Update PKCS#11 URI code for new draft of spec

 * pinfile attribute was renamed to pin-source
 * objecttype attribute was renamed to object-type
 * secretkey value was renamed to secret-key

We continue to support parsing the old attribute names and values but
generate URIs with the new ones.

8 files changed, 185 insertions, 145 deletions

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 7440f72..cf7f4bc 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -20,7 +20,7 @@ SCANGOBJ_OPTIONS= --version
 
 # Extra options to supply to gtkdoc-scan.
 # e.g. SCAN_OPTIONS=--deprecated-guards="GTK_DISABLE_DEPRECATED"
-SCAN_OPTIONS= --rebuild-types
+SCAN_OPTIONS= --rebuild-types --deprecated-guards="P11_KIT_DISABLE_DEPRECATED"
 
 # Extra options to supply to gtkdoc-mkdb.
 # e.g. MKDB_OPTIONS=--sgml-mode --output-format=xml
diff --git a/doc/p11-kit-sections.txt b/doc/p11-kit-sections.txt
index 7d9a825..37fceb5 100644
--- a/doc/p11-kit-sections.txt
+++ b/doc/p11-kit-sections.txt
@@ -19,6 +19,8 @@ p11_kit_uri_set_attribute
 p11_kit_uri_clear_attribute
 p11_kit_uri_set_unrecognized
 p11_kit_uri_any_unrecognized
+p11_kit_uri_get_pin_source
+p11_kit_uri_set_pin_source
 p11_kit_uri_get_pinfile
 p11_kit_uri_set_pinfile
 p11_kit_uri_format
diff --git a/p11-kit/pin.c b/p11-kit/pin.c
index f24005a..f74620a 100644
--- a/p11-kit/pin.c
+++ b/p11-kit/pin.c
@@ -59,47 +59,47 @@
  * Applications can register a callback which will be called to provide a
  * password associated with a given pin file.
  *
- * PKCS\#11 URIs can contain a 'pinfile' attribute. The value of this attribute
+ * PKCS\#11 URIs can contain a 'pin-source' attribute. The value of this attribute
  * is application dependent, but often references a file containing a PIN to
  * use.
  *
  * Using these functions, an applications or libraries can register a
  * callback with p11_kit_pin_register_callback() to be called when a given
- * 'pinfile' attribute value is requested. The application can then prompt
+ * 'pin-source' attribute value is requested. The application can then prompt
  * the user or retrieve a PIN for the given context. These registered
  * callbacks are only relevant and valid within the current process.
  *
  * A fallback callback can be registered by passing the %P11_KIT_PIN_FALLBACK
  * value to p11_kit_pin_register_callback(). This fallback callback will be
- * called for every 'pinfile' attribute request for which no callback has been
+ * called for every 'pin-source' attribute request for which no callback has been
  * directly registered.
  *
- * To request a PIN for a given 'pinfile' attribute, use the
+ * To request a PIN for a given 'pin-source' attribute, use the
  * p11_kit_pin_request() function. If this function returns %NULL then either
  * no callbacks were registered or none of them could handle the request.
  *
- * If multiple callbacks are registered for the same pinfile, then they are
+ * If multiple callbacks are registered for the same PIN source, then they are
  * called in last-registered-first-called order. They are called in turn until
  * one of them can handle the request. Fallback callbacks are not called if
- * a callback was registered specifically for a requested 'pinfile' attribute.
+ * a callback was registered specifically for a requested 'pin-source' attribute.
  *
  * PINs themselves are handled inside of P11KitPin structures. These are thread
  * safe and allow the callback to specify how the PIN is stored in memory
  * and freed. A callback can use p11_kit_pin_new_for_string() or related
  * functions to create a PIN to be returned.
  *
- * For example in order to handle the following PKCS\#11 URI with a 'pinfile'
+ * For example in order to handle the following PKCS\#11 URI with a 'pin-source'
  * attribute
  *
  * <code><literallayout>
- *      pkcs11:id=\%69\%95\%3e\%5c\%f4\%bd\%ec\%91;pinfile=my-application
+ *      pkcs11:id=\%69\%95\%3e\%5c\%f4\%bd\%ec\%91;pin-source=my-application
  * </literallayout></code>
  *
  * an application could register a callback like this:
  *
  * <informalexample><programlisting>
  * static P11KitPin*
- * my_application_pin_callback (const char *pinfile, P11KitUri *pin_uri,
+ * my_application_pin_callback (const char *pin_source, P11KitUri *pin_uri,
  *                              const char *pin_description, P11KitPinFlags pin_flags,
  *                              void *callback_data)
  * {
@@ -131,7 +131,7 @@
  * String of URI scheme for PKCS\#11 URIs.
  */
 
-typedef struct _PinfileCallback {
+typedef struct _PinCallback {
 	/* Only used/modified within the lock */
 	int refs;
 
@@ -139,28 +139,28 @@ typedef struct _PinfileCallback {
 	p11_kit_pin_callback func;
 	void *user_data;
 	p11_kit_pin_destroy_func destroy;
-} PinfileCallback;
+} PinCallback;
 
 /*
  * Shared data between threads, protected by the mutex, a structure so
  * we can audit thread safety easier.
  */
 static struct _Shared {
-	hashmap *pinfiles;
+	hashmap *pin_sources;
 } gl = { NULL };
 
 static void*
-ref_pinfile_callback (void *pointer)
+ref_pin_callback (void *pointer)
 {
-	PinfileCallback *cb = pointer;
+	PinCallback *cb = pointer;
 	cb->refs++;
 	return pointer;
 }
 
 static void
-unref_pinfile_callback (void *pointer)
+unref_pin_callback (void *pointer)
 {
-	PinfileCallback *cb = pointer;
+	PinCallback *cb = pointer;
 	assert (cb->refs >= 1);
 
 	cb->refs--;
@@ -173,39 +173,39 @@ unref_pinfile_callback (void *pointer)
 
