gck: Remove floating capabilities to GckAttributes

It is not necessary and makes it difficult to interact with GObject introspected
languages.

Signed-off-by: Corentin Noël <corentin.noel@collabora.com>

26 files changed, 127 insertions, 253 deletions

diff --git a/gck/gck-attributes.c b/gck/gck-attributes.c
index 6a0b4fb..3ba9be1 100644
--- a/gck/gck-attributes.c
+++ b/gck/gck-attributes.c
@@ -48,14 +48,10 @@
 
 G_STATIC_ASSERT (sizeof (GckAttribute) == sizeof (CK_ATTRIBUTE));
 
-#define STATE_LOCKED     1
-#define STATE_FLOATING   8
-
 struct _GckAttributes {
 	GckAttribute *data;
 	gulong count;
 	gint refs;
-	gint state;
 };
 
 typedef struct {
@@ -1266,19 +1262,17 @@ gck_builder_find_date (GckBuilder *builder,
 }
 
 /**
- * gck_builder_steal:
+ * gck_builder_end:
  * @builder: the builder
  *
  * Take the attributes that have been built in the #GckBuilder. The builder
  * will no longer contain any attributes after this function call.
  *
- * The returned set of attributes is a full reference, not floating.
- *
- * Returns: (transfer full): the stolen attributes, which should be freed with
+ * Returns: (transfer full): the attributes, which should be freed with
  *          gck_attributes_unref()
  */
 GckAttributes *
-gck_builder_steal (GckBuilder *builder)
+gck_builder_end (GckBuilder *builder)
 {
 	GckRealBuilder *real = (GckRealBuilder *)builder;
 	GckAttributes *attrs;
@@ -1305,39 +1299,6 @@ gck_builder_steal (GckBuilder *builder)
 }
 
 /**
- * gck_builder_end:
- * @builder: the builder
- *
- * Complete the #GckBuilder, and return the attributes contained in the builder.
- * The #GckBuilder will be cleared after this function call, and it is no
- * longer necessary to use [method@Builder.clear] on it, although it is also
- * permitted. The builder may be used again to build another set of attributes
- * after this function call.
- *
- * The returned set of attributes is floating, and should either be passed to
- * another gck library function which consumes this floating reference, or if
- * you wish to keep these attributes around you should ref them with
- * gck_attributes_ref_sink() and unref them later with gck_attributes_unref().
- *
- * Returns: (transfer none): a floating reference to the attributes created
- *          in the builder
- */
-GckAttributes *
-gck_builder_end (GckBuilder *builder)
-{
-	GckRealBuilder *real = (GckRealBuilder *)builder;
-	GckAttributes *attrs;
-
-	g_return_val_if_fail (builder != NULL, NULL);
-
-	attrs = gck_builder_steal (builder);
-	attrs->state |= STATE_FLOATING;
-
-	g_assert (real->array == NULL);
-	return attrs;
-}
-
-/**
  * gck_builder_clear:
  * @builder: the builder
  *
@@ -2041,12 +2002,7 @@ G_DEFINE_BOXED_TYPE (GckAttributes, gck_attributes,
  *
  * Terminate the argument list with [const@INVALID].
  *
- * The returned set of attributes is floating, and should either be passed to
- * another gck library function which consumes this floating reference, or if
- * you wish to keep these attributes around you should ref them with
- * gck_attributes_ref_sink() and unref them later with gck_attributes_unref().
- *
- * Returns: (transfer none): a floating reference to an empty set of attributes
+ * Returns: (transfer full): a reference to an empty set of attributes
  **/
 GckAttributes *
 gck_attributes_new_empty (gulong first_type,
@@ -2230,45 +2186,6 @@ gck_attributes_ref (GckAttributes *attrs)
 }
 
 /**
- * gck_attributes_ref_sink:
- * @attrs: an attribute array
- *
- * #GckAttributes uses a floating reference count system. [method@Builder.end]
- * and [ctor@Attributes.new_empty] both return floating references.
- *
- * Calling this function on a `GckAttributes` with a floating
- * reference will convert the floating reference into a full reference.
- * Calling this function on a non-floating `GckAttributes` results
- * in an additional normal reference being added.
- *
- * In other words, if the @attrs is floating, then this call "assumes
- * ownership" of the floating reference, converting it to a normal
- * reference.  If the @attrs is not floating, then this call adds a
- * new normal reference increasing the reference count by one.
- *
- * All Gck library functions that assume ownership of floating references
- * are documented as such. Essentially any Gck function that performs
- * an operation using a #GckAttributes argument rather than operating on the
- * attributes themselves, will accept a floating reference.
- *
- * Returns: (transfer full): the referenced attributes
- */
-GckAttributes *
-gck_attributes_ref_sink (GckAttributes *attrs)
-{
-	g_return_val_if_fail (attrs, NULL);
-	g_bit_lock (&attrs->state, STATE_LOCKED);
-
-	if (~attrs->state & STATE_FLOATING)
-		gck_attributes_ref (attrs);
-	else
-		attrs->state &= ~STATE_FLOATING;
-
-	g_bit_unlock (&attrs->state, STATE_LOCKED);
-	return attrs;
-}
-
-/**
  * gck_attributes_unref:
  * @attrs: (nullable) (type Gck.Attributes) (transfer full): An attribute array
  *
@@ -2803,20 +2720,14 @@ gck_attributes_to_string (GckAttributes *attrs)
 
 /**
  * gck_attributes_new:
- * @reserved: Should be set to always be [const@INVALID]
  *
  * Create a new empty `GckAttributes` array.
  *
- * The returned set of attributes is floating, and should either be passed to
- * another gck library function which consumes this floating reference, or if
- * you wish to keep these attributes around you should ref them with
- * gck_attributes_ref_sink() and unref them later with gck_attributes_unref().
- *
- * Returns: (transfer none): a floating reference to the new attributes array;
+ * Returns: (transfer full): a reference to the new attributes array;
  *          when done with the array release it with gck_attributes_unref().
  **/
 GckAttributes *
-gck_attributes_new (gulong reserved)
+gck_attributes_new (void)
 {
 	GckBuilder builder = GCK_BUILDER_INIT;
 	return gck_builder_end (&builder);
diff --git a/gck/gck-enumerator.c b/gck/gck-enumerator.c
index 70b04fe..16837e9 100644
--- a/gck/gck-enumerator.c
+++ b/gck/gck-enumerator.c
@@ -514,7 +514,7 @@ state_results (GckEnumeratorState *args,
 			rv = (args->funcs->C_GetAttributeValue) (session, result->handle, template, n_template);
 		}
 
-		attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+		attrs = gck_builder_end (&builder);
 
 		if (GCK_IS_GET_ATTRIBUTE_RV_OK (rv)) {
 			gchar *string = gck_attributes_to_string (attrs);
diff --git a/gck/gck-mock.c b/gck/gck-mock.c
index 50a033c..bd61ed0 100644
--- a/gck/gck-mock.c
+++ b/gck/gck-mock.c
@@ -150,6 +150,14 @@ insert_template (guint handle, GckAttributes *template)
 	the_objects_list = g_slist_append (the_objects_list, data);
 }
 
