in kmsp11/object_loader.cc [135:162]
void ObjectLoader::Cache::EvictUnused(const ObjectStoreState& state) {
absl::flat_hash_set<std::string> items_to_retain;
for (const Key& key : state.keys()) {
items_to_retain.insert(key.crypto_key_version().name());
}
auto it = keys_.begin();
while (it != keys_.end()) {
if (items_to_retain.contains(it->first)) {
it++;
continue;
}
if (it->second->public_key_handle() != CK_INVALID_HANDLE) {
allocated_handles_.erase(it->second->public_key_handle());
}
if (it->second->private_key_handle() != CK_INVALID_HANDLE) {
allocated_handles_.erase(it->second->private_key_handle());
}
if (it->second->has_certificate()) {
allocated_handles_.erase(it->second->certificate().handle());
}
if (it->second->secret_key_handle() != CK_INVALID_HANDLE) {
allocated_handles_.erase(it->second->secret_key_handle());
}
keys_.erase(it++);
}
}