Introduce backend-agnostic provider configuration and provider manager factory

[ChansAlive]

This PR decouples the crypto daemon's provider layer from any specific cryptographic backend.

Previously, daemon manually wired OpenSSL and SoftHSM factories step by step, provider names were hardcoded, and a single factory failure aborted the entire startup. There was no stable seam between which backends are compiled in and how providers are registered and routed at runtime.

Key changes:

• Introduced a backend abstraction layer (score/crypto/src/backend/) that contains all backend-specific knowledge — how to construct an OpenSSL provider, what default SoftHSM token entries look like, which backends are compiled in. The provider framework itself no longer imports any backend headers.
• Introduced ProviderManagerFactory that replaces the multi-step factory wiring in daemon.cpp with a single Create(config) call, owning the full sequencing: parse config → create factories for enabled backends → register providers → initialize routing tables.
• Made provider startup resilient: factory results now carry per-provider failure details instead of a single bool, so a single unavailable token no longer blocks all other providers from registering.
• Added documentation for the backend configuration model and updated the component overview and provider architecture diagrams.

Out of scope:
Test reuse across providers.

Build impact:
Backends selected via compile-time flags; existing OpenSSL and SoftHSM defaults are preserved.

closes #94

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: 4d1ec739-2190-4018-9883-17ff4f4ccbcb
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 9.349s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

[github-actions]

The created documentation from the pull request is available at: docu-html

[schreibwsag]

I just checked whether I could integrate the NXP pkcs11-hse module using the mechanism
you implemented (backend_config.bzl/backend_exports.bzl). All was working as described.

[ShoroukRamzy]

Hi @ChansAlive, Thank you for the great PR. I would like to revisit the decision we took today with @sunildevda and @schreibwsag regarding the merge of Cryptoki PR first https://github.com/eclipse-score/inc_security_crypto/pull/49/changes#diff-d1c061eac386f8ea2f48819d2f3a6ba46b3d17d9ac16176816beaf2fbea1c681. Sorry for the confusion, in the meeting I was thinking this is a proposal PR for the architecture improvement not a ready implementation. In this case, I think merging this PR first then adapting cryptoki PR accordingly will be more convenient and will allow me to handle the cryptoki integration the correct way based on this current implementation. So those will be two steps. otherwise, I think this PR will need to handle the cryptoki integration as well to resolve some expected conflicts. What do you think @ChansAlive, @sunildevda and @schreibwsag?
Thanks!

[ChansAlive]

@schreibwsag @ShoroukRamzy @masc2023:

We have completed the review.
Kindly have a final look and approve.

cc: @OliverHeilwagen @sunildevda

[Copilot]

Pull request overview

This PR refactors the crypto daemon’s provider wiring to be backend-agnostic and build/runtime configurable by introducing a backend abstraction layer and a single ProviderManagerFactory::Create(config) bootstrap path. It also updates Bazel third-party build targets (OpenSSL/SoftHSM) and integration test packaging to align with shared-library/runfiles usage.

Changes:

• Added backend selection/config infrastructure under score/crypto/src/backend/ (bool/label flags, active backend discovery, default config parsers) and updated provider factories to be backend-driven.
• Introduced ProviderManagerFactory to replace manual factory wiring in daemon.cpp, and updated ProviderManager/IProvider APIs to support lazy initialization + structured per-provider failure reporting.
• Updated OpenSSL/SoftHSM Bazel targets and integration tests to consume extracted .so files via runfiles-friendly filegroups.

