pkcs11-tool: return value is 0 when signature verification fails about opensc HOT 3 CLOSED

I would say that the pkcs11-tool is not designed for security and robust scripting. You can see in the code, the pkcs11 tool implements different operations and they are executed in the code-defined order, but do not return any return value:

https://github.com/OpenSC/OpenSC/blob/master/src/tools/pkcs11-tool.c#L1429

Supporting different return values for different operations would complicate stuff.

The other thing is that for the signature verification, one does not need the pkcs11 tool at all. The verification usually happens on some other place where the signing smart card/token is not available. It can be done without the smart card/token, just with the public key, that can be obtained from the pkcs11-tool with --read-object and for example openssl CLI that has more consistent exit codes.

from opensc.

Just for interest .. I use the following construct in my test scripts:

pkcs11-tool --verify -m ECDSA-SHA1 --id 61 --input-file file.txt --signature-file file.sig|grep -q "^Signature is valid$"
echo $?

from opensc.

@Jakuje thanks for your comments: I imagined that those were the reasons. I just wanted to be sure that I undertsood correctly.
@popovec thanks for your suggestion: yes, I have something similar in my script.

I close the issue, hoping that could help someone will search for the same topic.

from opensc.