+/**
+ * gck_mock_module_add_object:
+ * @attrs: (transfer full):
+ *
+ * Insert the @attrsin the mock module
+ *
+ * Returns: a #CK_OBJECT_HANDLE
+ */
 CK_OBJECT_HANDLE
 gck_mock_module_add_object (GckAttributes *attrs)
 {
@@ -163,13 +171,12 @@ gck_mock_module_add_object (GckAttributes *attrs)
 	handle = ++unique_identifier;
 	if (gck_attributes_find_boolean (attrs, CKA_TOKEN, &token)) {
 		g_return_val_if_fail (token == TRUE, 0);
-		gck_attributes_ref_sink (attrs);
 	} else {
 		gck_builder_init (&builder);
 		gck_builder_add_except (&builder, attrs, CKA_TOKEN, GCK_INVALID);
 		gck_builder_add_boolean (&builder, CKA_TOKEN, TRUE);
 		gck_attributes_unref (attrs);
-		attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+		attrs = gck_builder_end (&builder);
 	}
 	insert_template (handle, attrs);
 
@@ -279,9 +286,6 @@ replace_attributes (GckAttributes *atts,
 	CK_ATTRIBUTE_PTR set;
 	gulong *types;
 
-	if (!n_attrs)
-		return gck_attributes_ref_sink (atts);
-
 	gck_builder_init (&builder);
 	types = g_new0 (gulong, n_attrs);
 	for (i = 0; i < n_attrs; ++i) {
@@ -291,7 +295,7 @@ replace_attributes (GckAttributes *atts,
 	}
 	gck_builder_add_exceptv (&builder, atts, types, n_attrs);
 	g_free (types);
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 void
@@ -354,8 +358,7 @@ gck_mock_C_Initialize (CK_VOID_PTR pInitArgs)
 	gck_builder_init (&builder);
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
 	gck_builder_add_string (&builder, CKA_LABEL, "TEST LABEL");
-	insert_template (2,
-	                 gck_attributes_ref_sink (gck_builder_end (&builder)));
+	insert_template (2, gck_builder_end (&builder));
 
 	/* Private capitalize key */
 	value = CKM_MOCK_CAPITALIZE;
@@ -369,8 +372,7 @@ gck_mock_C_Initialize (CK_VOID_PTR pInitArgs)
 	gck_builder_add_boolean (&builder, CKA_DERIVE, CK_TRUE);
 	gck_builder_add_string (&builder, CKA_VALUE, "value");
 	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique1");
-	insert_template (PRIVATE_KEY_CAPITALIZE,
-	                 gck_attributes_ref_sink (gck_builder_end (&builder)));
+	insert_template (PRIVATE_KEY_CAPITALIZE, gck_builder_end (&builder));
 
 	/* Public capitalize key */
 	value = CKM_MOCK_CAPITALIZE;
@@ -393,8 +395,7 @@ gck_mock_C_Initialize (CK_VOID_PTR pInitArgs)
 	gck_builder_add_boolean (&builder, CKA_ALWAYS_AUTHENTICATE, CK_TRUE);
 	gck_builder_add_string (&builder, CKA_VALUE, "value");
 	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique3");
-	insert_template (PRIVATE_KEY_PREFIX,
-	                 gck_attributes_ref_sink (gck_builder_end (&builder)));
+	insert_template (PRIVATE_KEY_PREFIX, gck_builder_end (&builder));
 
 	/* Private prefix key */
 	value = CKM_MOCK_PREFIX;
@@ -405,8 +406,7 @@ gck_mock_C_Initialize (CK_VOID_PTR pInitArgs)
 	gck_builder_add_boolean (&builder, CKA_PRIVATE, CK_FALSE);
 	gck_builder_add_string (&builder, CKA_VALUE, "value");
 	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique4");
-	insert_template (PUBLIC_KEY_PREFIX,
-	                 gck_attributes_ref_sink (gck_builder_end (&builder)));
+	insert_template (PUBLIC_KEY_PREFIX, gck_builder_end (&builder));
 
 	logged_in = FALSE;
 	initialized = TRUE;
@@ -905,7 +905,7 @@ gck_mock_C_CreateObject (CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,
 	for (i = 0; i < ulCount; ++i)
 		gck_builder_add_data (&builder, pTemplate[i].type, pTemplate[i].pValue, pTemplate[i].ulValueLen);
 
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 	if (gck_attributes_find_boolean (attrs, CKA_PRIVATE, &priv) && priv) {
 		if (!logged_in) {
 			gck_attributes_unref (attrs);
@@ -1639,7 +1639,7 @@ gck_mock_unsupported_C_GenerateKeyPair (CK_SESSION_HANDLE hSession, CK_MECHANISM
 		                         pPublicKeyTemplate[i].pValue,
 		                         pPublicKeyTemplate[i].ulValueLen);
 	*phPublicKey = ++unique_identifier;
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 	if (gck_attributes_find_boolean (attrs, CKA_TOKEN, &token) && token)
 		g_hash_table_insert (the_objects, GUINT_TO_POINTER (*phPublicKey), attrs);
 	else
@@ -1652,7 +1652,7 @@ gck_mock_unsupported_C_GenerateKeyPair (CK_SESSION_HANDLE hSession, CK_MECHANISM
 		                         pPrivateKeyTemplate[i].pValue,
 		                         pPrivateKeyTemplate[i].ulValueLen);
 	*phPrivateKey = ++unique_identifier;
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 	if (gck_attributes_find_boolean (attrs, CKA_TOKEN, &token) && token)
 		g_hash_table_insert (the_objects, GUINT_TO_POINTER (*phPrivateKey), attrs);
 	else
@@ -1754,7 +1754,7 @@ gck_mock_unsupported_C_UnwrapKey (CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR p
 		                         pTemplate[i].pValue,
 		                         pTemplate[i].ulValueLen);
 	*phKey = ++unique_identifier;
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 	if (gck_attributes_find_boolean (attrs, CKA_TOKEN, &token) && token)
 		g_hash_table_insert (the_objects, GUINT_TO_POINTER (*phKey), attrs);
 	else
@@ -1802,7 +1802,7 @@ gck_mock_unsupported_C_DeriveKey (CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR p
 		                      pTemplate[i].ulValueLen);
 	gck_builder_add_all (&builder, attrs);
 	*phKey = ++unique_identifier;
-	copy = gck_attributes_ref_sink (gck_builder_end (&builder));
+	copy = gck_builder_end (&builder);
 	if (gck_attributes_find_boolean (copy, CKA_TOKEN, &token) && token)
 		g_hash_table_insert (the_objects, GUINT_TO_POINTER (*phKey), copy);
 	else
diff --git a/gck/gck-modules.c b/gck/gck-modules.c
index 1512eae..71a6ed9 100644
--- a/gck/gck-modules.c
+++ b/gck/gck-modules.c
@@ -195,8 +195,6 @@ gck_modules_get_slots (GList *modules, gboolean token_present)
  *
  * This call will not block but will return an enumerator immediately.
  *
- * If the @attrs [struct@Attributes] is floating, it is consumed.
- *
  * Return value: (transfer full): A new enumerator, which should be released
  * with g_object_unref().
  **/
@@ -210,7 +208,7 @@ gck_modules_enumerate_objects (GList *modules,
 	g_return_val_if_fail (attrs, NULL);
 
 	uri_data = gck_uri_data_new ();
-	uri_data->attributes = gck_attributes_ref_sink (attrs);
+	uri_data->attributes = gck_attributes_ref (attrs);
 
 	return _gck_enumerator_new_for_modules (modules, session_options, uri_data);
 }
diff --git a/gck/gck-object-cache.c b/gck/gck-object-cache.c
index 838ff16..2154867 100644
--- a/gck/gck-object-cache.c
+++ b/gck/gck-object-cache.c
@@ -91,9 +91,6 @@ gck_object_cache_get_attributes (GckObjectCache *object)
  * @attrs: (nullable): the attributes to set
  *
  * Sets the attributes cached on this object.
- *
- * If the @attrs #GckAttributes is floating, it is consumed.
- *
  */
 void
 gck_object_cache_set_attributes (GckObjectCache *object,
@@ -101,9 +98,7 @@ gck_object_cache_set_attributes (GckObjectCache *object,
 {
 	g_return_if_fail (GCK_IS_OBJECT_CACHE (object));
 