 /**
  * p11_kit_pin_register_callback:
- * @pinfile: the 'pinfile' attribute this this callback is for
+ * @pin_source: the 'pin-source' attribute this this callback is for
  * @callback: the callback function
  * @callback_data: data that will be passed to the callback
  * @callback_destroy: a function that will be called with @callback_data when
  *     the callback is unregistered.
  *
- * Register a callback to handle PIN requests for a given 'pinfile' attribute.
- * If @pinfile is set to P11_KIT_PIN_FALLBACK then this will be a fallback
+ * Register a callback to handle PIN requests for a given 'pin-source' attribute.
+ * If @pin_source is set to P11_KIT_PIN_FALLBACK then this will be a fallback
  * callback and will be called for requests for which no other callback has
  * been specifically registered.
  *
- * If multiple callbacks are registered for the same @pinfile value, then
+ * If multiple callbacks are registered for the same @pin_source value, then
  * the last registered callback will be the first to be called.
  *
  * Returns: Returns negative if registering fails. This can only happen if
  *     memory cannot be allocated.
  */
 int
-p11_kit_pin_register_callback (const char *pinfile, p11_kit_pin_callback callback,
+p11_kit_pin_register_callback (const char *pin_source, p11_kit_pin_callback callback,
                                void *callback_data, p11_kit_pin_destroy_func callback_destroy)
 {
 	ptr_array_t *callbacks = NULL;
-	PinfileCallback *cb;
+	PinCallback *cb;
 	char *name;
 	int ret;
 
-	cb = calloc (1, sizeof (PinfileCallback));
+	cb = calloc (1, sizeof (PinCallback));
 	if (cb == NULL) {
 		errno = ENOMEM;
 		return -1;
 	}
 
-	name = strdup (pinfile);
+	name = strdup (pin_source);
 	if (name == NULL) {
 		free (cb);
 		errno = ENOMEM;
@@ -219,24 +219,24 @@ p11_kit_pin_register_callback (const char *pinfile, p11_kit_pin_callback callbac
 
 	_p11_lock ();
 
-		if (gl.pinfiles == NULL) {
-			gl.pinfiles = hash_create (hash_string_hash, hash_string_equal,
-			                           free, (hash_destroy_func)ptr_array_free);
-			if (gl.pinfiles == NULL) {
+		if (gl.pin_sources == NULL) {
+			gl.pin_sources = hash_create (hash_string_hash, hash_string_equal,
+			                              free, (hash_destroy_func)ptr_array_free);
+			if (gl.pin_sources == NULL) {
 				errno = ENOMEM;
 				ret = -1;
 			}
 		}
 
-		if (gl.pinfiles != NULL)
-			callbacks = hash_get (gl.pinfiles, pinfile);
+		if (gl.pin_sources != NULL)
+			callbacks = hash_get (gl.pin_sources, pin_source);
 
 		if (callbacks == NULL) {
-			callbacks = ptr_array_create (unref_pinfile_callback);
+			callbacks = ptr_array_create (unref_pin_callback);
 			if (callbacks == NULL) {
 				errno = ENOMEM;
 				ret = -1;
-			} else if (!hash_set (gl.pinfiles, name, callbacks)) {
+			} else if (!hash_set (gl.pin_sources, name, callbacks)) {
 				ptr_array_free (callbacks);
 				callbacks = NULL;
 				errno = ENOMEM;
@@ -262,14 +262,14 @@ p11_kit_pin_register_callback (const char *pinfile, p11_kit_pin_callback callbac
 	/* Unless consumed above */
 	free (name);
 	if (cb != NULL)
-		unref_pinfile_callback (cb);
+		unref_pin_callback (cb);
 
 	return ret;
 }
 
 /**
  * p11_kit_pin_unregister_callback:
- * @pinfile: the 'pinfile' attribute the callback was registered for
+ * @pin_source: the 'pin-source' attribute the callback was registered for
  * @callback: the callback function that was registered
  * @callback_data: data that was registered for the callback
  *
@@ -279,17 +279,17 @@ p11_kit_pin_register_callback (const char *pinfile, p11_kit_pin_callback callbac
  * removed.
  */
 void
-p11_kit_pin_unregister_callback (const char *pinfile, p11_kit_pin_callback callback,
+p11_kit_pin_unregister_callback (const char *pin_source, p11_kit_pin_callback callback,
                                  void *callback_data)
 {
-	PinfileCallback *cb;
+	PinCallback *cb;
 	ptr_array_t *callbacks;
 	unsigned int i;
 
 	_p11_lock ();
 
-		if (gl.pinfiles) {
-			callbacks = hash_get (gl.pinfiles, pinfile);
+		if (gl.pin_sources) {
+			callbacks = hash_get (gl.pin_sources, pin_source);
 			if (callbacks) {
 				for (i = 0; i < ptr_array_count (callbacks); i++) {
 					cb = ptr_array_at (callbacks, i);
@@ -300,13 +300,13 @@ p11_kit_pin_unregister_callback (const char *pinfile, p11_kit_pin_callback callb
 				}
 
 				if (ptr_array_count (callbacks) == 0)
-					hash_remove (gl.pinfiles, pinfile);
+					hash_remove (gl.pin_sources, pin_source);
 			}
 
