
+
+        rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG
+        else
+            rlAssertGrep 'Successfully removed AES 128 key object "aes_key".' $rlRun_LOG
+            rlAssertGrep "1 key object(s) removed." $rlRun_LOG
+        fi
+	rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN"
+	rlAssertNotGrep "aes_key" $rlRun_LOG
+
+        rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG
+        else
+            rlAssertGrep 'Successfully removed 3DES key object "3des_key".' $rlRun_LOG
+            rlAssertGrep "1 key object(s) removed." $rlRun_LOG
+        fi
+	rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN"
+	rlAssertNotGrep "3des_key" $rlRun_LOG
+
+        rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub"
+        if nvrTestPackage opencryptoki '<' 3.21.0; then
+            rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG
+        else
+            rlAssertGrep 'Successfully removed public RSA 2048 key object "rsa_key:pub".' $rlRun_LOG
+            rlAssertGrep "1 key object(s) removed." $rlRun_LOG
+        fi
+	rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN"
+	rlAssertNotGrep "rsa_key:pub" $rlRun_LOG
+    rlPhaseEnd
+fi
+
+    rlPhaseStartTest "Test help printing"
+        rlRun -s "p11sak --help"
+        rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG
+
+        rlRun -s "p11sak generate-key --help" 0,7
+        rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG
+
+        rlRun -s "p11sak list-key --help" 0,7
+        rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG
+
+
+if nvrTestPackage opencryptoki '>=' 3.15.0; then
+        rlRun -s "p11sak remove-key --help" 0,7
+        rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG
+fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceStop pkcsslotd
+        rlRun "pkcsRestoreTokens"
+        rlFileRestore
+        rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf

@@ -0,0 +1,46 @@
+summary: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories)
+description: |
+    Bug summary: RHEL7.3 - patch to create lock and log directories from opencryptoki
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1343671
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- library(nvr/nvr)
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-tpmtok
+- opencryptoki-ccatok
+- opencryptoki-icsftok
+- opencryptoki-icatok
+- expect
+- libselinux-utils
+- policycoreutils
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- NoRHEL4
+- NoRHEL5
+- NoRHEL6
+- TIPpass_Security
+- Tier1
+- Tier1security
+- TierCandidatesPASS
+tier: '1'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343671
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373833
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697489
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+extra-nitrate: TC#0532369
+extra-summary: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories
+extra-task: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories

Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh

@@ -0,0 +1,115 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories
+#   Description: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2016 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+USER="bz1343671user"
+
+TESTDIR=`pwd`
+
+LOCKDIR=/run/lock  # see bz#1373833
+rlIsRHEL '<7' && LOCKDIR=/var/lock
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library"
+        rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library"
+        # need library path so we can import it as a test user
+        LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'`
+        echo "LIBPATH=$LIBPATH"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlServiceStop pkcsslotd
+        pkcsResetTokens
+        rlFileBackup --clean /var/lib/opencryptoki /var/log/opencryptoki $LOCKDIR/opencryptoki
+        # avoid using /var/lock symlink to properly test bug 1373833
+        if [ "$LOCKDIR" == "/run/lock" ]; then
+            [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock"
+        fi
+        rlRun "useradd -m $USER -G pkcs11"
+    rlPhaseEnd
+
+  # skip this one for opencryptoki 3.21.0 as since then the service is running as a regular user
+  if nvrTestPackage opencryptoki '<' 3.21.0; then
+    rlPhaseStartTest "testing directory creation during pkcsslotd start"
+        rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki"
+        rlRun "pkcsResetTokens"
+        rlServiceStart pkcsslotd
+        rlAssertExists /var/log/opencryptoki
+        rlAssertExists $LOCKDIR/opencryptoki
+        rlRun "matchpathcon /var/log/opencryptoki"
+        rlRun "matchpathcon $LOCKDIR/opencryptoki"
+        rlRun "su $USER -c 'pkcsconf -t' &> query1.log"
+        cat query1.log
+        if nvrTestPackage opencryptoki '<' 3.14.0; then
+            rlAssertGrep "Model: IBM SoftTok" query1.log
+        else
+            rlAssertGrep "Model: Soft " query1.log
+        fi
+    rlPhaseEnd
+  fi
+
+    # initialize every token available
+    for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do
+
+        rlPhaseStartTest "initialize token #$SLOT"
+	    	rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'"
+	    	rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log"
+	    	cat query2.log
+	    	rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E
+        rlPhaseEnd
+
+    done
+
+  if [ "$LOCKDIR" == "/run/lock" ]; then
+    rlPhaseStartTest "checking there is no /var/lock in filelist"
+        rlRun "rpm -ql $(rpm -qa | grep opencryptoki | tr '\n' ' ') | grep /var/lock" 1
+    rlPhaseEnd
+  fi
+
+    rlPhaseStartTest "checking $LOCKDIR/opencryptoki selinux contexts"
+	    rlRun -s "restorecon -Rnv $LOCKDIR/opencryptoki"
+	    rlAssertNotGrep "restorecon reset" $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+	    rlFileRestore
+        rlRun "pkcsRestoreTokens"
+	    rlServiceRestore pkcsslotd
+        rlLog "Waiting 12 sec for systemd --user process to exit..."
+        sleep 12
+        rlRun "userdel -r $USER" || ps -ef
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/pkcsstats-basic-functionality/main.fmf

