Implementation for PKCS11 support

[ylangisc]

No description provided.

[ylangisc]

[Copilot]

Pull request overview

This PR is a draft implementation toward issue #8401, aiming to enable authentication using private keys stored on SmartCards (PKCS#11), primarily by introducing a PKCS#11-backed X509KeyManager and wiring it into TLS session creation and the macOS UI/build packaging.

Changes:

• Added PKCS11CertificateStoreX509KeyManager and DelegatingCertificateStoreX509KeyManager, and wired the delegator into SessionPoolFactory to expose both Keychain and PKCS#11 identities.
• Refactored keystore handling by extracting DefaultCertificateStoreX509KeyManager from CertificateStoreX509KeyManager, updating usages/tests accordingly.
• Updated macOS packaging/signing/runtime scripts to bundle and process .so (OpenSC PKCS#11), and added the smartcard sandbox entitlement.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
webdav/src/test/java/ch/cyberduck/core/dav/DAVSessionTest.java	Updates test to use DefaultCertificateStoreX509KeyManager.
ssh/src/test/java/ch/cyberduck/core/sftp/openssh/OpenSSHAgentAuthenticatorTest.java	Removes unused imports.
setup/app/sandbox.entitlements	Adds smartcard entitlement for sandboxed macOS app.
runtime.xml	Extends install-name handling to .so and sets -id per library.
osx/src/main/java/ch/cyberduck/ui/cocoa/controller/DefaultBookmarkController.java	Removes unused imports.
osx/src/main/java/ch/cyberduck/ui/cocoa/controller/BookmarkController.java	Populates certificate picker from Keychain + PKCS#11 aliases.
osx/pom.xml	Copies .so runtime artifacts into app bundle frameworks.
osx/build.xml	Rewrites OpenSC dylib install name references for bundled libs.
freenet/src/main/java/ch/cyberduck/core/freenet/FreenetAuthenticatedUrlProvider.java	Switches to CertificateIdentityCallback.noop.
defaults/src/main/resources/default.properties	Adds PKCS#11 library preference defaults/comments.
core/src/test/java/ch/cyberduck/core/ssl/CustomTrustSSLProtocolSocketFactoryTest.java	Updates test to use DefaultCertificateStoreX509KeyManager.
core/src/test/java/ch/cyberduck/core/ssl/CertificateStoreX509KeyManagerTest.java	Updates tests after keystore manager refactor.
core/src/main/java/ch/cyberduck/core/ssl/PreferencesX509KeyManager.java	Uses CertificateIdentityCallback.noop.
core/src/main/java/ch/cyberduck/core/ssl/PKCS11CertificateStoreX509KeyManager.java	New PKCS#11-backed keystore/key manager with PIN prompt.
core/src/main/java/ch/cyberduck/core/ssl/KeychainX509KeyManager.java	Rebased on DefaultCertificateStoreX509KeyManager.
core/src/main/java/ch/cyberduck/core/ssl/DelegatingCertificateStoreX509KeyManager.java	New delegator combining multiple key managers.
core/src/main/java/ch/cyberduck/core/ssl/DefaultCertificateStoreX509KeyManager.java	New default keystore implementation extracted from base class.
core/src/main/java/ch/cyberduck/core/ssl/CertificateStoreX509KeyManager.java	Refactored into abstract base with shared selection/key logic.
core/src/main/java/ch/cyberduck/core/SessionPoolFactory.java	Uses delegating key manager (Keychain + PKCS#11).
core/src/main/java/ch/cyberduck/core/library/Native.java	Makes getPath/getName public for broader use.
core/src/main/java/ch/cyberduck/core/diagnostics/HttpReachability.java	Uses CertificateIdentityCallback.noop.
core/src/main/java/ch/cyberduck/core/CertificateIdentityCallbackFactory.java	Returns CertificateIdentityCallback.noop on failure.
core/src/main/java/ch/cyberduck/core/CertificateIdentityCallback.java	Adds noop constant instance.
core/dylib/src/test/java/ch/cyberduck/core/ssl/PKCS11CertificateStoreX509KeyManagerTest.java	Adds basic PKCS#11 manager tests.
core/dylib/pom.xml	Adds OpenSC runtime artifacts (opensc-pkcs11.so, libopensc.dylib).
core/dylib/build.xml	Imports runtime.xml and adjusts target gating/formatting.
codesign.xml	Adds .so to codesigning inputs.
cli/osx/pom.xml	Copies .so runtime artifacts into CLI bundle frameworks.
cli/osx/build.xml	Rewrites OpenSC dylib install name references for CLI bundle.
brick/src/main/java/ch/cyberduck/core/brick/BrickPairingFeature.java	Uses CertificateIdentityCallback.noop.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.