-			/* When there are no more pinfiles, get rid of the hash table */
-			if (hash_size (gl.pinfiles) == 0) {
-				hash_free (gl.pinfiles);
-				gl.pinfiles = NULL;
+			/* When there are no more pin sources, get rid of the hash table */
+			if (hash_size (gl.pin_sources) == 0) {
+				hash_free (gl.pin_sources);
+				gl.pin_sources = NULL;
 			}
 		}
 
@@ -315,12 +315,12 @@ p11_kit_pin_unregister_callback (const char *pinfile, p11_kit_pin_callback callb
 
 /**
  * p11_kit_pin_request:
- * @pinfile: the 'pinfile' attribute that is being requested
+ * @pin_source: the 'pin-source' attribute that is being requested
  * @pin_uri: a PKCS\#11 URI that the PIN is being requested for, optionally %NULL.
  * @pin_description: a description of what the PIN is for, must not be %NULL.
  * @pin_flags: various flags for this request
  *
- * Request a PIN for a given 'pinfile' attribute. The result depends on the
+ * Request a PIN for a given 'pin-source' attribute. The result depends on the
  * registered callbacks.
  *
  * If not %NULL, then the @pin_uri attribute should point to the thing that the
@@ -331,13 +331,13 @@ p11_kit_pin_unregister_callback (const char *pinfile, p11_kit_pin_callback callb
  * what the PIN is for. For example this would be the token label, if the PIN
  * is for a token.
  *
- * If more than one callback is registered for the @pinfile, then the latest
+ * If more than one callback is registered for the @pin_source, then the latest
  * registered one will be called first. If that callback does not return a
  * PIN, then the next will be called in turn.
  *
- * If no callback is registered for @pinfile, then the fallback callbacks will
+ * If no callback is registered for @pin_source, then the fallback callbacks will
  * be invoked in the same way. The fallback callbacks will not be called if any
- * callback has been registered specifically for @pinfile.
+ * callback has been registered specifically for @pin_source.
  *
  * The PIN returned should be released with p11_kit_pin_unref().
  *
@@ -345,10 +345,10 @@ p11_kit_pin_unregister_callback (const char *pinfile, p11_kit_pin_callback callb
  *     if no callback was registered or could proivde a PIN
  */
 P11KitPin*
-p11_kit_pin_request (const char *pinfile, P11KitUri *pin_uri,
+p11_kit_pin_request (const char *pin_source, P11KitUri *pin_uri,
                      const char *pin_description, P11KitPinFlags pin_flags)
 {
-	PinfileCallback **snapshot = NULL;
+	PinCallback **snapshot = NULL;
 	unsigned int snapshot_count = 0;
 	ptr_array_t *callbacks;
 	P11KitPin *pin;
@@ -356,19 +356,19 @@ p11_kit_pin_request (const char *pinfile, P11KitUri *pin_uri,
 
 	_p11_lock ();
 
-		/* Find and ref the pinfile data */
-		if (gl.pinfiles) {
-			callbacks = hash_get (gl.pinfiles, pinfile);
+		/* Find and ref the pin source data */
+		if (gl.pin_sources) {
+			callbacks = hash_get (gl.pin_sources, pin_source);
 
 			/* If we didn't find any snapshots try the global ones */
 			if (callbacks == NULL)
-				callbacks = hash_get (gl.pinfiles, P11_KIT_PIN_FALLBACK);
+				callbacks = hash_get (gl.pin_sources, P11_KIT_PIN_FALLBACK);
 
 			if (callbacks != NULL) {
-				snapshot = (PinfileCallback**)ptr_array_snapshot (callbacks);
+				snapshot = (PinCallback**)ptr_array_snapshot (callbacks);
 				snapshot_count = ptr_array_count (callbacks);
 				for (i = 0; i < snapshot_count; i++)
-					ref_pinfile_callback (snapshot[i]);
+					ref_pin_callback (snapshot[i]);
 			}
 		}
 
@@ -378,13 +378,13 @@ p11_kit_pin_request (const char *pinfile, P11KitUri *pin_uri,
 		return NULL;
 
 	for (pin = NULL, i = snapshot_count; pin == NULL && i > 0; i--) {
-		pin = (snapshot[i - 1]->func) (pinfile, pin_uri, pin_description, pin_flags,
+		pin = (snapshot[i - 1]->func) (pin_source, pin_uri, pin_description, pin_flags,
 		                               snapshot[i - 1]->user_data);
 	}
 
 	_p11_lock ();
 		for (i = 0; i < snapshot_count; i++)
-			unref_pinfile_callback (snapshot[i]);
+			unref_pin_callback (snapshot[i]);
 		free (snapshot);
 	_p11_unlock ();
 
@@ -393,7 +393,7 @@ p11_kit_pin_request (const char *pinfile, P11KitUri *pin_uri,
 
 /**
  * p11_kit_pin_callback:
- * @pinfile: a 'pinfile' attribute string
+ * @pin_source: a 'pin-source' attribute string
  * @pin_uri: a PKCS\#11 URI that the PIN is for, or %NULL
  * @pin_description: a descrption of what the PIN is for
  * @pin_flags: flags describing the PIN request
@@ -423,13 +423,13 @@ p11_kit_pin_request (const char *pinfile, P11KitUri *pin_uri,
 
