From 6597563da7bb359eac57c8fb70e4efc3d6ef4c02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= Date: Fri, 5 Jun 2026 11:43:07 +0200 Subject: [PATCH] package/gnutls: add host support for pkcs11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Future U-Boot 2026.07 will build mkeficapsule with pkcs11 support. [1] This causes link errors with Buildroot, such as the following one: mkeficapsule.c:(.text.startup+0xcd3): undefined reference to `gnutls_pkcs11_init' (Other symbols the linker complains about are: gnutls_pkcs11_add_provider, gnutls_pkcs11_obj_list_import_url4, gnutls_x509_crt_import_pkcs11 and gnutls_pkcs11_deinit.) The following example commands can be used to reproduce the issue: make qemu_aarch64_ebbr_defconfig echo 'BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.07-rc3"' >>.config echo 'BR2_TARGET_UBOOT_NEEDS_GNUTLS=y' >>.config echo '# BR2_DOWNLOAD_FORCE_CHECK_HASHES is not set' >>.config make olddefconfig make uboot This commit adds the pkcs11 support for host-gnutls. In Buildroot, since host-gnutls is currently only needed by uboot (and other uboot derivatives such as uboot-tools) the pkcs11 support is added unconditionally to host-gnutls. Link: https://github.com/u-boot/u-boot/commit/0c716a157be460006a4b762625de329b5e36dbf9 [1] Signed-off-by: Vincent Stehlé Signed-off-by: Fiona Klute --- package/gnutls/gnutls.mk | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/package/gnutls/gnutls.mk b/package/gnutls/gnutls.mk index 6411a7d621..ae1caaa221 100644 --- a/package/gnutls/gnutls.mk +++ b/package/gnutls/gnutls.mk @@ -43,7 +43,8 @@ GNUTLS_CONF_ENV = gl_cv_socket_ipv6=yes \ gl_cv_func_gettimeofday_clobber=no GNUTLS_INSTALL_STAGING = YES -HOST_GNUTLS_DEPENDENCIES = host-pkgconf host-libtasn1 host-libunistring host-nettle +HOST_GNUTLS_DEPENDENCIES = host-pkgconf host-libtasn1 host-libunistring \ + host-nettle host-p11-kit HOST_GNUTLS_CONF_OPTS = \ --disable-doc \ --disable-libdane \ @@ -64,7 +65,7 @@ HOST_GNUTLS_CONF_OPTS = \ --disable-openssl-compatibility \ --without-brotli \ --without-idn \ - --without-p11-kit \ + --with-p11-kit \ --without-zlib \ --without-zstd