Signature configuration not working any more. What should I update?

[Fernando-Cabral]

Using pyhanko version 0.15.0 the following command line worked perfectly:

pyhanko --verbose --config pyhanko.yml sign addsig --field "1/277,55,407,140/F" --style-name mystile pkcs11 --lib /usr/lib/libaetpkss.so --p11-setup test-setup --token-label "Token NAME" --key-label "" --cert-label "MY LABEL ON TOKEN:123456789012" input.pdf signed.pdf
Now, trying to use pyhanko version 0.20.0 no options (like --lib, --style-name) is accepted. I've checked the documentation but thou it says those parameters will not be accepted on the command line, the examples it brings are compatible with the line I was using.

On the other other hand, there is a line in the manual that says those things should go into the configuration (yml) file, but I could not find how to do it.

Any hints will be much appreciated.

EDIT:
The manual says that:

Using the --p11-setup argument to pkcs11 will cause pyHanko to ignore all other parameters to the pkcs11 subcommand. In other words, you have to put everything in the configuration.

Nevertheless, when I use the --p11-setup argument, I got the error message:

Usage: pyhanko sign addsig pkcs11 [OPTIONS]
Try 'pyhanko sign addsig pkcs11 --help' for help.

Error: No such option: --p11-setup

=== Is let it known that when I downgraded pyhanko to version 0.15.1 it started working again. So, most likely, it has to do with a intentional change in the way command line parameters are read. Nevertheless, I have not been able to figure that out from the documentation (the last version at readthedocs).

• fernando

[MatthiasValvekens]

Hi @Fernando-Cabral,

Are you sure you have installed pyHanko with the [pkcs11] option? Unfortunately the way optional dependencies are implemented in the CLI is a bit clunky, and your error is constistent with what would happen if python-pkcs11 is not importable.

I should try to come up with a more user-friendly way to get Click to identify the pkcs11 command as something only exposed if optional deps are available.

[Fernando-Cabral]

@matthias, unfortunately I am completely confused. After installing and uninstalling different versions, the newest (0.20.1) started working with the same configuration as the old one. Unfortunately, I have not been able to identify what the problem was. Anyway, the good news is that the newest version is working as before.

But there is still something I do not understand: I tried to replicate the installation in another new machine. This time the trick of installing/removing different versions till it worked did not work!

Just in case you want to take a look in the new error messages:

  2023-08-28 22:55:05,888 - PIL.PngImagePlugin - DEBUG - STREAM b'IDAT' 8449 8192
2023-08-28 22:55:05,993 - cli - ERROR - Error raised while producing signed file: PKCS#11 error: [FunctionFailed] 
Traceback (most recent call last):
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/sign/pkcs11.py", line 744, in __enter__
    return self._instantiate()
           ^^^^^^^^^^^^^^^^^^^
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/sign/pkcs11.py", line 722, in _instantiate
    self._session = session = open_pkcs11_session(
                              ^^^^^^^^^^^^^^^^^^^^
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/sign/pkcs11.py", line 366, in open_pkcs11_session
    slots = lib.get_slots()
            ^^^^^^^^^^^^^^^
  File "pkcs11/_pkcs11.pyx", line 1470, in pkcs11._pkcs11.lib.get_slots
  File "pkcs11/_errors.pyx", line 88, in pkcs11._pkcs11.assertRV
pkcs11.exceptions.FunctionFailed

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/cli/runtime.py", line 50, in pyhanko_exception_manager
    yield
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/cli/commands/signing/plugin.py", line 132, in _callback
    _callback_logic(plugin, infile, outfile, **kwargs)
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/cli/commands/signing/plugin.py", line 70, in _callback_logic
    with plugin.create_signer(cli_ctx, **kwargs) as signer:
  File "/home/fernando/anaconda3/lib/python3.11/site-packages/pyhanko/sign/pkcs11.py", line 746, in __enter__
    raise SigningError(
pyhanko.sign.general.SigningError: PKCS#11 error: [FunctionFailed] 
Error: Error raised while producing signed file: PKCS#11 error: [FunctionFailed]

The token is the same as in the other machine and the environment is supposed to be exactly the same (Debian 12 recently installed with the same packages)...

[Fernando-Cabral]

Sorry, @matthias, as soon as I posted the above answer I found the problem: pcscd and libccid, for some reason, were not running. So, it was entirely my fault.

So, now version 0.20.0 is working in both machines.

Thank you for your kind attention.