-	gck_attributes_ref_sink (attrs);
 	g_object_set (object, "attributes", attrs, NULL);
-	gck_attributes_unref (attrs);
 }
 
 /**
@@ -115,8 +110,6 @@ gck_object_cache_set_attributes (GckObjectCache *object,
  * already present in the cache it will be overridden by this value.
  *
  * This will be done in a thread-safe manner.
- *
- * If the @attrs #GckAttributes is floating, it is consumed.
  */
 void
 gck_object_cache_fill (GckObjectCache *object,
@@ -130,9 +123,7 @@ gck_object_cache_fill (GckObjectCache *object,
 	iface = GCK_OBJECT_CACHE_GET_IFACE (object);
 	g_return_if_fail (iface->fill != NULL);
 
-	gck_attributes_ref_sink (attrs);
 	(iface->fill) (object, attrs);
-	gck_attributes_unref (attrs);
 }
 
 /**
diff --git a/gck/gck-object.c b/gck/gck-object.c
index 284b1f3..606dda4 100644
--- a/gck/gck-object.c
+++ b/gck/gck-object.c
@@ -503,8 +503,6 @@ free_set_attributes (SetAttributes *args)
  *
  * Set PKCS#11 attributes on an object. This call may block for an indefinite period.
  *
- * If the @attrs #GckAttributes is floating, it is consumed.
- *
  * Return value: Whether the call was successful or not.
  **/
 gboolean
@@ -522,12 +520,8 @@ gck_object_set (GckObject *self, GckAttributes *attrs,
 	args.attrs = attrs;
 	args.object = self->pv->handle;
 
-	gck_attributes_ref_sink (attrs);
-
 	ret = _gck_call_sync (self->pv->session, perform_set_attributes, NULL, &args, cancellable, error);
 
-	gck_attributes_unref (attrs);
-
 	return ret;
 }
 
@@ -541,8 +535,6 @@ gck_object_set (GckObject *self, GckAttributes *attrs,
  *
  * Set PKCS#11 attributes on an object. This call will return
  * immediately and completes asynchronously.
- *
- * If the @attrs #GckAttributes is floating, it is consumed.
  **/
 void
 gck_object_set_async (GckObject *self, GckAttributes *attrs, GCancellable *cancellable,
@@ -558,7 +550,7 @@ gck_object_set_async (GckObject *self, GckAttributes *attrs, GCancellable *cance
 	                             NULL, sizeof (*args), free_set_attributes);
 
 	args = _gck_call_get_arguments (call);
-	args->attrs = gck_attributes_ref_sink (attrs);
+	args->attrs = gck_attributes_ref (attrs);
 	args->object = self->pv->handle;
 
 	_gck_call_async_ready_go (call, self, cancellable, callback, user_data);
@@ -724,7 +716,7 @@ gck_object_get_full (GckObject *self,
 	ret = _gck_call_sync (self->pv->session, perform_get_attributes, NULL, &args, cancellable, error);
 
 	if (ret) {
-		return gck_attributes_ref_sink (gck_builder_end (&args.builder));
+		return gck_builder_end (&args.builder);
 	} else {
 		gck_builder_clear (&args.builder);
 		return NULL;
@@ -802,7 +794,7 @@ gck_object_get_finish (GckObject *self, GAsyncResult *result, GError **error)
 	if (!_gck_call_basic_finish (result, error))
 		return NULL;
 
-	return gck_attributes_ref_sink (gck_builder_end (&args->builder));
+	return gck_builder_end (&args->builder);
 }
 
 /* ---------------------------------------------------------------------------------
@@ -1085,12 +1077,8 @@ gck_object_set_template (GckObject *self, gulong attr_type, GckAttributes *attrs
 	args.type = attr_type;
 	args.object = self->pv->handle;
 
-	gck_attributes_ref_sink (attrs);
-
 	ret = _gck_call_sync (self->pv->session, perform_set_template, NULL, &args, cancellable, error);
 
-	gck_attributes_unref (attrs);
-
 	return ret;
 }
 
@@ -1125,7 +1113,7 @@ gck_object_set_template_async (GckObject *self, gulong attr_type, GckAttributes
 	                             NULL, sizeof (*args), free_set_template);
 
 	args = _gck_call_get_arguments (call);
-	args->attrs = gck_attributes_ref_sink (attrs);
+	args->attrs = gck_attributes_ref (attrs);
 	args->type = attr_type;
 	args->object = self->pv->handle;
 
@@ -1254,7 +1242,7 @@ gck_object_get_template (GckObject *self, gulong attr_type,
 		return NULL;
 	}
 
-	return gck_attributes_ref_sink (gck_builder_end (&args.builder));
+	return gck_builder_end (&args.builder);
 }
 
 /**
@@ -1316,5 +1304,5 @@ gck_object_get_template_finish (GckObject *self, GAsyncResult *result,
 		return NULL;
 
 	args = _gck_call_async_result_arguments (result, get_template_args);
-	return gck_attributes_ref_sink (gck_builder_end (&args->builder));
+	return gck_builder_end (&args->builder);
 }
diff --git a/gck/gck-session.c b/gck/gck-session.c
index 578aaea..5f5579e 100644
--- a/gck/gck-session.c
+++ b/gck/gck-session.c
@@ -1391,8 +1391,6 @@ perform_create_object (CreateObject *args)
  * Create a new PKCS#11 object. This call may block for an
  * indefinite period.
  *
- * If the @attrs #GckAttributes is floating, it is consumed.
- *
  * Returns: (transfer full): the newly created object or %NULL if an error occurred
  **/
 GckObject *
@@ -1405,9 +1403,7 @@ gck_session_create_object (GckSession *self, GckAttributes *attrs,
 	g_return_val_if_fail (GCK_IS_SESSION (self), NULL);
 	g_return_val_if_fail (attrs != NULL, NULL);
 
-	gck_attributes_ref_sink (attrs);
 	ret = _gck_call_sync (self, perform_create_object, NULL, &args, cancellable, error);
-	gck_attributes_unref (attrs);
 
 	if (!ret)
 		return NULL;
@@ -1442,7 +1438,7 @@ gck_session_create_object_async (GckSession *self, GckAttributes *attrs,
 
 	g_return_if_fail (attrs);
 
-	args->attrs = gck_attributes_ref_sink (attrs);
+	args->attrs = gck_attributes_ref (attrs);
 