@@ -0,0 +1,33 @@
+summary: Tests basic functionality of the pkcsstats command
+description: |
+    Bug summary: openCryptoki: add crypto counters
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2043854
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2044180
+contact: Karel Srot <ksrot@redhat.com>
+component:
+  - opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - url: https://src.fedoraproject.org/tests/opencryptoki.git
+    name: /Library/token-manipulation
+recommend:
+  - opencryptoki
+  - opencryptoki-swtok
+  - expect
+duration: 5m
+enabled: true
+tag:
+  - CI-Tier-1
+  - Tier1
+tier: '1'
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2043854
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2044180
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+  - enabled: false
+    when: distro < rhel-8.7 or distro < rhel-9.1
+    because: feature has been introduced in 8.7 and 9.1
+extra-nitrate: TC#0613736

Sanity/pkcsstats-basic-functionality/runtest.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+[ -n "$SLOT" ] || SLOT=sw
+USER="user$RANDOM"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+	rlRun "useradd -m $USER -G pkcs11"
+        rlRun -s "su $USER -c 'id'"
+        rlFileBackup /etc/opencryptoki/opencryptoki.conf
+        rlServiceStop pkcsslotd
+        rlRun "pkcsResetTokens"
+        rlServiceStart pkcsslotd
+        sleep 1
+        rlRun "pkcsconf -t | grep 'Soft'"
+	SLOT=$( pkcsGetTokenSlot $SLOT )
+        rlRun "pkcsInitToken $SLOT"
+        rlRun "pkcsconf -t"
+	rlRun "pkcsstats -R"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Generate aes key as root and verify stats"
+        rlRun -s "pkcsstats -s $SLOT -U root"
+        rlAssertGrep "[no mechanisms were used]" $rlRun_LOG
+        rlRun "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED"
+        rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E
+        rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key"
+        rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN"
+        rlRun -s "pkcsstats -s $SLOT -U root"
+        rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E
+        rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Generate aes key as $USER and verify stats"
+        rlRun -s "pkcsstats -s $SLOT -U $USER" 0,1
+	rlAssertGrep "(no mechanisms were used|No statistics are available for user '$USER')" $rlRun_LOG -E
+        rlRun "su - $USER -c 'sleep 3 && p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'"
+        rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN"
+        rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E
+        rlRun -s "pkcsstats -s $SLOT -U $USER"
+        rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Print acummulated stats for all users"
+        rlRun -s "pkcsstats -s $SLOT -S"
+        rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *2 *0 *0" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Print --all-mechs stats for $USER"
+        rlRun -s "pkcsstats -s $SLOT --all-mechs -U $USER"
+        rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E
+        rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Reset stats for $USER"
+        rlRun -s "pkcsstats -r -U $USER"
+        rlRun -s "pkcsstats -s $SLOT -U $USER"
+	rlAssertGrep "no mechanisms were used" $rlRun_LOG
+        rlRun -s "pkcsstats -s $SLOT -U $USER -a"
+        rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Delete stats for $USER"
+        rlRun -s "pkcsstats -d -U $USER"
+        rlRun -s "pkcsstats -s $SLOT -U $USER -a" 1
+        rlAssertGrep "No statistics are available for user '$USER'" $rlRun_LOG -E
+    rlPhaseEnd
+
+    rlPhaseStartTest "Print user stats in JSON"
+        rlRun -s "pkcsstats -s $SLOT -j"
+        rlAssertGrep '"user": "root",' $rlRun_LOG
+        rlAssertGrep '"mechanism": "CKM_AES_KEY_GEN",' $rlRun_LOG
+        rlAssertGrep '"strength-128": 1,' $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartTest "Print help"
+        rlRun -s "pkcsstats -h"
+        rlAssertGrep "Usage: pkcsstats \[OPTIONS\]" $rlRun_LOG
+    rlPhaseEnd
+ 
+    rlPhaseStartCleanup
+        rlServiceStop pkcsslotd
+        rlRun "pkcsRestoreTokens"
+        rlFileRestore
+        rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlLog "Waiting 12 for systemd --user process to exit..."
+        sleep 15
+        rlRun "userdel -r $USER" || ps -ef
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf

@@ -0,0 +1,32 @@
+summary: Tests if signing certificate via opencryptoki module in NSS works
+description:
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- expect
+- nss-tools
+- rng-utils
+duration: 20m
+enabled: true
+tag:
+- CI-Tier-1
+- TIPpass_Security
+- Tier2
+- Tier2security
+tier: '2'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=654088
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1056036
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1059176
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600434
+extra-nitrate: TC#0102977
+extra-summary: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS
+extra-task: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS

Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh

@@ -0,0 +1,149 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS
+#   Description: Tests if signing certificate via opencryptoki module in NSS works
+#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2011 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+PASS="redhat"
+PASSTOKEN="01234567"
+PASSTOKEN2="87654321"
+SERVICE="pkcsslotd"
+[ -n "$SLOT" ] || SLOT=sw
+NSSDB_D="nssdb"
+PASSWORD_F="${NSSDB_D}/nsspassword"
+NSSDB_PREFIX="sql:"
+rlIsRHEL 3 4 5 && NSSDB_PREFIX=""
+M=0
+CACERT_NAME="cacert"
+USERCERT_NAME="mycert"
+USERCERT_REQ_F="${USERCERT_NAME}.req"
+USERCERT_DER_F="${USERCERT_NAME}.der"
+USERCERT_PEM_F="${USERCERT_NAME}.pem"
+LOG_F="${PACKAGE}.log"
+CONF_F="/usr/share/p11-kit/modules/opencryptoki.module"
+LIB_F=$( rpm -ql opencryptoki-libs | grep pkcs11/libopencryptoki.so | head -1 )
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlAssertRpm $PACKAGE
+        rlFileBackup /etc/opencryptoki/opencryptoki.conf
+        rlServiceStop $SERVICE
+        rlRun "pkcsResetTokens"
+        rlServiceStart $SERVICE
+        sleep 1
+        rlRun "pkcsconf -t"
+        SLOT=$( pkcsGetTokenSlot $SLOT )
+        rlRun "pkcsInitToken $SLOT"
+        rlRun "pkcsconf -t"
+        # prepar entropy generator
+        pidof rngd || ENTROPY=true
+        $ENTROPY && rngd -r /dev/urandom
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+	rlRun "mkdir -p ${NSSDB_D}" 0
+        rlRun "echo '${PASS}' > ${PASSWORD_F}" 0
+        rlRun "certutil -N -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}"
+	M=`expr ${M} + 1`
+        rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -S -n ${CACERT_NAME} -s 'cn=CAcert' -x -t 'C,C,C' -m ${M} -v 120 -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" 0 "Generating CA certificate"
+        rlRun "certutil -L -d ${NSSDB_PREFIX}${NSSDB_D}" 0 "Certificate listing"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlLog "Adding opencryptoki as an external module to opencryptoki"
+
+        if rlIsRHEL '<8'; then
+            if [ -r /usr/lib64/opencryptoki/PKCS11_API.so ]; then
+                rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib64/opencryptoki/PKCS11_API.so"
+            else
+                rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib/opencryptoki/PKCS11_API.so"
+            fi
+            rlLog "Setting opencryptoki as the default module for all mechanisms"
+            rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -default opencryptoki -mechanisms RSA:DSA:DH:RC2:RC4:RC5:AES:CAMELLIA:DES:MD2:MD5:SHA1:SHA256:SHA512:SSL:TLS:RANDOM"
+            rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -list"
+	        export TOKPARAM=""
+	        export PINPARAM=""
+        else
+	        [ -f $CONF_F ] && rlFileBackup $CONF_F;
+	        echo $LIB_F
+	        rlRun "cat > $CONF_F <<EOF
+module: $LIB_F
+priority: 99
+EOF"
+	        rlRun -s "p11-kit list-modules"
+	        rlAssertGrep "softtok" $rlRun_LOG
+	        rlRun -s "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -list"
+	        rlAssertGrep "softtok" $rlRun_LOG
+	        echo $PASSTOKEN > pin
+	        export TOKPARAM="-h softtok"
+	        export PINPARAM="-f pin"
+        fi
+
+        rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -f ${PASSWORD_F} -R -s 'CN=John Smith, O=Netscape, L=Mountain View, ST=California, C=US' -p '650-555-8888' -o ${USERCERT_REQ_F} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} ${PINPARAM}" 0 "Generating user certificate"
+        rlAssertExists "${USERCERT_REQ_F}"
+	M=`expr ${M} + 1`
+        expect -c "
+spawn certutil -C -m ${M} -i ${USERCERT_REQ_F} -o ${USERCERT_PEM_F} -c ${CACERT_NAME} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM}
+expect {L13} {send -- $PASSTOKEN\r}
+expect {
+    {L13} {send -- \"$PASTOKEN2\r\"; exp_continue}
+    eof { exit 0 }
+}
+"
+        rlAssertExists "${USERCERT_PEM_F}"
+        [ "x$(stat -c '%s' ${USERCERT_PEM_F})" = "x0" ] && rlFail "${USERCERT_PEM_F} is empty" || rlPass "${USERCERT_DER_F} create OK"
+	M=`expr ${M} + 1`
+        expect -c "        
+spawn certutil -C -d ${NSSDB_PREFIX}${NSSDB_D} -c ${CACERT_NAME} -i ${USERCERT_REQ_F} -o ${USERCERT_DER_F} -m ${M} -v 48 -1 -f ${PASSWORD_F} -5 ${TOKPARAM}
+expect {L13} {send -- $PASSTOKEN\r}
+expect {
+    {L13} {send -- \"$PASSTOKEN2\"\r; exp_continue}
+    {>} {send -- 01234567\r}
+}
+expect {y/N} {send -- N\r}
+expect {>} {send -- 01234567\r}
+expect {y/N} {send -- N\r}
+expect eof
+"
+        rlAssertExists "${USERCERT_DER_F}"
+        [ "x$(stat -c '%s' ${USERCERT_DER_F})" = "x0" ] && rlFail "${USERCERT_DER_F} is empty" || rlPass "${USERCERT_DER_F} create OK"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $CONF_F"
+        rlServiceStop $SERVICE
+        rlRun "pkcsRestoreTokens"
+        rlFileRestore
+        $ENTROPY && killall rngd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlServiceRestore $SERVICE
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/testsuite/main.fmf