 /**
  * p11_kit_pin_file_callback:
- * @pinfile: a 'pinfile' attribute string
+ * @pin_source: a 'pin-source' attribute string
  * @pin_uri: a PKCS\#11 URI that the PIN is for, or %NULL
  * @pin_description: a descrption of what the PIN is for
  * @pin_flags: flags describing the PIN request
  * @callback_data: unused, should be %NULL
  *
- * This is a PIN callback function that looks up the 'pinfile' attribute in
+ * This is a PIN callback function that looks up the 'pin-source' attribute in
  * a file with that name. This can be used to enable the normal PKCS\#11 URI
  * behavior described in the RFC.
  *
@@ -445,7 +445,7 @@ p11_kit_pin_request (const char *pinfile, P11KitUri *pin_uri,
  *    could not be read.
  */
 P11KitPin*
-p11_kit_pin_file_callback (const char *pinfile,
+p11_kit_pin_file_callback (const char *pin_source,
                            P11KitUri *pin_uri,
                            const char *pin_description,
                            P11KitPinFlags pin_flags,
@@ -461,7 +461,7 @@ p11_kit_pin_file_callback (const char *pinfile,
 	if (pin_flags & P11_KIT_PIN_FLAGS_RETRY)
 		return NULL;
 
-	fd = open (pinfile, O_RDONLY);
+	fd = open (pin_source, O_RDONLY);
 	if (fd == -1)
 		return NULL;
 
diff --git a/p11-kit/pin.h b/p11-kit/pin.h
index 07e7f6a..bc342b1 100644
--- a/p11-kit/pin.h
+++ b/p11-kit/pin.h
@@ -74,27 +74,27 @@ const unsigned char * p11_kit_pin_get_value                 (P11KitPin *pin,
 
 size_t                p11_kit_pin_get_length                (P11KitPin *pin);
 
-typedef P11KitPin*  (*p11_kit_pin_callback)                 (const char *pinfile,
+typedef P11KitPin*  (*p11_kit_pin_callback)                 (const char *pin_source,
                                                              P11KitUri *pin_uri,
                                                              const char *pin_description,
                                                              P11KitPinFlags pin_flags,
                                                              void *callback_data);
 
-int                   p11_kit_pin_register_callback         (const char *pinfile,
+int                   p11_kit_pin_register_callback         (const char *pin_source,
                                                              p11_kit_pin_callback callback,
                                                              void *callback_data,
                                                              p11_kit_pin_destroy_func callback_destroy);
 
-void                  p11_kit_pin_unregister_callback       (const char *pinfile,
+void                  p11_kit_pin_unregister_callback       (const char *pin_source,
                                                              p11_kit_pin_callback callback,
                                                              void *callback_data);
 
-P11KitPin*            p11_kit_pin_request                   (const char *pinfile,
+P11KitPin*            p11_kit_pin_request                   (const char *pin_source,
                                                              P11KitUri *pin_uri,
                                                              const char *pin_description,
                                                              P11KitPinFlags pin_flags);
 
-P11KitPin*            p11_kit_pin_file_callback             (const char *pinfile,
+P11KitPin*            p11_kit_pin_file_callback             (const char *pin_source,
                                                              P11KitUri *pin_uri,
                                                              const char *pin_description,
                                                              P11KitPinFlags pin_flags,
diff --git a/p11-kit/uri.c b/p11-kit/uri.c
index 3075cae..d466486 100644
--- a/p11-kit/uri.c
+++ b/p11-kit/uri.c
@@ -58,7 +58,7 @@
  * <code><literallayout>
  *      pkcs11:token=The\%20Software\%20PKCS\#11\%20softtoken;
  *          manufacturer=Snake\%20Oil,\%20Inc.;serial=;object=my-certificate;
- *          model=1.0;objecttype=cert;id=\%69\%95\%3e\%5c\%f4\%bd\%ec\%91
+ *          model=1.0;object-type=cert;id=\%69\%95\%3e\%5c\%f4\%bd\%ec\%91
  * </literallayout></code>
  *
  * You can use p11_kit_uri_parse() to parse such a URI, and p11_kit_uri_format()
@@ -143,7 +143,7 @@ struct p11_kit_uri {
 	CK_TOKEN_INFO token;
 	CK_ATTRIBUTE attributes[NUM_ATTRIBUTE_TYPES];
 	CK_ULONG n_attributes;
-	char *pinfile;
+	char *pin_source;
 };
 
 const static char HEX_CHARS[] = "0123456789abcdef";
@@ -677,35 +677,60 @@ p11_kit_uri_any_unrecognized (P11KitUri *uri)
 }
 
 /**
- * p11_kit_uri_get_pinfile:
+ * p11_kit_uri_get_pin_source:
  * @uri: The URI
  *
- * Get the 'pinfile' part of the URI. This is used by some applications to
+ * Get the 'pin-source' part of the URI. This is used by some applications to
  * lookup a PIN for logging into a PKCS\#11 token.
  *
- * Returns: The pinfile or %NULL if not present.
+ * Returns: The pin-source or %NULL if not present.
+ */
+const char*
+p11_kit_uri_get_pin_source (P11KitUri *uri)
+{
+	assert (uri);
+	return uri->pin_source;
+}
+
+/**
+ * p11_kit_uri_get_pinfile:
+ * @uri: The URI
+ *
+ * Deprecated: use p11_kit_uri_get_pin_source().
  */
 const char*
 p11_kit_uri_get_pinfile (P11KitUri *uri)
 {
+	return p11_kit_uri_get_pin_source (uri);
+}
+
+/**
+ * p11_kit_uri_set_pin_source:
+ * @uri: The URI
+ * @pin_source: The new pin-source
+ *
+ * Set the 'pin-source' part of the URI. This is used by some applications to
+ * lookup a PIN for logging into a PKCS\#11 token.
+ */
+void
+p11_kit_uri_set_pin_source (P11KitUri *uri, const char *pin_source)
+{
 	assert (uri);
-	return uri->pinfile;
+	free (uri->pin_source);
+	uri->pin_source = strdup (pin_source);
 }
 