Reviewed changes

Copilot reviewed 84 out of 89 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
third_party/soft_hsm/BUILD	Switch SoftHSM to public softhsm_shared + runfiles softhsm_so extraction; restrict cmake target visibility.
third_party/openssl/BUILD	Build OpenSSL as shared libs; provide openssl_shared for linking and openssl_so for runfiles.
score/tests/integration_tests/integration_test.py	Update container file mapping to copy OpenSSL + SoftHSM .so files from new runfiles locations.
score/tests/integration_tests/init_softhsm_token.cpp	Remove direct cryptoki.h include; rely on pkcs11.h.
score/tests/integration_tests/BUILD	Update deps/data to use openssl_so and softhsm_so, and rename SoftHSM cc_library target.
score/tests/demo/mac_multi_provider_demo.cpp	Update demo provider naming/config usage and ProviderManager construction.
score/tests/demo/BUILD	Update OpenSSL dependency to :openssl_shared.
score/crypto/tests/softhsm/BUILD	Update SoftHSM dependency to :softhsm_shared.
score/crypto/tests/softhsm/block_cipher/ECB-AES128/BUILD	Update SoftHSM dependency to :softhsm_shared.
score/crypto/tests/openssl/block_cipher/ECB-AES128/BUILD	Update OpenSSL dependency to :openssl_shared.
score/crypto/tests/key_management/test_access_policy_enforcer.cpp	Replace provider-name constant usage with string "OPENSSL".
score/crypto/tests/key_management/BUILD	Update OpenSSL/SoftHSM deps to new targets.
score/crypto/src/daemon/src/daemon.cpp	Replace manual provider wiring with ProviderManagerFactory::Create(config).
score/crypto/src/daemon/provider/tests/provider_test/test_provider.cpp	Add new provider hash tests gated by OpenSSL backend being active.
score/crypto/src/daemon/provider/tests/provider_test/test_pkcs11_provider.cpp	Add PKCS#11 provider hash tests gated by PKCS#11 backend enablement.
score/crypto/src/daemon/provider/tests/provider_test/test_pkcs11_multi_token.cpp	Add multi-token PKCS#11 coexistence tests.
score/crypto/src/daemon/provider/tests/provider_test/BUILD	Gate tests by backend flags; wire selected PKCS#11 backend; remove old manager test target.
score/crypto/src/daemon/provider/src/provider_manager.cpp	Refactor ProviderManager to policy-by-name, lazy init, structured failure recording, and type mapping build.
score/crypto/src/daemon/provider/src/provider_manager_test.cpp	Update tests for new ProviderManager ctor/config and init-state tracking.
score/crypto/src/daemon/provider/src/provider_manager_factory.cpp	New factory to parse config, create backend factories, register providers, validate required providers, initialize manager.
score/crypto/src/daemon/provider/score_provider/src/score_provider.cpp	Add backend init hook and IsInitialized() state tracking.
score/crypto/src/daemon/provider/score_provider/src/score_provider_factory.cpp	Switch Score provider creation to backend adapter discovery + config snapshot + structured results.
score/crypto/src/daemon/provider/score_provider/src/score_provider_config.cpp	Rework config to snapshot model (GetConfig) and out-of-line mutation.
score/crypto/src/daemon/provider/score_provider/score_provider.hpp	Make Initialize final; add IsInitialized; add backend init hook.
score/crypto/src/daemon/provider/score_provider/score_provider_factory.hpp	Update factory interface to return ProviderFactoryResult and accept config snapshot.
score/crypto/src/daemon/provider/score_provider/score_provider_config.hpp	Add ScoreProviderFactoryConfig, providerType, and ParseConfig API.
score/crypto/src/daemon/provider/score_provider/score_backend_adapter.hpp	New score-provider backend adapter interface and provider-creator metadata.
score/crypto/src/daemon/provider/score_provider/operations/mac/BUILD	Gate score-provider MAC operations by backend enablement.
score/crypto/src/daemon/provider/score_provider/operations/key_management/BUILD	Gate score-provider key management operations by backend enablement.
score/crypto/src/daemon/provider/score_provider/operations/hash/BUILD	Gate score-provider hash operations by backend enablement.
score/crypto/src/daemon/provider/score_provider/operations/factory/BUILD	Gate score-provider handler factory by backend enablement.
score/crypto/src/daemon/provider/score_provider/openssl/provider_openssl.hpp	Move OpenSSL init to InitialiseBackend hook; adjust inheritance visibility.
score/crypto/src/daemon/provider/score_provider/openssl/provider_openssl.cpp	Move OpenSSL initialization into backend hook; use GetProviderId() for key factory.
score/crypto/src/daemon/provider/score_provider/openssl/operations/mac/openssl_hmac_handler.cpp	Minor whitespace cleanup.
score/crypto/src/daemon/provider/score_provider/openssl/key_management/openssl_key_handler.cpp	Adjust key export to assign into SecureKeyBytes; remove unused include.
score/crypto/src/daemon/provider/score_provider/openssl/BUILD	Gate OpenSSL provider targets; update deps to :openssl_shared; remove OpenSSL provider factory target.
score/crypto/src/daemon/provider/score_provider/BUILD	Add backend adapter target; wire backend selection into factory; gate by backend enablement.
score/crypto/src/daemon/provider/provider_manager.hpp	Update ProviderManager API to policy snapshot + lazy init + failure tracking.