@@ -0,0 +1,38 @@
+summary: Executes testsuite shipped with opencryptoki
+description: |
+   it seems it should work with softoken on all architectures
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+- library(nvr/nvr)
+recommend:
+- opencryptoki
+- gcc
+- yum-utils
+- rpm-build
+- opencryptoki-swtok
+- opencryptoki-ccatok
+- opencryptoki-icatok
+duration: 100m
+enabled: true
+tag:
+- TIPfail_Security
+- noExpectedness
+# test duration is big for tiers
+- notier
+- rhel8-buildroot
+- rhel9-buildroot
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=644284
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099175
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=904937
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=650482
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099193
+extra-nitrate: TC#0063178
+extra-summary: /CoreOS/openCryptoki/Sanity/testsuite
+extra-task: /CoreOS/openCryptoki/Sanity/testsuite

Sanity/testsuite/runtest.sh

@@ -0,0 +1,237 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Sanity/testsuite
+#   Description: Executes testsuite shipped with openCryptoki
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+# At the moment of creation of this test a lot of upstream tests
+# were not fully functional. Please check README documents and 
+# try enable additional tests if possible
+# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+# find out package name
+PACKAGE="opencryptoki"
+
+LOGDIR=`mktemp -d`
+[ -z "$SLOT" ] && SLOT=sw
+
+function reset_tokens() {
+    rlLogInfo "Reseting tokens..."
+    rlServiceStop pkcsslotd
+    rlRun "pkcsResetTokens randomNamespace"  # using different namespace not to overwrite previous backup
+    rlServiceStart pkcsslotd
+    rlLogInfo "Initializing tokens..."
+    rlRun "pkcsInitToken $SLOT"
+}
+
+function get_test_id() {
+    ID=`cat $TmpDir/testid`
+    ID=$(( $ID+1 ))
+    echo $ID > $TmpDir/testid
+    echo $ID
+}
+
+rlJournalStart
+    rlPhaseStartSetup 
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library"
+        export PKCS11_USER_PIN=$pkcsUSER_PIN
+        export PKCS11_SO_PIN=$pkcsSO_PIN
+        rlAssertRpm $PACKAGE
+        TmpDir=`mktemp -d`
+        pushd $TmpDir
+        rlFetchSrcForInstalled $PACKAGE
+        rlRun "rpm -ivh $PACKAGE*.src.rpm" 0 "Installing $PACKAGE src rpm"
+        rlRun "yum-builddep -y ~/rpmbuild/SPECS/opencryptoki.spec"
+        # opencryptoki needs to enable building test cases during the pkg build
+        rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec"
+        rlRun "rpmbuild -bc ~/rpmbuild/SPECS/opencryptoki.spec &> build.log" 0 "Building opencryptoki files"
+        tail build.log
+        TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases`
+
+        rlServiceStop pkcsslotd
+        sleep 3
+        rlRun "pkcsResetTokens"
+
+        rlServiceStart pkcsslotd
+        rlLogInfo "Available tokens"
+        pkcsconf -t
+        # allow to pass SLOT number as a parameter
+        # or take the first available slot (Token)
+        SLOT=$( pkcsGetTokenSlot $SLOT )
+        rlLogInfo "Token under a test"
+        pkcsconf -t -c $SLOT
+
+        NOSKIP=""
+        # !!!!!!!!!!!!!!!!!!!!!!!
+        # tests doings writes are not skipped only for a softoken because they could descrease flash memory
+        # lifetime on real tokens
+        pkcsconf -t -c $SLOT | grep -qi 'soft' && NOSKIP="-noskip"
+    rlPhaseEnd 
+
+    echo 0 > $TmpDir/testid
+
+    rlPhaseStartTest "crypto"
+        reset_tokens
+        if [ -d $TESTDIR/crypto ]; then
+            export PKCS11_USER_PIN=01234567
+            export PKCS11_SO_PIN=76543210
+            pushd $TESTDIR/crypto
+
+            RUN_SEPARATELY="ab_tests"  # do not report results the usual way
+
+            for TEST in *_tests; do
+                # skip test if it is on TODO list in README
+                if grep -A 1 $TEST README | grep -q TODO; then
+                    rlLogWarning "Skipping $TEST since it is on TODO list in README"
+                elif echo $RUN_SEPARATELY | grep -q $TEST; then
+                    ID=`get_test_id`
+                    rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID"
+                    [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+                else
+                    ID=`get_test_id`
+                    rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID"
+                    RESULT=$?
+                    grep Total $TmpDir/testlog.$ID
+                    rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID
+                    rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID
+                    # print log in case of error
+                    [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID
+                fi
+            done
+            popd
+        else
+            rlFail "No crypto tests available!"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartTest "misc_tests"
+	if [ -d $TESTDIR/misc_tests ]; then
+            reset_tokens
+            pushd $TESTDIR/misc_tests
+
+            # obj_mgmt_tests
+            ID=`get_test_id`
+            rlRun "./obj_mgmt_tests $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID"
+            [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+
+            #spinlock_tests.sh
+            ID=`get_test_id`
+            rlRun "./spinlock_tests.sh -s 1 -p 10 -l 20 &> $TmpDir/testlog.$ID"
+            [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+
+            #fork
+            ID=`get_test_id`
+            rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID"
+            [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+            rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID
+            rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID
+
+            # events - added in 3.16.0-3.el9
+            if nvrTestPackage opencryptoki '>=' 3.16.0; then
+                ID=`get_test_id`
+                rlRun "./events -slot $SLOT &> $TmpDir/testlog.$ID"
+                [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+                rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID
+               rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID
+            fi
+
+            #  p11sak_test.sh added in 3.17.0
+            if nvrTestPackage opencryptoki '>=' 3.17.0; then
+                ID=`get_test_id`
+                rlRun "SLOT=$SLOT ./p11sak_test.sh &> $TmpDir/testlog.$ID"
+                [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+                rlAssertNotGrep 'TESTCASE.*FAIL' $TmpDir/testlog.$ID -E
+            fi
+
+	    popd
+	else
+	    rlFail "No misc_tests test available!"
+	fi
+    rlPhaseEnd
+
+    rlPhaseStartTest "pkcs11"
+        if [ -d $TESTDIR/pkcs11 ]; then
+            reset_tokens
+            pushd $TESTDIR/pkcs11
+            for TEST in get_interface attribute copyobjects findobjects generate_keypair; do
+                ID=`get_test_id`
+                rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID"
+                RESULT=$?
+                grep Total $TmpDir/testlog.$ID
+                rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID
+                rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID
+                # print log in case of error
+                [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID
+            done
+
+            # now run additional tests with specific output
+
+            #sess_opstate
+            # skip if using swtok since the test is being skipped with
+            # TESTCASE sess_opstate_funcs SKIP Get/SetOperationState digest test: state unsavable
+            ID=`get_test_id`
+            if [ "$SLOT" != "3" ]; then
+                rlRun "./sess_opstate -slot $SLOT &> $TmpDir/testlog.$ID"
+                [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+                rlAssertGrep "TESTCASE sess_opstate_funcs PASS" $TmpDir/testlog.$ID
+            fi
+
+            #getobjectsize
+            ID=`get_test_id`
+            rlRun "./getobjectsize -slot $SLOT &> $TmpDir/testlog.$ID"
+            [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+            rlAssertGrep "C_GetObjectSize test passed" $TmpDir/testlog.$ID
+
+            #hw_fn
+            ID=`get_test_id`
+            rlRun "./hw_fn -slot $SLOT &> $TmpDir/testlog.$ID"
+            [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID   # print log in case of error
+            rlAssertGrep "(Hardware Feature tests succeeded.|do_HW_Feature_Search passed)" $TmpDir/testlog.$ID -E
+
+            popd
+
+        else
+            rlFail "No pkcs11_tests test available!"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlBundleLogs testlogs $TmpDir/testlog* build.log
+        #rlRun "rpmbuild --clean -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Clean the BUILD root"
+        rlRun "rm -rf $TmpDir"
+        [ -d $TESTDIR ] && rlRun "rm -rf $TESTDIR"
+        rlFileRestore
+        rlRun "pkcsRestoreTokens"
+        rlServiceRestore pkcsslotd
+    rlPhaseEnd
+
+rlJournalPrintText
+rlJournalEnd

Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf

@@ -0,0 +1,31 @@
+summary: tools should inform user about pkcs11 group
+description: |
+    Bug summary: RFE opencryptoki tools should inform the user that he is not in pkcs11 group
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1063763
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+- opencryptoki
+duration: 5m
+enabled: true
+tag:
+- NoRHEL4
+- NoRHEL5
+- NoRHEL6
+- TIPpass_Security
+- Tier2
+- Tier2security
+tier: '2'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063763
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697494
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+extra-nitrate: TC#0598649
+extra-summary: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that
+extra-task: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that

Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that
+#   Description: Test for BZ#1063763 (RFE opencryptoki tools should inform the user that)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlServiceStart pkcsslotd
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "useradd -m bz1063763user"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun -s "su - bz1063763user -c 'pkcsconf -t'" 144,6
+        rlAssertGrep "Error initializing the PKCS11 library" $rlRun_LOG
+        rlAssertGrep "Note: all non-root users that require access to PKCS#11 tokens using opencryptoki must be assigned to the pkcs11 group to be able to communicate with the pkcsslotd daemon." $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+		rlLog "Waiting 12 sec for systemd --user process to exit..." && sleep 12
+        rlRun "userdel -r bz1063763user" 0
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlServiceRestore pkcsslotd
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Sanity/verify-all-HW-tokens-are-available/main.fmf

@@ -0,0 +1,30 @@
+summary: Verify that all tokens are available
+description: |
+    Verify on s390x system that ICA and SWTPM tokens are available
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- opencryptoki-icatok
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- Tier1
+tier: '1'
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+-   enabled: false
+    when: arch != s390x
+    continue: false
+
+extra-nitrate: TC#577597
+extra-summary: Verify that all tokens are available
+extra-hardware: hostrequire = <system><hypervisor op="==" value=""/></system>

Sanity/verify-all-HW-tokens-are-available/runtest.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+TESTDIR=`pwd`
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+		rlServiceStart pkcsslotd
+    rlPhaseEnd
+
+    rlPhaseStartTest "listing available tokens"
+        rlRun -s "pkcsconf -t"
+        rlAssertGrep "Model: ICA" $rlRun_LOG
+        rlAssertGrep "Model: Soft" $rlRun_LOG
+        rpm -q ep11-host &>/dev/null && rlAssertGrep "Model: EP11" $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlServiceRestore pkcsslotd
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

