I have also cross-checked the output with other tools, and it seems reasonable:

$ systemd-cryptenroll --pkcs11-token=list; ./src/tools/pkcs11-tool -L | grep uri | awk -F ': ' '{print $NF}' 
| tr -d ' '
URI                                                                                        LABEL  MANUFACTURER MODEL           
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=abcdef1234567890;token=clevis clevis piv_II       PKCS#15 emulated
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=abcdef1234567890;token=clevis

I think this is good to go.

One possible area to extend this could be printing the URI for the objects too (which could reuse most of the current code) and some test coverage to see the URIs printed make sense. Should be quite easy to start from for example tests/test-pkcs11-tool-import.sh and grep for the important uri parts.

Sure. I will open an issue for it and I will create a PR for that.

Thanks for your help, @Jakuje

Thank you for your contribution!

I think this is good to go.

One possible area to extend this could be printing the URI for the objects too (which could reuse most of the current code) and some test coverage to see the URIs printed make sense. Should be quite easy to start from for example tests/test-pkcs11-tool-import.sh and grep for the important uri parts.

Hello Jakub. I opened #3129 for this extension.