score/crypto/src/daemon/provider/provider_manager_factory.hpp	New ProviderManagerFactory public API and documentation.
score/crypto/src/daemon/provider/pkcs11/src/pkcs11_token_config.cpp	New out-of-line token config methods for snapshot model.
score/crypto/src/daemon/provider/pkcs11/src/pkcs11_provider.cpp	New/relocated PKCS#11 provider implementation under src/ with lazy handler factory/key store.
score/crypto/src/daemon/provider/pkcs11/src/pkcs11_provider_factory.cpp	New PKCS#11 provider factory using snapshot config + shared module and structured results.
score/crypto/src/daemon/provider/pkcs11/src/pkcs11_module.cpp	Make ModuleGuard finalize via function list; pass function list into Initialize.
score/crypto/src/daemon/provider/pkcs11/pkcs11_token_config.hpp	Add snapshot config + ParseConfig API; include providerType.
score/crypto/src/daemon/provider/pkcs11/pkcs11_provider.hpp	Remove cryptoki.h include; add IsInitialized() implementation.
score/crypto/src/daemon/provider/pkcs11/pkcs11_provider_factory.hpp	Switch to snapshot config + structured results; keep PKCS#11 types out of header.
score/crypto/src/daemon/provider/pkcs11/pkcs11_module.hpp	Remove cryptoki.h include; track providerType; pass function list into ModuleGuard.
score/crypto/src/daemon/provider/pkcs11/operations/mac/pkcs11_mac_handler.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/operations/key_management/pkcs11_key_management_handler.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/operations/hash/pkcs11_hash_handler.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/operations/hash/pkcs11_hash_context.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp	Remove cryptoki.h include; adjust comment wording.
score/crypto/src/daemon/provider/pkcs11/detail/pkcs11_algorithm_info.hpp	Remove cryptoki.h include.
score/crypto/src/daemon/provider/pkcs11/BUILD	Gate PKCS#11 targets; move sources under src/; depend on selected backend.
score/crypto/src/daemon/provider/i_provider.hpp	Add IsInitialized() to provider interface.
score/crypto/src/daemon/provider/i_provider_factory.hpp	Add structured factory result/failure types; change interface to return ProviderFactoryResult.
score/crypto/src/daemon/provider/BUILD	Add provider_manager_factory library and new provider manager unit test target.
score/crypto/src/daemon/mediator/src/mediator_impl.cpp	Minor formatting/logging adjustment for selection log line.
score/crypto/src/daemon/key_management/core/key_management_service.cpp	Reorder member initialization to match declaration order.
score/crypto/src/daemon/config/src/config.cpp	Minor include order change; log config path via string_view.
score/crypto/src/daemon/config/inc/config.hpp	Change ProviderInitConfig mapping to provider-name based; add required field.
score/crypto/src/daemon/common/types.hpp	Remove hardcoded provider-name constants; add CryptoProviderTypeFromString.
score/crypto/src/daemon/BUILD	Remove OpenSSL dynamic dep; switch to provider_manager_factory; broaden visibility.
score/crypto/src/backend/score_provider/score_provider_config_parser.cpp	Default Score provider config parser to discover compile-time active backends.
score/crypto/src/backend/score_provider/openssl/openssl_backend_adapter.hpp	New OpenSSL backend adapter declaration.
score/crypto/src/backend/score_provider/openssl/openssl_backend_adapter.cpp	New OpenSSL backend adapter implementation creating OpenSSL provider.
score/crypto/src/backend/score_provider/openssl/BUILD	New backend BUILD targets (adapter/define/aggregate) for OpenSSL.
score/crypto/src/backend/score_provider/BUILD	New score-provider backend aggregation targets and discovery header target.
score/crypto/src/backend/score_provider/active_backends_list.hpp	New compile-time active backend discovery list.
score/crypto/src/backend/README.md	New documentation for backend configuration model and flags.
score/crypto/src/backend/pkcs11/pkcs11_token_config_parser.cpp	Default PKCS#11 config parser producing SoftHSM defaults.
score/crypto/src/backend/pkcs11/BUILD	New PKCS#11 backend config parser library target.
score/crypto/src/backend/BUILD	New bool/label flags and config_settings for backend selection; exports active backend targets/defines.
score/crypto/docs/architecture/provider_architecture.rst	Update docs to reflect new configuration flow and factory model.
score/crypto/docs/architecture/provider_architecture.puml	Update UML for config snapshot/factory approach and IProvider API.
score/crypto/docs/architecture/key_management_sequence_diagrams.puml	Update sequence diagram to match new bootstrap path.
score/crypto/docs/architecture/key_management_details.rst	Update docs from visitor pattern to snapshot-based factory config.
score/crypto/docs/architecture/key_management_class_diagram.puml	Update class diagram for snapshot config factory.
score/crypto/docs/architecture/index.rst	Update architecture docs for structured factory results + ProviderManagerFactory ownership.
score/crypto/docs/architecture/component_overview.puml	Update component diagram to include backend layer and ProviderManagerFactory.
MODULE.bazel	Add bazel_skylib dependency for build settings utilities.
conf.py	Exclude backend README from Sphinx docs build.