Update/dnf-update-opencryptoki/main.fmf

@@ -0,0 +1,8 @@
+summary: Update opencryptoki package with dnf
+contact: Karel Srot <ksrot@redhat.com>
+tag:
+  - setup
+framework: shell
+duration: 10m
+enabled: true
+test: "dnf -y update 'opencryptoki*'"

Update/initialized-ica-token/main.fmf

@@ -0,0 +1,30 @@
+summary: initialize ICA token and test it still works after an update
+description: ''
+contact: Karel Srot <ksrot@redhat.com>
+component:
+  - opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - url: https://src.fedoraproject.org/tests/opencryptoki
+    name: /Library/token-manipulation
+recommend:
+  - opencryptoki
+  - opencryptoki-icatok
+  - libica
+  - gnutls-utils
+  - opensc
+  - expect
+duration: 5m
+
+/all:
+  environment:
+    PHASES: all
+
+/setup:
+  environment:
+    PHASES: "setup,test"
+
+/test:
+  environment:
+    PHASES: test

Update/initialized-ica-token/runtest.sh

@@ -0,0 +1,122 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-ica-token
+#   Description: initialize ICA token and test it still works after an update
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+function phaseSetup() {
+  rlPhaseStartTest
+    rlFileBackup /etc/opencryptoki/opencryptoki.conf
+    rlServiceStop pkcsslotd
+    rlRun "pkcsResetTokens"
+    rlRun "systemctl enable pkcsslotd"
+    rlServiceStart pkcsslotd
+    sleep 1
+    rlRun "pkcsconf -t"
+    SLOT=$( pkcsGetTokenSlot ica )
+    rlRun "pkcsInitToken $SLOT"
+    rlRun "pkcsconf -t"
+    if rlIsRHEL '<8'; then
+        rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa  --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub"
+    else
+        rlRun "p11tool --generate-rsa  --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub"
+    fi
+    rlAssertExists id_rsa.pub
+    rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects"
+    rlAssertGrep "Public Key Object" $rlRun_LOG
+    rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+  rlPhaseEnd
+}
+
+
+function phaseTest() {
+  rlPhaseStartTest
+    SLOT=$( pkcsGetTokenSlot ica )
+    rlRun "pkcsconf -t"
+    rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key"
+    rlAssertGrep "Public Key Object" $rlRun_LOG
+    rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+    rlLog "Exporting stored RSA key"
+    rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der"
+    rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format"
+    rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key"
+  rlPhaseEnd
+}
+
+
+function phaseCleanup() {
+  rlPhaseStartCleanup
+    rlServiceStop pkcsslotd
+    rlRun "pkcsRestoreTokens"
+    rlFileRestore
+    rlServiceRestore pkcsslotd
+    rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+  rlPhaseEnd
+}
+
+
+rlJournalStart
+
+    rlPhaseStartSetup "init"
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files"
+        [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        if rlIsRHEL '<8'; then
+            rlRun "TokenSpec='model=IBM%20ICA'"
+        else
+            rlRun "TokenSpec='model=ICA;manufacturer=IBM'"
+        fi
+    rlPhaseEnd
+
+    # clear $PHASES if IN_PLACE_UPGRADE is specified
+    [ -n "$IN_PLACE_UPGRADE" ] && PHASES=""
+    echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE
+    echo PHASES=$PHASES
+
+    # run setup, except when running post-upgrade phase
+    if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then
+        phaseSetup
+    fi
+
+    # run test by default
+    if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then
+        phaseTest
+    fi
+
+    popd
+    # run cleanup only when run as a standalone test
+    if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then
+        phaseCleanup
+    fi
+
+rlJournalPrintText
+rlJournalEnd

Update/initialized-sw-token/main.fmf

@@ -0,0 +1,29 @@
+summary: initialize sw token and test it still works after an update
+description: ''
+contact: Karel Srot <ksrot@redhat.com>
+component:
+  - opencryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+  - url: https://src.fedoraproject.org/tests/opencryptoki
+    name: /Library/token-manipulation
+recommend:
+  - opencryptoki
+  - opencryptoki-swtok
+  - gnutls-utils
+  - opensc
+  - expect
+duration: 5m
+
+/all:
+  environment:
+    PHASES: all
+
+/setup:
+  environment:
+    PHASES: "setup,test"
+
+/test:
+  environment:
+    PHASES: test