 /**
  * p11_kit_uri_set_pinfile:
  * @uri: The URI
- * @pinfile: The new pinfile
+ * @pinfile: The pinfile
  *
- * Set the 'pinfile' part of the URI. This is used by some applications to
- * lookup a PIN for logging into a PKCS\#11 token.
+ * Deprecated: use p11_kit_uri_set_pin_source().
  */
 void
 p11_kit_uri_set_pinfile (P11KitUri *uri, const char *pinfile)
 {
-	assert (uri);
-	free (uri->pinfile);
-	uri->pinfile = strdup (pinfile);
+	p11_kit_uri_set_pin_source (uri, pinfile);
 }
 
 /**
@@ -827,7 +852,7 @@ format_attribute_class (char **string, size_t *length, int *is_first,
 		value = "data";
 		break;
 	case CKO_SECRET_KEY:
-		value = "secretkey";
+		value = "secret-key";
 		break;
 	case CKO_CERTIFICATE:
 		value = "cert";
@@ -942,17 +967,17 @@ p11_kit_uri_format (P11KitUri *uri, P11KitUriType uri_type, char **string)
 			return P11_KIT_URI_NO_MEMORY;
 		}
 
-		if (!format_attribute_class (&result, &length, &is_first, "objecttype",
+		if (!format_attribute_class (&result, &length, &is_first, "object-type",
 		                             p11_kit_uri_get_attribute (uri, CKA_CLASS))) {
 			free (result);
 			return P11_KIT_URI_NO_MEMORY;
 		}
 	}
 
-	if (uri->pinfile) {
-		format_encode_string (&result, &length, &is_first, "pinfile",
-		                      (const unsigned char*)uri->pinfile,
-		                      strlen (uri->pinfile));
+	if (uri->pin_source) {
+		format_encode_string (&result, &length, &is_first, "pin-source",
+		                      (const unsigned char*)uri->pin_source,
+		                      strlen (uri->pin_source));
 	}
 
 	*string = result;
@@ -1004,7 +1029,8 @@ parse_class_attribute (const char *name, const char *start, const char *end,
 
 	assert (start <= end);
 
-	if (strcmp ("objecttype", name) != 0)
+	if (strcmp ("objecttype", name) != 0 &&
+	    strcmp ("object-type", name) != 0)
 		return 0;
 
 	if (equals_segment (start, end, "cert"))
@@ -1015,6 +1041,8 @@ parse_class_attribute (const char *name, const char *start, const char *end,
 		klass = CKO_PRIVATE_KEY;
 	else if (equals_segment (start, end, "secretkey"))
 		klass = CKO_SECRET_KEY;
+	else if (equals_segment (start, end, "secret-key"))
+		klass = CKO_SECRET_KEY;
 	else if (equals_segment (start, end, "data"))
 		klass = CKO_DATA;
 	else {
@@ -1175,17 +1203,18 @@ static int
 parse_extra_info (const char *name, const char *start, const char *end,
                   P11KitUri *uri)
 {
-	unsigned char *pinfile;
+	unsigned char *pin_source;
 	int ret;
 
 	assert (start <= end);
 
-	if (strcmp (name, "pinfile") == 0) {
-		ret = url_decode (start, end, &pinfile, NULL);
+	if (strcmp (name, "pinfile") == 0 ||
+	    strcmp (name, "pin-source") == 0) {
+		ret = url_decode (start, end, &pin_source, NULL);
 		if (ret < 0)
 			return ret;
-		free (uri->pinfile);
-		uri->pinfile = (char*)pinfile;
+		free (uri->pin_source);
+		uri->pin_source = (char*)pin_source;
 		return 1;
 	}
 
@@ -1245,8 +1274,8 @@ p11_kit_uri_parse (const char *string, P11KitUriType uri_type,
 	uri->module.libraryVersion.major = (CK_BYTE)-1;
 	uri->module.libraryVersion.minor = (CK_BYTE)-1;
 	uri->unrecognized = 0;
-	free (uri->pinfile);
-	uri->pinfile = NULL;
+	free (uri->pin_source);
+	uri->pin_source = NULL;
 
 	for (;;) {
 		spos = strchr (string, ';');
@@ -1313,7 +1342,7 @@ p11_kit_uri_free (P11KitUri *uri)
 	for (i = 0; i < uri->n_attributes; ++i)
 		free (uri->attributes[i].pValue);
 
-	free (uri->pinfile);
+	free (uri->pin_source);
 	free (uri);
 }
 
diff --git a/p11-kit/uri.h b/p11-kit/uri.h
index 9f1f516..e08dfc8 100644
--- a/p11-kit/uri.h
+++ b/p11-kit/uri.h
@@ -119,11 +119,20 @@ int                 p11_kit_uri_match_attributes            (P11KitUri *uri,
                                                              CK_ATTRIBUTE_PTR attrs,
                                                              CK_ULONG n_attrs);
 
+const char*         p11_kit_uri_get_pin_source              (P11KitUri *uri);
+
+void                p11_kit_uri_set_pin_source              (P11KitUri *uri,
+                                                             const char *pin_source);
+
+#ifndef P11_KIT_DISABLE_DEPRECATED
+
 const char*         p11_kit_uri_get_pinfile                 (P11KitUri *uri);
 
 void                p11_kit_uri_set_pinfile                 (P11KitUri *uri,
                                                              const char *pinfile);
 