Suppressed comments (2)

score/crypto/src/daemon/provider/src/provider_manager.cpp:231

• GetProvider(CryptoProviderType) has the same issue as GetProvider(providerId): it uses m_provider_by_id[id]->GetProviderName() to locate the ProviderEntry. If the provider isn't initialized yet, GetProviderName() may be empty and m_providers.at(...) will throw instead of triggering lazy initialization.
  third_party/openssl/BUILD:154
• Same as above: this genrule silently succeeds even if libssl.so.3 is not found, leading to confusing downstream failures. Make it fail if the expected file is missing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 84 out of 89 changed files in this pull request and generated 1 comment.

Suppressed comments (8)

score/crypto/docs/architecture/provider_architecture.puml:40

• provider_architecture.puml still shows IProviderFactory::CreateAndRegister returning bool, but the code now returns ProviderFactoryResult. The diagram should match the updated interface so it stays a reliable reference.

    interface IProviderFactory {
        +CreateAndRegister(manager : ProviderManager&) : bool
    }

score/crypto/src/daemon/common/types.hpp:175

• CryptoProviderTypeFromString() silently maps unknown strings to CryptoProviderType::DEFAULT, which can mask configuration typos and route requests to an unintended provider type. Consider returning an error/optional (or at least a dedicated INVALID value) so callers can surface misconfiguration instead of silently defaulting.

    else
    {
        return CryptoProviderType::DEFAULT;
    }

score/crypto/docs/architecture/provider_architecture.rst:82

• The macro name for the PKCS#11 backend enablement is inconsistent: the text says it is exposed as score_crypto_pkcs11_backend_enabled, but the build defines SCORE_CRYPTO_PKCS11_BACKEND_ENABLED. This makes the documentation misleading for developers looking for the compile-time define.