Update/initialized-sw-token/runtest.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-sw-token
+#   Description: initialize sw token and test it still works after an update
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+function phaseSetup() {
+  rlPhaseStartSetup
+    rlFileBackup /etc/opencryptoki/opencryptoki.conf
+    rlServiceStop pkcsslotd
+    rlRun "pkcsResetTokens"
+    rlRun "systemctl enable pkcsslotd"
+    rlServiceStart pkcsslotd
+    sleep 1
+    rlRun "pkcsconf -t | grep 'Soft'"
+    SLOT=$( pkcsGetTokenSlot sw )
+    rlRun "pkcsInitToken $SLOT"
+    rlRun "pkcsconf -t"
+    if rlIsRHEL '<8'; then
+        rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa  --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub"
+    else
+        rlRun "p11tool --generate-rsa  --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub"
+    fi
+    rlAssertExists id_rsa.pub
+    rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects"
+    rlAssertGrep "Public Key Object" $rlRun_LOG
+    rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+  rlPhaseEnd
+}
+
+
+function phaseTest() {
+  rlPhaseStartTest
+    SLOT=$( pkcsGetTokenSlot sw )
+    rlRun "pkcsconf -t"
+    rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key"
+    rlAssertGrep "Public Key Object" $rlRun_LOG
+    rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+    rlLog "Exporting stored RSA key"
+    rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der"
+    rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format"
+    rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key"
+    rlRun "popd"
+  rlPhaseEnd
+}
+
+
+function phaseCleanup() {
+  rlPhaseStartCleanup
+    rlServiceStop pkcsslotd
+    rlRun "pkcsRestoreTokens"
+    rlFileRestore
+    rlServiceRestore pkcsslotd
+    rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+  rlPhaseEnd
+}
+
+
+rlJournalStart
+
+    rlPhaseStartSetup "init"
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files"
+        [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        if rlIsRHEL '<8'; then
+            rlRun "TokenSpec='model=IBM%20SoftTok'"
+        else
+            rlRun "TokenSpec='model=Soft;manufacturer=IBM'"
+        fi
+    rlPhaseEnd
+
+    # clear $PHASES if IN_PLACE_UPGRADE is specified
+    [ -n "$IN_PLACE_UPGRADE" ] && PHASES=""
+    echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE
+    echo PHASES=$PHASES
+
+    # run setup, except when running post-upgrade phase
+    if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then
+        phaseSetup
+    fi
+
+    # run test by default
+    if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then
+        phaseTest
+    fi
+
+    popd
+    # run cleanup only when run as a standalone test
+    if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then
+        phaseCleanup
+    fi
+
+rlJournalPrintText
+rlJournalEnd

main.fmf

@@ -0,0 +1,2 @@
+environment:
+  GIT_SSL_NO_VERIFY: "true"

plans/opencryptoki-tests-fedora-ci.fmf

@@ -0,0 +1,11 @@
+summary:
+  Run modified tests using Fedora CI
+discover:
+  how: fmf
+#  modified-only: True
+#  modified-url: https://src.fedoraproject.org/tests/opencryptoki.git
+#  modified-ref: reference/main
+#  filter:
+#   - tag: CI-Tier-1
+execute:
+    how: tmt

plans/regression.fmf

@@ -0,0 +1,10 @@
+summary: Runs all tests
+
+discover:
+    how: fmf
+    test:
+     - /Sanity/*
+     - /Regression/*
+
+execute:
+    how: tmt

setup/reboot/main.fmf

@@ -0,0 +1,6 @@
+summary: reboot test system
+description: ''
+contact: Karel Srot <ksrot@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+duration: 15m

setup/reboot/runtest.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: reboot test system
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2025 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+COOKIE=/var/tmp/opencryptoki-setup-system-rebooted
+
+rlJournalStart
+
+  if [ ! -e $COOKIE ]; then
+    rlPhaseStartSetup "pre-reboot phase"
+        rlRun "uname -a"
+        rlRun "cat /proc/cmdline"
+        rlRun "touch $COOKIE"
+        rlLogInfo "going to reboot now..."
+    rlPhaseEnd
+    rhts-reboot
+  else
+    rlPhaseStartTest "post-reboot phase"
+        rlRun "uname -a"
+        rlRun "cat /proc/cmdline"
+        rlRun "uptime"
+        rlRun "rm -f $COOKIE"
+    rlPhaseEnd
+  fi
+
+rlJournalPrintText
+rlJournalEnd