+#endif /* P11_KIT_DISABLE_DEPRECATED */
+
 void                p11_kit_uri_set_unrecognized            (P11KitUri *uri,
                                                              int unrecognized);
 
diff --git a/tests/pin-test.c b/tests/pin-test.c
index 6431857..0117908 100644
--- a/tests/pin-test.c
+++ b/tests/pin-test.c
@@ -44,7 +44,7 @@
 #include "p11-kit/pin.h"
 
 static P11KitPin *
-callback_one (const char *pinfile, P11KitUri *pin_uri, const char *pin_description,
+callback_one (const char *pin_source, P11KitUri *pin_uri, const char *pin_description,
               P11KitPinFlags pin_flags, void *callback_data)
 {
 	int *data = callback_data;
@@ -53,7 +53,7 @@ callback_one (const char *pinfile, P11KitUri *pin_uri, const char *pin_descripti
 }
 
 static P11KitPin*
-callback_other (const char *pinfile, P11KitUri *pin_uri, const char *pin_description,
+callback_other (const char *pin_source, P11KitUri *pin_uri, const char *pin_description,
                 P11KitPinFlags pin_flags, void *callback_data)
 {
 	char *data = callback_data;
@@ -72,10 +72,10 @@ test_pin_register_unregister (CuTest *tc)
 {
 	int data = 33;
 
-	p11_kit_pin_register_callback ("/the/pinfile", callback_one,
+	p11_kit_pin_register_callback ("/the/pin_source", callback_one,
 	                               &data, destroy_data);
 
-	p11_kit_pin_unregister_callback ("/the/pinfile", callback_one,
+	p11_kit_pin_unregister_callback ("/the/pin_source", callback_one,
 	                                 &data);
 
 	CuAssertIntEquals (tc, 34, data);
@@ -90,11 +90,11 @@ test_pin_read (CuTest *tc)
 	size_t length;
 	const unsigned char *ptr;
 
-	p11_kit_pin_register_callback ("/the/pinfile", callback_one,
+	p11_kit_pin_register_callback ("/the/pin_source", callback_one,
 	                               &data, destroy_data);
 
 	uri = p11_kit_uri_new ();
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 	p11_kit_uri_free (uri);
 
@@ -103,7 +103,7 @@ test_pin_read (CuTest *tc)
 	CuAssertIntEquals (tc, 3, length);
 	CuAssertTrue (tc, memcmp (ptr, "one", 3) == 0);
 
-	p11_kit_pin_unregister_callback ("/the/pinfile", callback_one,
+	p11_kit_pin_unregister_callback ("/the/pin_source", callback_one,
 	                                 &data);
 
 	p11_kit_pin_ref (pin);
@@ -117,7 +117,7 @@ test_pin_read_no_match (CuTest *tc)
 	P11KitPin *pin;
 
 	uri = p11_kit_uri_new ();
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 	p11_kit_uri_free (uri);
 
@@ -136,13 +136,13 @@ test_pin_register_duplicate (CuTest *tc)
 
 	uri = p11_kit_uri_new ();
 
-	p11_kit_pin_register_callback ("/the/pinfile", callback_one,
+	p11_kit_pin_register_callback ("/the/pin_source", callback_one,
 	                               &data, destroy_data);
 
-	p11_kit_pin_register_callback ("/the/pinfile", callback_other,
+	p11_kit_pin_register_callback ("/the/pin_source", callback_other,
 	                               value, NULL);
 
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 
 	CuAssertPtrNotNull (tc, pin);
@@ -151,10 +151,10 @@ test_pin_register_duplicate (CuTest *tc)
 	CuAssertTrue (tc, memcmp (ptr, "secret", length) == 0);
 	p11_kit_pin_unref (pin);
 
-	p11_kit_pin_unregister_callback ("/the/pinfile", callback_other,
+	p11_kit_pin_unregister_callback ("/the/pin_source", callback_other,
 	                                 value);
 
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 
 	CuAssertPtrNotNull (tc, pin);
@@ -163,10 +163,10 @@ test_pin_register_duplicate (CuTest *tc)
 	CuAssertTrue (tc, memcmp (ptr, "one", length) == 0);
 	p11_kit_pin_unref (pin);
 
-	p11_kit_pin_unregister_callback ("/the/pinfile", callback_one,
+	p11_kit_pin_unregister_callback ("/the/pin_source", callback_one,
 	                                 &data);
 
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 
 	CuAssertPtrEquals (tc, NULL, pin);
@@ -189,7 +189,7 @@ test_pin_register_fallback (CuTest *tc)
 	p11_kit_pin_register_callback (P11_KIT_PIN_FALLBACK, callback_one,
 	                               &data, destroy_data);
 
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 
 	CuAssertPtrNotNull (tc, pin);
@@ -198,10 +198,10 @@ test_pin_register_fallback (CuTest *tc)
 	CuAssertTrue (tc, memcmp (ptr, "one", length) == 0);
 	p11_kit_pin_unref (pin);
 
-	p11_kit_pin_register_callback ("/the/pinfile", callback_other,
+	p11_kit_pin_register_callback ("/the/pin_source", callback_other,
 	                               value, NULL);
 
-	pin = p11_kit_pin_request ("/the/pinfile", uri, "The token",
+	pin = p11_kit_pin_request ("/the/pin_source", uri, "The token",
 	                            P11_KIT_PIN_FLAGS_USER_LOGIN);
 
 	CuAssertPtrNotNull (tc, pin);
@@ -210,7 +210,7 @@ test_pin_register_fallback (CuTest *tc)
 	CuAssertTrue (tc, memcmp (ptr, "secret", length) == 0);
 	p11_kit_pin_unref (pin);
 