 	_gck_call_async_ready_go (call, self, cancellable, callback, user_data);
 }
@@ -1559,8 +1555,6 @@ perform_find_objects (FindObjects *args)
  * Find the objects matching the passed attributes. This call may
  * block for an indefinite period.
  *
- * If @match is a floating reference, it is consumed.
- *
  * Returns: (transfer full) (array length=n_handles) (nullable): a list of
  *          the matching objects, which may be empty
  **/
@@ -1580,13 +1574,11 @@ gck_session_find_handles (GckSession *self,
 	g_return_val_if_fail (n_handles != NULL, NULL);
 	g_return_val_if_fail (error == NULL || *error == NULL, NULL);
 
-	gck_attributes_ref_sink (match);
 	if (_gck_call_sync (self, perform_find_objects, NULL, &args, cancellable, error)) {
 		results = args.objects;
 		*n_handles = args.n_objects;
 		args.objects = NULL;
 	}
-	gck_attributes_unref (match);
 
 	g_free (args.objects);
 	return results;
@@ -1622,7 +1614,7 @@ gck_session_find_handles_async (GckSession *self,
 	call = _gck_call_async_prep (self, perform_find_objects,
 	                             NULL, sizeof (*args), free_find_objects);
 	args = _gck_call_get_arguments (call);
-	args->attrs = gck_attributes_ref_sink (match);
+	args->attrs = gck_attributes_ref (match);
 	_gck_call_async_ready_go (call, self, cancellable, callback, user_data);
 }
 
@@ -1767,8 +1759,6 @@ gck_session_find_objects_finish (GckSession *self,
  *
  * Setup an enumerator for listing matching objects available via this session.
  *
- * If @match is a floating reference, it is consumed.
- *
  * This call will not block but will return an enumerator immediately.
  *
  * Returns: (transfer full): a new enumerator
@@ -1782,7 +1772,7 @@ gck_session_enumerate_objects (GckSession *session,
 	g_return_val_if_fail (match != NULL, NULL);
 
 	uri_data = gck_uri_data_new ();
-	uri_data->attributes = gck_attributes_ref_sink (match);
+	uri_data->attributes = gck_attributes_ref (match);
 
 	return _gck_enumerator_new_for_session (session, uri_data);
 }
@@ -1870,9 +1860,6 @@ gck_session_generate_key_pair (GckSession *self, gulong mech_type,
  * Generate a new key pair of public and private keys. This call may block for an
  * indefinite period.
  *
- * If @public_attrs and/or @private_attrs is a floating reference, it is
- * consumed.
- *
  * Return value: %TRUE if the operation succeeded.
  **/
 gboolean
@@ -1896,14 +1883,8 @@ gck_session_generate_key_pair_full (GckSession *self,
 	/* Shallow copy of the mechanism structure */
 	memcpy (&args.mechanism, mechanism, sizeof (args.mechanism));
 
-	gck_attributes_ref_sink (public_attrs);
-	gck_attributes_ref_sink (private_attrs);
-
 	ret = _gck_call_sync (self, perform_generate_key_pair, NULL, &args, cancellable, error);
 
-	gck_attributes_unref (private_attrs);
-	gck_attributes_unref (public_attrs);
-
 	if (!ret)
 		return FALSE;
 
@@ -1951,8 +1932,8 @@ gck_session_generate_key_pair_async (GckSession *self, GckMechanism *mechanism,
 	/* Shallow copy of the mechanism structure */
 	memcpy (&args->mechanism, mechanism, sizeof (args->mechanism));
 
-	args->public_attrs = gck_attributes_ref_sink (public_attrs);
-	args->private_attrs = gck_attributes_ref_sink (private_attrs);
+	args->public_attrs = gck_attributes_ref (public_attrs);
+	args->private_attrs = gck_attributes_ref (private_attrs);
 
 	_gck_call_async_ready_go (call, self, cancellable, callback, user_data);
 }
@@ -2236,8 +2217,6 @@ perform_unwrap_key (UnwrapKey *args)
  * Unwrap a key from a byte stream. This call may block for an
  * indefinite period.
  *
- * If @attrs is a floating reference, it is consumed.
- *
  * Returns: (transfer full): the new unwrapped key or %NULL if the
  *          operation failed
  **/
@@ -2269,8 +2248,6 @@ gck_session_unwrap_key (GckSession *self,
  * Unwrap a key from a byte stream. This call may block for an
  * indefinite period.
  *
- * If @attrs is a floating reference, it is consumed.
- *
  * Returns: (transfer full): the new unwrapped key or %NULL if the operation
  *          failed
  **/
@@ -2298,12 +2275,8 @@ gck_session_unwrap_key_full (GckSession *self,
 	g_object_get (wrapper, "handle", &args.wrapper, NULL);
 	g_return_val_if_fail (args.wrapper != 0, NULL);
 
-	gck_attributes_ref_sink (attrs);
-
 	ret = _gck_call_sync (self, perform_unwrap_key, NULL, &args, cancellable, error);
 
-	gck_attributes_unref (attrs);
-
 	if (!ret)
 		return NULL;
 
@@ -2324,8 +2297,6 @@ gck_session_unwrap_key_full (GckSession *self,
  *
  * Unwrap a key from a byte stream. This call will
  * return immediately and complete asynchronously.
- *
- * If @attrs is a floating reference, it is consumed.
  **/
 void
 gck_session_unwrap_key_async (GckSession *self,
@@ -2355,7 +2326,7 @@ gck_session_unwrap_key_async (GckSession *self,
 	/* Shallow copy of the mechanism structure */
 	memcpy (&args->mechanism, mechanism, sizeof (args->mechanism));
 
-	args->attrs = gck_attributes_ref_sink (attrs);
+	args->attrs = gck_attributes_ref (attrs);
 	args->input = input;
 	args->n_input = n_input;
 
@@ -2459,8 +2430,6 @@ gck_session_derive_key (GckSession *self, GckObject *base, gulong mech_type,
  * Derive a key from another key. This call may block for an
  * indefinite period.
  *
- * If the @attrs #GckAttributes is floating, it is consumed.
- *
  * Returns: (transfer full): the new derived key or %NULL if the operation
  *          failed
  **/
@@ -2482,12 +2451,8 @@ gck_session_derive_key_full (GckSession *self, GckObject *base, GckMechanism *me
 	g_object_get (base, "handle", &args.key, NULL);
 	g_return_val_if_fail (args.key != 0, NULL);
 
-	gck_attributes_ref_sink (attrs);
-
 	ret = _gck_call_sync (self, perform_derive_key, NULL, &args, cancellable, error);
 
-	gck_attributes_unref (attrs);
-
 	if (!ret)
 		return NULL;
 
@@ -2506,8 +2471,6 @@ gck_session_derive_key_full (GckSession *self, GckObject *base, GckMechanism *me
  *
  * Derive a key from another key. This call will
  * return immediately and complete asynchronously.
- *
- * If the @attrs #GckAttributes is floating, it is consumed.
  **/
 void
 gck_session_derive_key_async (GckSession *self, GckObject *base, GckMechanism *mechanism,
@@ -2531,7 +2494,7 @@ gck_session_derive_key_async (GckSession *self, GckObject *base, GckMechanism *m
 	/* Shallow copy of the mechanism structure */
 	memcpy (&args->mechanism, mechanism, sizeof (args->mechanism));
 
-	args->attrs = gck_attributes_ref_sink (attrs);
+	args->attrs = gck_attributes_ref (attrs);
 
