[Bravo555]

Proposed changes

tedge-p11-server uses its device.cryptoki.uri as a base for every request URI, and when both set the same attribute (token, serial, object, id), the server's value wins. A tedge hsm command can therefore be served from another token or key than the user requested, without any message. For example, with device.cryptoki.uri=pkcs11:token=tedge1, tedge hsm list-keys pkcs11:token=tedge2 returned the keys of tedge1.

This PR detects these cases on the client side, so it also works with older tedge-p11-server versions:

• list-keys: keys that don't match the requested URI are not shown, and a warning says how many results were hidden because of device.cryptoki.uri.
• delete-key: before deleting (and before the confirmation prompt, even with --force), the command lists the keys on the token the server selects for the request and refuses if they are on another token. After deleting, it fails with a non-zero exit code if the server deleted objects that don't match the requested URI.
• create-key: refuses to create or reuse a key if the server selects another token. If the server still creates the key on another token, the command fails and doesn't save the key URI to device.key_uri. When the server can't list keys (all released versions), the check is skipped, so create-key and tedge cert download keep working with older servers.
• change-pin: refuses to change the PIN if the server selects another token, and warns if the server changed the PIN of another token than requested.
• list-tokens and init don't use device.cryptoki.uri, so they are unchanged.

This also fixes Pkcs11Uri::matches, which never matched a filter with a slot-id attribute because URIs exported by tedge-p11-server don't include one.

Known limitations (tracked by skipped tests)

Some cases can't be detected on the client side without changes to tedge-p11-server. The new hsm_config_uri_scope Robot suite has a test asserting the correct behavior for each of them, tagged robot:skip and known-issue:p11-server-uri-override:

Command	Case	Server cause
list-keys	pkcs11:slot-id=N lists the keys of the first token	Cryptoki::open_session ignores slot-id
delete-key	object=/id= in device.cryptoki.uri makes the server delete the configured key instead of the requested one; the client only reports it afterwards	Cryptoki::request_uri lets the config override object/id, and Cryptoki::list_keys ignores them
create-key	When device.cryptoki.uri selects a token without keys, the key is created there before the mismatch is detected	Cryptoki::request_uri overrides token; an empty token can't be identified from the client
create-key	object= in device.cryptoki.uri makes the existing key check "reuse" the configured key, so no key is created and device.key_uri is set to a URI naming a key that doesn't exist	Cryptoki::request_uri overrides object
change-pin	When device.cryptoki.uri selects a token without keys, the PIN is changed before the mismatch is detected	Same as above
change-pin --reset	No check before resetting, as listing keys would need a login with the unknown current PIN	Cryptoki::request_uri overrides token

The proper fix is for tedge-p11-server to reject requests that conflict with device.cryptoki.uri.

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
• Documentation Update (if none of the other choices apply)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

Checklist

• I have read the CONTRIBUTING doc
• I have signed the CLA (in all commits with git commit -s. You can activate automatic signing by running just prepare-dev once)
• I ran just format as mentioned in CODING_GUIDELINES
• I used just check as mentioned in CODING_GUIDELINES
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Further comments

The list-keys test that checked filtering by device.cryptoki.uri moved from the create_key_hsm suite to the new hsm_config_uri_scope suite, which covers every tedge hsm command. That suite has no initial.robot variant, as released tedge-p11-server versions can't list keys, delete keys or change PINs.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 69.69697% with 60 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/core/tedge/src/cli/hsm/uri_scope.rs	66.41%	42 Missing and 2 partials ⚠️
crates/core/tedge/src/cli/hsm/create_key.rs	0.00%	10 Missing ⚠️
crates/core/tedge/src/cli/hsm/change_pin.rs	0.00%	2 Missing ⚠️
crates/core/tedge/src/cli/hsm/delete_key.rs	0.00%	2 Missing ⚠️
crates/core/tedge/src/cli/hsm/list_keys.rs	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.