-	p11_kit_pin_unregister_callback ("/the/pinfile", callback_other,
+	p11_kit_pin_unregister_callback ("/the/pin_source", callback_other,
 	                                 value);
 
 	p11_kit_pin_unregister_callback (P11_KIT_PIN_FALLBACK, callback_one,
diff --git a/tests/uri-test.c b/tests/uri-test.c
index d5ca423..8ab8f93 100644
--- a/tests/uri-test.c
+++ b/tests/uri-test.c
@@ -138,7 +138,7 @@ test_uri_parse_with_label_and_klass (CuTest *tc)
 	uri = p11_kit_uri_new ();
 	CuAssertPtrNotNull (tc, uri);
 
-	ret = p11_kit_uri_parse ("pkcs11:object=Test%20Label;objecttype=cert", P11_KIT_URI_FOR_ANY, uri);
+	ret = p11_kit_uri_parse ("pkcs11:object=Test%20Label;object-type=cert", P11_KIT_URI_FOR_ANY, uri);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
 
 	attr = p11_kit_uri_get_attribute (uri, CKA_LABEL);
@@ -485,7 +485,7 @@ test_uri_build_with_attributes (CuTest *tc)
 	p11_kit_uri_free (check);
 
 	CuAssertTrue (tc, strstr (string, "object=The%20Label") != NULL);
-	CuAssertTrue (tc, strstr (string, "objecttype=data") != NULL);
+	CuAssertTrue (tc, strstr (string, "object-type=data") != NULL);
 	CuAssertTrue (tc, strstr (string, "id=HELLO") != NULL);
 
 	free (string);
@@ -502,7 +502,7 @@ test_uri_parse_private_key (CuTest *tc)
 	uri = p11_kit_uri_new ();
 	CuAssertPtrNotNull (tc, uri);
 
-	ret = p11_kit_uri_parse ("pkcs11:objecttype=private", P11_KIT_URI_FOR_OBJECT, uri);
+	ret = p11_kit_uri_parse ("pkcs11:object-type=private", P11_KIT_URI_FOR_OBJECT, uri);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
 
 	attr = p11_kit_uri_get_attribute (uri, CKA_CLASS);
@@ -523,7 +523,7 @@ test_uri_parse_secret_key (CuTest *tc)
 	uri = p11_kit_uri_new ();
 	CuAssertPtrNotNull (tc, uri);
 
-	ret = p11_kit_uri_parse ("pkcs11:objecttype=secretkey", P11_KIT_URI_FOR_OBJECT, uri);
+	ret = p11_kit_uri_parse ("pkcs11:object-type=secret-key", P11_KIT_URI_FOR_OBJECT, uri);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
 
 	attr = p11_kit_uri_get_attribute (uri, CKA_CLASS);
@@ -577,7 +577,7 @@ test_uri_parse_library_version (CuTest *tc)
 }
 
 static void
-test_uri_parse_parse_unknown_objecttype (CuTest *tc)
+test_uri_parse_parse_unknown_object_type (CuTest *tc)
 {
 	P11KitUri *uri;
 	CK_ATTRIBUTE_PTR attr;
@@ -586,7 +586,7 @@ test_uri_parse_parse_unknown_objecttype (CuTest *tc)
 	uri = p11_kit_uri_new ();
 	CuAssertPtrNotNull (tc, uri);
 
-	ret = p11_kit_uri_parse ("pkcs11:objecttype=unknown", P11_KIT_URI_FOR_OBJECT, uri);
+	ret = p11_kit_uri_parse ("pkcs11:object-type=unknown", P11_KIT_URI_FOR_OBJECT, uri);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
 
 	attr = p11_kit_uri_get_attribute (uri, CKA_CLASS);
@@ -635,7 +635,7 @@ test_uri_parse_too_long_is_unrecognized (CuTest *tc)
 
 
 static void
-test_uri_build_objecttype_cert (CuTest *tc)
+test_uri_build_object_type_cert (CuTest *tc)
 {
 	CK_ATTRIBUTE attr;
 	CK_OBJECT_CLASS klass;
@@ -654,14 +654,14 @@ test_uri_build_objecttype_cert (CuTest *tc)
 
 	ret = p11_kit_uri_format (uri, P11_KIT_URI_FOR_ANY, &string);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
-	CuAssertTrue (tc, strstr (string, "objecttype=cert") != NULL);
+	CuAssertTrue (tc, strstr (string, "object-type=cert") != NULL);
 
 	p11_kit_uri_free (uri);
 	free (string);
 }
 
 static void
-test_uri_build_objecttype_private (CuTest *tc)
+test_uri_build_object_type_private (CuTest *tc)
 {
 	CK_ATTRIBUTE attr;
 	CK_OBJECT_CLASS klass;
@@ -680,14 +680,14 @@ test_uri_build_objecttype_private (CuTest *tc)
 
 	ret = p11_kit_uri_format (uri, P11_KIT_URI_FOR_ANY, &string);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
-	CuAssertTrue (tc, strstr (string, "objecttype=private") != NULL);
+	CuAssertTrue (tc, strstr (string, "object-type=private") != NULL);
 
 	p11_kit_uri_free (uri);
 	free (string);
 }
 
 static void
-test_uri_build_objecttype_public (CuTest *tc)
+test_uri_build_object_type_public (CuTest *tc)
 {
 	CK_ATTRIBUTE attr;
 	CK_OBJECT_CLASS klass;
@@ -706,14 +706,14 @@ test_uri_build_objecttype_public (CuTest *tc)
 
 	ret = p11_kit_uri_format (uri, P11_KIT_URI_FOR_ANY, &string);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
-	CuAssertTrue (tc, strstr (string, "objecttype=public") != NULL);
+	CuAssertTrue (tc, strstr (string, "object-type=public") != NULL);
 