 	_gck_call_async_ready_go (call, self, cancellable, callback, user_data);
 }
diff --git a/gck/gck-slot.c b/gck/gck-slot.c
index cfa86a2..a2b4a7c 100644
--- a/gck/gck-slot.c
+++ b/gck/gck-slot.c
@@ -925,8 +925,6 @@ gck_slot_enumerate_objects (GckSlot *self,
  *
  * Setup an enumerator for listing matching objects on the slots.
  *
- * If the @match #GckAttributes is floating, it is consumed.
- *
  * This call will not block but will return an enumerator immediately.
  *
  * Returns: (transfer full): a new enumerator
@@ -941,7 +939,7 @@ gck_slots_enumerate_objects (GList *slots,
 	g_return_val_if_fail (match != NULL, NULL);
 
 	uri_data = gck_uri_data_new ();
-	uri_data->attributes = gck_attributes_ref_sink (match);
+	uri_data->attributes = gck_attributes_ref (match);
 
 	return _gck_enumerator_new_for_slots (slots, options, uri_data);
 }
diff --git a/gck/gck-uri.c b/gck/gck-uri.c
index 6945980..e034ed5 100644
--- a/gck/gck-uri.c
+++ b/gck/gck-uri.c
@@ -196,7 +196,7 @@ gck_uri_data_parse (const gchar *string, GckUriFlags flags, GError **error)
 		gck_builder_init (&builder);
 		for (i = 0; i < n_attrs; ++i)
 			gck_builder_add_data (&builder, attrs[i].type, attrs[i].pValue, attrs[i].ulValueLen);
-		uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+		uri_data->attributes = gck_builder_end (&builder);
 	}
 	uri_data->any_unrecognized = p11_kit_uri_any_unrecognized (p11_uri);
 
diff --git a/gck/gck.h b/gck/gck.h
index b22d2ca..0b6695f 100644
--- a/gck/gck.h
+++ b/gck/gck.h
@@ -331,8 +331,6 @@ gboolean             gck_builder_find_date                  (GckBuilder *builder
                                                              gulong attr_type,
                                                              GDate *value);
 
-GckAttributes *      gck_builder_steal                      (GckBuilder *builder);
-
 GckAttributes *      gck_builder_end                        (GckBuilder *builder);
 
 GckBuilder *         gck_builder_copy                       (GckBuilder *builder);
@@ -345,7 +343,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC (GckBuilder, gck_builder_unref);
 
 GType                gck_attributes_get_type                (void) G_GNUC_CONST;
 
-GckAttributes *      gck_attributes_new                     (gulong reserved);
+GckAttributes *      gck_attributes_new                     (void);
 
 GckAttributes *      gck_attributes_new_empty               (gulong first_type,
                                                              ...);
@@ -376,8 +374,6 @@ gulong               gck_attributes_count                   (GckAttributes *attr
 
 GckAttributes *      gck_attributes_ref                     (GckAttributes *attrs);
 
-GckAttributes *      gck_attributes_ref_sink                (GckAttributes *attrs);
-
 void                 gck_attributes_unref                   (gpointer attrs);
 
 gboolean             gck_attributes_contains                (GckAttributes *attrs,
diff --git a/gck/gck.symbols b/gck/gck.symbols
index ae784c9..0bd62e5 100644
--- a/gck/gck.symbols
+++ b/gck/gck.symbols
@@ -55,7 +55,6 @@ gck_attributes_new
 gck_attributes_new_empty
 gck_attributes_new_full
 gck_attributes_ref
-gck_attributes_ref_sink
 gck_attributes_set
 gck_attributes_set_all
 gck_attributes_set_boolean
@@ -99,7 +98,6 @@ gck_builder_set_empty
 gck_builder_set_invalid
 gck_builder_set_string
 gck_builder_set_ulong
-gck_builder_steal
 gck_builder_take_data
 gck_builder_unref
 gck_enumerator_get_chained
diff --git a/gck/test-gck-crypto.c b/gck/test-gck-crypto.c
index e6286ff..2bc535c 100644
--- a/gck/test-gck-crypto.c
+++ b/gck/test-gck-crypto.c
@@ -115,12 +115,15 @@ find_key (GckSession *session, CK_ATTRIBUTE_TYPE method, CK_MECHANISM_TYPE mech)
 	GckBuilder builder = GCK_BUILDER_INIT;
 	GList *objects, *l;
 	GckObject *object = NULL;
+	GckAttributes *attributes;
 	CK_MECHANISM_TYPE_PTR mechs;
 	gboolean match;
 	gsize n_mechs;
 
 	gck_builder_add_boolean (&builder, method, TRUE);
-	objects = gck_session_find_objects (session, gck_builder_end (&builder), NULL, NULL);
+	attributes = gck_builder_end (&builder);
+	objects = gck_session_find_objects (session, attributes, NULL, NULL);
+	gck_attributes_unref (attributes);
 	g_assert_nonnull (objects);
 
 	for (l = objects; l; l = g_list_next (l)) {
@@ -150,11 +153,14 @@ static GckObject*
 find_key_with_value (GckSession *session, const gchar *value)
 {
 	GckBuilder builder = GCK_BUILDER_INIT;
+	GckAttributes *attributes;
 	GList *objects;
 	GckObject *object;
 
 	gck_builder_add_string (&builder, CKA_VALUE, value);
-	objects = gck_session_find_objects (session, gck_builder_end (&builder), NULL, NULL);
+	attributes = gck_builder_end (&builder);
+	objects = gck_session_find_objects (session, attributes, NULL, NULL);
+	gck_attributes_unref (attributes);
 	g_assert_nonnull (objects);
 
 	object = g_object_ref (objects->data);
@@ -402,9 +408,9 @@ test_generate_key_pair (Test *test, gconstpointer unused)
 	gboolean ret;
 
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PUBLIC_KEY);
-	pub_attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	pub_attrs = gck_builder_end (&builder);
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PRIVATE_KEY);
-	prv_attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	prv_attrs = gck_builder_end (&builder);
 
 	/* Full One*/
 	ret = gck_session_generate_key_pair_full (test->session, &mech, pub_attrs, prv_attrs,
@@ -534,7 +540,7 @@ test_unwrap_key (Test *test, gconstpointer unused)
 
 	wrapper = find_key (test->session, CKA_UNWRAP, 0);
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_SECRET_KEY);
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	/* Full One*/
 	unwrapped = gck_session_unwrap_key_full (test->session, wrapper, &mech, (const guchar *)"special", 7, attrs, NULL, &error);
@@ -590,7 +596,7 @@ test_derive_key (Test *test, gconstpointer unused)
 
 	wrapper = find_key (test->session, CKA_DERIVE, 0);
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_SECRET_KEY);
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	/* Full One*/
 	derived = gck_session_derive_key_full (test->session, wrapper, &mech, attrs, NULL, &error);
diff --git a/gck/test-gck-enumerator.c b/gck/test-gck-enumerator.c
index addfe33..4776ce5 100644
--- a/gck/test-gck-enumerator.c
+++ b/gck/test-gck-enumerator.c
@@ -230,6 +230,7 @@ test_enumerate_session (Test *test,
                         gconstpointer unused)
 {
 	GckBuilder builder = GCK_BUILDER_INIT;
+	GckAttributes *attributes;
 	GckEnumerator *en;
 	GError *error = NULL;
 	GckSession *session;
@@ -243,7 +244,9 @@ test_enumerate_session (Test *test,
 	session = gck_session_open (slots->data, 0, NULL, NULL, &error);
 	g_assert_no_error (error);
 