   ``score_crypto_score_backend_enabled`` for the Score provider family and
   ``score_crypto_pkcs11_backend_enabled`` for the PKCS#11 provider family. Their
   corresponding config settings are exposed to the code as
   ``SCORE_CRYPTO_SCORE_BACKEND_ENABLED`` and ``score_crypto_pkcs11_backend_enabled``. The Score
   family also has the per-backend flag ``score_crypto_score_openssl_enabled``,

score/crypto/docs/architecture/provider_architecture.puml:87

• The diagram still models ScoreProviderFactory::CreateAndRegister() returning bool, but the code now returns ProviderFactoryResult. Also, this section still references OpenSSLProviderFactory delegation, which no longer exists after switching to backend adapters.

        class ScoreProviderFactory {
            -m_config : ScoreProviderFactoryConfig
            +ScoreProviderFactory(config : ScoreProviderFactoryConfig)
            +CreateAndRegister(manager) : bool
        }

score/crypto/docs/architecture/provider_architecture.puml:178

• The diagram shows Pkcs11ProviderFactory::CreateAndRegister() returning bool, but the code now returns ProviderFactoryResult. Keeping the UML signature aligned avoids confusion when reading failure-handling behavior.

        class Pkcs11ProviderFactory {
            -m_config : Pkcs11ProviderFactoryConfig
            +Pkcs11ProviderFactory(config : Pkcs11ProviderFactoryConfig)
            +CreateAndRegister(manager) : bool
        }

score/crypto/docs/architecture/key_management_sequence_diagrams.puml:25

• This sequence diagram still shows main calling ScoreProviderFactory/Pkcs11ProviderFactory directly, but the code now uses ProviderManagerFactory::Create(config) and does not call Initialize() separately. Updating the diagram will keep it consistent with the new bootstrap seam.

Main -> PM ** : make_shared<ProviderManager>(config.GetProviderInitConfig())
Main -> PM : ScoreProviderFactory.CreateAndRegister(PM)
Main -> PM : Pkcs11ProviderFactory.CreateAndRegister(PM)
Main -> PM : Initialize()

score/crypto/docs/architecture/key_management_class_diagram.puml:266

• Pkcs11ProviderFactory::CreateAndRegister() now returns ProviderFactoryResult, but the class diagram still shows a bool return type.

        + CreateAndRegister(manager) : bool

score/crypto/src/backend/README.md:38

• The README advertises a score_crypto_score_primula_enabled flag, but there is no backend/score_provider/primula/ implementation in this repo, so enabling it currently cannot add a backend. Either add the backend package or mark the flag as not yet implemented to avoid misleading users.

| `score_crypto_score_primula_enabled` | `False` | `--//score/crypto/src/backend:score_crypto_score_primula_enabled=True` |

[OliverHeilwagen]

Approved.
Identified issues which are out of scope for this PR have planned issues, see #94 sub-issues.

[ChansAlive]

@masc2023, kindly trigger the qnx build.
All relevant fixes required for this PR are done. The PR may be approved and merged.
Thanks
cc: @schreibwsag @ShoroukRamzy @OliverHeilwagen @sunildevda

[ShoroukRamzy]

@schreibwsag @ShoroukRamzy @masc2023:

We have completed the review. Kindly have a final look and approve.

cc: @OliverHeilwagen @sunildevda
Thank you @ChansAlive for the great work. I see that you created these sub-issues #94, I agree with this approach to handle the rest of work in separate PRs.

[masc2023]

@ShoroukRamzy , if it is ok, please remove your blocker, thank you

Thank you @ChansAlive for the great work. I see that you created these sub-issues #94, I agree with this approach to handle the rest of work in separate PRs.