 	p11_kit_uri_free (uri);
 	free (string);
 }
 
 static void
-test_uri_build_objecttype_secret (CuTest *tc)
+test_uri_build_object_type_secret (CuTest *tc)
 {
 	CK_ATTRIBUTE attr;
 	CK_OBJECT_CLASS klass;
@@ -732,7 +732,7 @@ test_uri_build_objecttype_secret (CuTest *tc)
 
 	ret = p11_kit_uri_format (uri, P11_KIT_URI_FOR_ANY, &string);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
-	CuAssertTrue (tc, strstr (string, "objecttype=secretkey") != NULL);
+	CuAssertTrue (tc, strstr (string, "object-type=secret-key") != NULL);
 
 	p11_kit_uri_free (uri);
 	free (string);
@@ -910,7 +910,7 @@ test_uri_match_attributes (CuTest *tc)
 	uri = p11_kit_uri_new ();
 	CuAssertPtrNotNull (tc, uri);
 
-	ret = p11_kit_uri_parse ("pkcs11:object=Fancy;id=Blah;objecttype=data", P11_KIT_URI_FOR_ANY, uri);
+	ret = p11_kit_uri_parse ("pkcs11:object=Fancy;id=Blah;object-type=data", P11_KIT_URI_FOR_ANY, uri);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
 
 	ret = p11_kit_uri_match_attributes (uri, attrs, 4);
@@ -1086,31 +1086,31 @@ test_uri_get_set_attributes (CuTest *tc)
 	p11_kit_uri_free (uri);
 }
 static void
-test_uri_pinfile (CuTest *tc)
+test_uri_pin_source (CuTest *tc)
 {
 	P11KitUri *uri;
-	const char *pinfile;
+	const char *pin_source;
 	char *string;
 	int ret;
 
 	uri = p11_kit_uri_new ();
 	CuAssertPtrNotNull (tc, uri);
 
-	p11_kit_uri_set_pinfile (uri, "|my-pin-file");
+	p11_kit_uri_set_pin_source (uri, "|my-pin-file");
 
-	pinfile = p11_kit_uri_get_pinfile (uri);
-	CuAssertStrEquals (tc, "|my-pin-file", pinfile);
+	pin_source = p11_kit_uri_get_pin_source (uri);
+	CuAssertStrEquals (tc, "|my-pin-file", pin_source);
 
 	ret = p11_kit_uri_format (uri, P11_KIT_URI_FOR_ANY, &string);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
-	CuAssertTrue (tc, strstr (string, "pinfile=%7cmy-pin-file") != NULL);
+	CuAssertTrue (tc, strstr (string, "pin-source=%7cmy-pin-file") != NULL);
 	free (string);
 
-	ret = p11_kit_uri_parse ("pkcs11:pinfile=blah%2Fblah", P11_KIT_URI_FOR_ANY, uri);
+	ret = p11_kit_uri_parse ("pkcs11:pin-source=blah%2Fblah", P11_KIT_URI_FOR_ANY, uri);
 	CuAssertIntEquals (tc, P11_KIT_URI_OK, ret);
 
-	pinfile = p11_kit_uri_get_pinfile (uri);
-	CuAssertStrEquals (tc, "blah/blah", pinfile);
+	pin_source = p11_kit_uri_get_pin_source (uri);
+	CuAssertStrEquals (tc, "blah/blah", pin_source);
 
 	p11_kit_uri_free (uri);
 }
@@ -1156,13 +1156,13 @@ main (void)
 	SUITE_ADD_TEST (suite, test_uri_parse_private_key);
 	SUITE_ADD_TEST (suite, test_uri_parse_secret_key);
 	SUITE_ADD_TEST (suite, test_uri_parse_library_version);
-	SUITE_ADD_TEST (suite, test_uri_parse_parse_unknown_objecttype);
+	SUITE_ADD_TEST (suite, test_uri_parse_parse_unknown_object_type);
 	SUITE_ADD_TEST (suite, test_uri_parse_unrecognized);
 	SUITE_ADD_TEST (suite, test_uri_parse_too_long_is_unrecognized);
-	SUITE_ADD_TEST (suite, test_uri_build_objecttype_cert);
-	SUITE_ADD_TEST (suite, test_uri_build_objecttype_private);
-	SUITE_ADD_TEST (suite, test_uri_build_objecttype_public);
-	SUITE_ADD_TEST (suite, test_uri_build_objecttype_secret);
+	SUITE_ADD_TEST (suite, test_uri_build_object_type_cert);
+	SUITE_ADD_TEST (suite, test_uri_build_object_type_private);
+	SUITE_ADD_TEST (suite, test_uri_build_object_type_public);
+	SUITE_ADD_TEST (suite, test_uri_build_object_type_secret);
 	SUITE_ADD_TEST (suite, test_uri_build_with_library);
 	SUITE_ADD_TEST (suite, test_uri_build_library_version);
 	SUITE_ADD_TEST (suite, test_uri_get_set_unrecognized);
@@ -1171,7 +1171,7 @@ main (void)
 	SUITE_ADD_TEST (suite, test_uri_match_attributes);
 	SUITE_ADD_TEST (suite, test_uri_get_set_attribute);
 	SUITE_ADD_TEST (suite, test_uri_get_set_attributes);
-	SUITE_ADD_TEST (suite, test_uri_pinfile);
+	SUITE_ADD_TEST (suite, test_uri_pin_source);
 	SUITE_ADD_TEST (suite, test_uri_free_null);
 	SUITE_ADD_TEST (suite, test_uri_message);