-	en = gck_session_enumerate_objects (session, gck_builder_end (&builder));
+	attributes = gck_builder_end (&builder);
+	en = gck_session_enumerate_objects (session, attributes);
+	gck_attributes_unref (attributes);
 	g_assert_true (GCK_IS_ENUMERATOR (en));
 
 	obj = gck_enumerator_next (en, NULL, &error);
@@ -266,7 +269,7 @@ test_attribute_match (Test *test, gconstpointer unused)
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_string (&builder, CKA_LABEL, "Private Capitalize Key");
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 	en = _gck_enumerator_new_for_modules (test->modules, 0, uri_data);
 	g_assert_true (GCK_IS_ENUMERATOR (en));
 
@@ -446,7 +449,7 @@ mock_object_fill (GckObjectCache *object,
 	gck_builder_set_all (&builder, attrs);
 
 	gck_attributes_unref (self->attrs);
-	self->attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	self->attrs = gck_builder_end (&builder);
 }
 
 static void
@@ -528,18 +531,18 @@ test_chained (Test *test,
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PUBLIC_KEY);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 	one = _gck_enumerator_new_for_modules (test->modules, 0, uri_data);
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PRIVATE_KEY);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 	two = _gck_enumerator_new_for_modules (test->modules, 0, uri_data);
 	gck_enumerator_set_chained (one, two);
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 	three = _gck_enumerator_new_for_modules (test->modules, 0, uri_data);
 	gck_enumerator_set_chained (two, three);
 
diff --git a/gck/test-gck-modules.c b/gck/test-gck-modules.c
index 6ef994e..96928da 100644
--- a/gck/test-gck-modules.c
+++ b/gck/test-gck-modules.c
@@ -67,10 +67,13 @@ test_enumerate_objects (Test *test, gconstpointer unused)
 	GckBuilder builder = GCK_BUILDER_INIT;
 	GError *error = NULL;
 	GckEnumerator *en;
+	GckAttributes *attributes;
 	GList *objects;
 
 	gck_builder_add_string (&builder, CKA_LABEL, "Private Capitalize Key");
-	en = gck_modules_enumerate_objects (test->modules, gck_builder_end (&builder), 0);
+	attributes = gck_builder_end (&builder);
+	en = gck_modules_enumerate_objects (test->modules, attributes, 0);
+	gck_attributes_unref (attributes);
 	g_assert_true (GCK_IS_ENUMERATOR (en));
 
 	objects = gck_enumerator_next_n (en, -1, NULL, &error);
diff --git a/gck/test-gck-object.c b/gck/test-gck-object.c
index 438ce76..294fe4d 100644
--- a/gck/test-gck-object.c
+++ b/gck/test-gck-object.c
@@ -152,7 +152,7 @@ test_create_object (Test *test, gconstpointer unused)
 	gck_builder_add_string (&builder, CKA_LABEL, "TEST LABEL");
 	gck_builder_add_boolean (&builder, CKA_TOKEN, CK_FALSE);
 	gck_builder_add_data (&builder, CKA_VALUE, (const guchar *)"BLAH", 4);
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	object = gck_session_create_object (test->session, attrs, NULL, &err);
 	g_assert_true (GCK_IS_OBJECT (object));
@@ -190,7 +190,7 @@ test_destroy_object (Test *test, gconstpointer unused)
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
 	gck_builder_add_string (&builder, CKA_LABEL, "TEST OBJECT");
 	gck_builder_add_boolean (&builder, CKA_TOKEN, CK_TRUE);
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	/* Using simple */
 	object = gck_session_create_object (test->session, attrs, NULL, &err);
@@ -322,7 +322,9 @@ test_set_attributes (Test *test, gconstpointer unused)
 	gck_builder_add_string (&builder, CKA_LABEL, "CHANGE TWO");
 
 	/* Full */
-	ret = gck_object_set (test->object, gck_builder_end (&builder), NULL, &err);
+	attrs = gck_builder_end (&builder);
+	ret = gck_object_set (test->object, attrs, NULL, &err);
+	gck_attributes_unref (attrs);
 	g_assert_no_error (err);
 	g_assert_true (ret);
 	attrs = gck_object_get (test->object, NULL, &err, CKA_CLASS, CKA_LABEL, GCK_INVALID);
@@ -335,7 +337,9 @@ test_set_attributes (Test *test, gconstpointer unused)
 	gck_builder_add_string (&builder, CKA_LABEL, "CHANGE THREE");
 
 	/* Async */
-	gck_object_set_async (test->object, gck_builder_end (&builder), NULL, fetch_async_result, &result);
+	attrs = gck_builder_end (&builder);
+	gck_object_set_async (test->object, attrs, NULL, fetch_async_result, &result);
+	gck_attributes_unref (attrs);
 	egg_test_wait_until (500);
 	g_assert_nonnull (result);
 
@@ -355,36 +359,47 @@ test_find_objects (Test *test, gconstpointer unused)
 {
 	GckBuilder builder = GCK_BUILDER_INIT;
 	GAsyncResult *result = NULL;
+	GckAttributes *attributes;
 	GList *objects;
 	GckObject *testobj;
 	GError *err = NULL;
 
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
 	gck_builder_add_string (&builder, CKA_LABEL, "UNIQUE LABEL");
-	testobj = gck_session_create_object (test->session, gck_builder_end (&builder), NULL, &err);
+	attributes = gck_builder_end (&builder);
+	testobj = gck_session_create_object (test->session, attributes, NULL, &err);
+	gck_attributes_unref (attributes);
 	g_object_unref (testobj);
 
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
 	gck_builder_add_string (&builder, CKA_LABEL, "OTHER LABEL");
-	testobj = gck_session_create_object (test->session, gck_builder_end (&builder), NULL, &err);
+	attributes = gck_builder_end (&builder);
+	testobj = gck_session_create_object (test->session, attributes, NULL, &err);
+	gck_attributes_unref (attributes);
 	g_object_unref (testobj);
 
 	/* Simple, "TEST LABEL" */
 	gck_builder_add_string (&builder, CKA_LABEL, "UNIQUE LABEL");
-	objects = gck_session_find_objects (test->session, gck_builder_end (&builder), NULL, &err);
+	attributes = gck_builder_end (&builder);
+	objects = gck_session_find_objects (test->session, attributes, NULL, &err);
+	gck_attributes_unref (attributes);
 	g_assert_no_error (err);
 	g_assert_cmpuint (g_list_length (objects), ==, 1);
 	gck_list_unref_free (objects);
 
 	/* Full, All */
-	objects = gck_session_find_objects (test->session, gck_builder_end (&builder), NULL, &err);
+	attributes = gck_builder_end (&builder);
+	objects = gck_session_find_objects (test->session, attributes, NULL, &err);
+	gck_attributes_unref (attributes);
 	g_assert_no_error (err);
 	g_assert_cmpuint (g_list_length (objects), >, 1);
 	gck_list_unref_free (objects);
 
 	/* Async, None */
 	gck_builder_add_string (&builder, CKA_LABEL, "blah blah");
-	gck_session_find_objects_async (test->session, gck_builder_end (&builder), NULL, fetch_async_result, &result);
+	attributes = gck_builder_end (&builder);
+	gck_session_find_objects_async (test->session, attributes, NULL, fetch_async_result, &result);
+	gck_attributes_unref (attributes);
 	egg_test_wait_until (500);
 	g_assert_nonnull (result);
 
diff --git a/gck/test-gck-session.c b/gck/test-gck-session.c
index 4a8ab48..055a92d 100644
--- a/gck/test-gck-session.c
+++ b/gck/test-gck-session.c
@@ -433,7 +433,7 @@ test_auto_login (Test *test, gconstpointer unused)
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
 	gck_builder_add_string (&builder, CKA_LABEL, "TEST OBJECT");
 	gck_builder_add_boolean (&builder, CKA_PRIVATE, CK_TRUE);
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	/* Try to do something that requires a login */
 	object = gck_session_create_object (test->session, attrs, NULL, &err);
diff --git a/gck/test-gck-uri.c b/gck/test-gck-uri.c
index 1254fc9..1d76975 100644
--- a/gck/test-gck-uri.c
+++ b/gck/test-gck-uri.c
@@ -325,7 +325,7 @@ test_build_with_attributes (void)
 	gck_builder_add_string (&builder, CKA_LABEL, "The Label");
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);
 	gck_builder_add_data (&builder, CKA_ID, (const guchar *)"TEST", 5);
-	uri_data.attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data.attributes = gck_builder_end (&builder);
 
 	uri = gck_uri_data_build (&uri_data, GCK_URI_FOR_OBJECT);
 	g_assert_nonnull (uri);
@@ -426,7 +426,7 @@ test_build_objecttype_cert (void)
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_CERTIFICATE);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 
 	uri = gck_uri_data_build (uri_data, GCK_URI_FOR_OBJECT);
 	g_assert_nonnull (uri);
@@ -445,7 +445,7 @@ test_build_objecttype_private (void)
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PRIVATE_KEY);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 
 	uri = gck_uri_data_build (uri_data, GCK_URI_FOR_OBJECT);
 	g_assert_nonnull (uri);
@@ -464,7 +464,7 @@ test_build_objecttype_public (void)
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PUBLIC_KEY);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 
 	uri = gck_uri_data_build (uri_data, GCK_URI_FOR_OBJECT);
 	g_assert_nonnull (uri);
@@ -484,7 +484,7 @@ test_build_objecttype_secret (void)
 
 	uri_data = gck_uri_data_new ();
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_SECRET_KEY);
-	uri_data->attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	uri_data->attributes = gck_builder_end (&builder);
 
 	uri = gck_uri_data_build (uri_data, GCK_URI_FOR_OBJECT);
 	g_assert_nonnull (uri);
diff --git a/gcr/gcr-importer.c b/gcr/gcr-importer.c
index 5e41ab3..f1916f0 100644
--- a/gcr/gcr-importer.c
+++ b/gcr/gcr-importer.c
@@ -128,11 +128,9 @@ gcr_importer_default_init (GcrImporterInterface *iface)
 /**
  * gcr_importer_register:
  * @importer_type: the GType of the importer being registered
- * @attrs: the attributes that this importer is compatible with
+ * @attrs: (transfer full): the attributes that this importer is compatible with
  *
  * Register an importer to handle parsed items that match the given attributes.
- *
- * If @attrs are a floating reference, then it is consumed.
  */
 void
 gcr_importer_register (GType importer_type,
@@ -144,7 +142,7 @@ gcr_importer_register (GType importer_type,
 		registered_importers = g_array_new (FALSE, FALSE, sizeof (GcrRegistered));
 
 	registered.importer_type = importer_type;
-	registered.attrs = gck_attributes_ref_sink (attrs);
+	registered.attrs = attrs;
 	g_array_append_val (registered_importers, registered);
 	registered_sorted = FALSE;
 }
diff --git a/gcr/gcr-openssh.c b/gcr/gcr-openssh.c
index af4d550..a4b7ebe 100644
--- a/gcr/gcr-openssh.c
+++ b/gcr/gcr-openssh.c
@@ -230,7 +230,7 @@ parse_v1_public_line (const gchar *line,
 	if (word_options)
 		options = g_strndup (word_options, len_options);
 
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	if (callback != NULL) {
 		bytes = g_bytes_new_with_free_func (outer, n_outer,
@@ -542,7 +542,7 @@ parse_v2_public_line (const gchar *line,
 		gck_builder_add_string (&builder, CKA_LABEL, label);
 	}
 
-	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attrs = gck_builder_end (&builder);
 
 	if (callback != NULL) {
 		bytes = g_bytes_new_with_free_func (outer, n_outer,
diff --git a/gcr/gcr-parser.c b/gcr/gcr-parser.c
index ba3927e..1de17f9 100644
--- a/gcr/gcr-parser.c
+++ b/gcr/gcr-parser.c
@@ -482,7 +482,7 @@ parsed_fire (GcrParser *self,
 	g_assert (parsed == self->pv->parsed);
 	g_assert (parsed->attrs == NULL);
 
-	parsed->attrs = gck_attributes_ref_sink (gck_builder_end (&parsed->builder));
+	parsed->attrs = gck_builder_end (&parsed->builder);
 
 	g_object_notify (G_OBJECT (self), "parsed-description");
 	g_object_notify (G_OBJECT (self), "parsed-attributes");
diff --git a/gcr/gcr-pkcs11-certificate.c b/gcr/gcr-pkcs11-certificate.c
index e3c3b55..db35aba 100644
--- a/gcr/gcr-pkcs11-certificate.c
+++ b/gcr/gcr-pkcs11-certificate.c
@@ -74,7 +74,7 @@ prepare_lookup_certificate_issuer (GcrCertificate *cert)
 	gck_builder_add_data (&builder, CKA_SUBJECT, data, n_data);
 	g_free (data);
 
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 static GcrCertificate*
diff --git a/gcr/gcr-pkcs11-importer.c b/gcr/gcr-pkcs11-importer.c
index b686742..8f65f35 100644
--- a/gcr/gcr-pkcs11-importer.c
+++ b/gcr/gcr-pkcs11-importer.c
@@ -306,7 +306,7 @@ supplement_attributes (GcrPkcs11Importer *self,
 		}
 
 		gck_attributes_unref (attrs);
-		l->data = attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+		l->data = attrs = gck_builder_end (&builder);
 
 		switch (klass) {
 		case CKO_CERTIFICATE:
@@ -340,14 +340,14 @@ supplement_attributes (GcrPkcs11Importer *self,
 			supplement_with_attributes (&builder, supplements);
 			supplement_id_for_data (&builder, nonce, sizeof (nonce),
 			                        fingerprint, strlen (fingerprint));
-			g_queue_push_tail (queue, gck_attributes_ref_sink (gck_builder_end (&builder)));
+			g_queue_push_tail (queue, gck_builder_end (&builder));
 			g_hash_table_insert (paired, pair->private_key, "present");
 
 			gck_builder_add_all (&builder, pair->certificate);
 			supplement_with_attributes (&builder, supplements);
 			supplement_id_for_data (&builder, nonce, sizeof (nonce),
 			                        fingerprint, strlen (fingerprint));
-			g_queue_push_tail (queue, gck_attributes_ref_sink (gck_builder_end (&builder)));
+			g_queue_push_tail (queue, gck_builder_end (&builder));
 			g_hash_table_insert (paired, pair->certificate, "present");
 
 			/* Used the suplements for the pairs, don't use for unpaired stuff */
@@ -371,7 +371,7 @@ supplement_attributes (GcrPkcs11Importer *self,
 			supplement_id_for_data (&builder, nonce, sizeof (nonce),
 			                        &attrs, sizeof (gpointer));
 
-			g_queue_push_tail (queue, gck_attributes_ref_sink (gck_builder_end (&builder)));
+			g_queue_push_tail (queue, gck_builder_end (&builder));
 		}
 	}
 
@@ -392,7 +392,7 @@ complete_supplement (GTask *task,
 	GckAttributes *attributes;
 
 	if (error == NULL) {
-		attributes = gck_attributes_ref_sink (gck_builder_end (data->supplement));
+		attributes = gck_builder_end (data->supplement);
 		supplement_attributes (data->importer, attributes);
 		gck_attributes_unref (attributes);
 
@@ -911,7 +911,9 @@ _gcr_pkcs11_importer_queue (GcrPkcs11Importer *self,
 		gck_builder_add_all (&builder, attrs);
 		gck_builder_add_string (&builder, CKA_LABEL, label);
 		attrs = gck_builder_end (&builder);
+	} else {
+		gck_attributes_ref (attrs);
 	}
 
-	g_queue_push_tail (self->queue, gck_attributes_ref_sink (attrs));
+	g_queue_push_tail (self->queue, attrs);
 }
diff --git a/gcr/gcr-subject-public-key.c b/gcr/gcr-subject-public-key.c
index 7ff78f4..1a3f383 100644
--- a/gcr/gcr-subject-public-key.c
+++ b/gcr/gcr-subject-public-key.c
@@ -206,7 +206,9 @@ lookup_public_key (GckObject *object,
 	gck_attributes_unref (attrs);
 
 	session = gck_object_get_session (object);
-	objects = gck_session_find_objects (session, gck_builder_end (&builder), cancellable, &error);
+	attrs = gck_builder_end (&builder);
+	objects = gck_session_find_objects (session, attrs, cancellable, &error);
+	gck_attributes_unref (attrs);
 	g_object_unref (session);
 
 	if (error != NULL) {
@@ -567,7 +569,7 @@ _gcr_subject_public_key_load_finish (GAsyncResult *result,
 		return NULL;
 
 	closure = g_task_get_task_data (G_TASK (result));
-	attributes = gck_attributes_ref_sink (gck_builder_end (&closure->builder));
+	attributes = gck_builder_end (&closure->builder);
 	asn = _gcr_subject_public_key_for_attributes (attributes);
 	if (asn == NULL) {
 		g_set_error_literal (error, GCK_ERROR, CKR_TEMPLATE_INCONSISTENT,
diff --git a/gcr/gcr-trust.c b/gcr/gcr-trust.c
index 16e1d87..c6ac4de 100644
--- a/gcr/gcr-trust.c
+++ b/gcr/gcr-trust.c
@@ -93,7 +93,7 @@ prepare_is_certificate_pinned (GcrCertificate *certificate, const gchar *purpose
 	gck_builder_add_string (&builder, CKA_X_PURPOSE, purpose);
 	gck_builder_add_string (&builder, CKA_X_PEER, peer);
 
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 static gboolean
@@ -255,7 +255,7 @@ prepare_add_pinned_certificate (GcrCertificate *certificate, const gchar *purpos
 	gck_builder_add_string (&builder, CKA_X_PEER, peer);
 	gck_builder_add_boolean (&builder, CKA_TOKEN, TRUE);
 
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 static gboolean
@@ -309,7 +309,8 @@ perform_add_pinned_certificate (GckAttributes *search,
 	} else {
 		session = gck_slot_open_session (slot, CKF_RW_SESSION, NULL, NULL, &lerr);
 		if (session != NULL) {
-			object = gck_session_create_object (session, gck_builder_end (&builder),
+			GckAttributes *attrs = gck_builder_end (&builder);
+			object = gck_session_create_object (session, attrs,
 			                                    cancellable, &lerr);
 			if (object != NULL) {
 				g_object_unref (object);
@@ -317,6 +318,7 @@ perform_add_pinned_certificate (GckAttributes *search,
 			}
 
 			g_object_unref (session);
+			gck_attributes_unref (attrs);
 		}
 
 		g_object_unref (slot);
@@ -461,7 +463,7 @@ prepare_remove_pinned_certificate (GcrCertificate *certificate, const gchar *pur
 	gck_builder_add_string (&builder, CKA_X_PURPOSE, purpose);
 	gck_builder_add_string (&builder, CKA_X_PEER, peer);
 
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 static gboolean
@@ -638,7 +640,7 @@ prepare_is_certificate_anchored (GcrCertificate *certificate, const gchar *purpo
 	prepare_trust_attrs (certificate, CKT_X_ANCHORED_CERTIFICATE, &builder);
 	gck_builder_add_string (&builder, CKA_X_PURPOSE, purpose);
 
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 static gboolean
diff --git a/gcr/test-fingerprint.c b/gcr/test-fingerprint.c
index 4932560..002e082 100644
--- a/gcr/test-fingerprint.c
+++ b/gcr/test-fingerprint.c
@@ -115,7 +115,7 @@ build_attributes_for_cert (GBytes *data)
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_CERTIFICATE);
 	gck_builder_add_ulong (&builder, CKA_CERTIFICATE_TYPE, CKC_X_509);
 
-	return gck_attributes_ref_sink (gck_builder_end (&builder));
+	return gck_builder_end (&builder);
 }
 
 static GBytes *
diff --git a/gcr/test-subject-public-key.c b/gcr/test-subject-public-key.c
index 1b52dd3..e213d99 100644
--- a/gcr/test-subject-public-key.c
+++ b/gcr/test-subject-public-key.c
@@ -491,7 +491,7 @@ mock_object_fill (GckObjectCache *object,
 	gck_builder_set_all (&builder, attrs);
 
 	gck_attributes_unref (self->attrs);
-	self->attrs = gck_attributes_ref_sink (gck_builder_end (&builder));
+	self->attrs = gck_builder_end (&builder);
 }
 
 static void
@@ -568,7 +568,7 @@ perform_load_partial (TestLoading *test,
 
 	for (i = 0; i < gck_attributes_count (attributes); i += 2)
 		gck_builder_add_attribute (&builder, gck_attributes_at (attributes, i));
-	partial = gck_attributes_ref_sink (gck_builder_end (&builder));
+	partial = gck_builder_end (&builder);
 
 	object = g_object_new (mock_object_get_type (),
 	                       "module", test->mo.module,
@@ -649,7 +649,7 @@ test_load_failure_build (TestModule *test,
 	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_CERTIFICATE);
 	gck_builder_add_ulong (&builder, CKA_CERTIFICATE_TYPE, CKC_X_509);
 	gck_builder_add_string (&builder, CKA_VALUE, "invalid value");
-	attributes = gck_attributes_ref_sink (gck_builder_end (&builder));
+	attributes = gck_builder_end (&builder);
 
 	object = g_object_new (mock_object_get_type (),
 	                       "module", test->module,