mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-22 17:02:01 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/uboot-tools: do not require OpenSSL PKCS#11 provider

Browse Source 
Patch 0003-Add-support-for-OpenSSL-Provider-API.patch makes
package/uboot-tools build without the OpenSSL engine API, but it fails
at runtime if pkcs11-provider [1] is not available. That provider is
not packaged in Buildroot, and should not be required when not
actually using PKCS#11 keys.

The problem has been discussed on the U-Boot mailing list [2], and
part of the reason this patch has not been merged into U-Boot yet. It
causes tests.package.test_uboot_tools.TestHostUbootTools to fail with:

=== STDOUT/STDERR ===
At main.c:259:
- SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_dlfcn.c:115
- SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_lib.c:147
- SSL error:07880025:common libcrypto routines::reason(37): crypto/provider_core.c:1026
mkimage: OSSL_PROVIDER_try_load(pkcs11)

This commit adjust the patch as suggested in [2] to continue if the
PKCS#11 provider fails to load, making the test work. However,
actually using PKCS#11 keys will not work until pkcs11-provider [1] is
packaged.

[1] https://github.com/openssl-projects/pkcs11-provider
[2] https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html

Fixes: f87cf2d623 ("package/uboot-tools: Fix build with OpenSSL 4.0.0")

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Fiona Klute (othermo GmbH)
2026-10-16 17:28:08 +02:00
committed by Julien Olivain
parent 1923f760bb
commit 6d666b46f2
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch
View File

@@ -29,6 +29,8 @@ Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
Upstream: https://github.com/u-boot/u-boot/pull/918
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Fiona: apply fix from https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html to make pkcs11 provider optional]
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
lib/aes/aes-encrypt.c | 4 +-
lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++---
@@ -149,10 +151,10 @@ index 0e38c9e802f..f456f3c58e6 100644
+ EVP_PKEY *private_key = NULL;
+ OSSL_STORE_CTX *store;
+
+ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
+ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
+ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
+ ERR(1, "OSSL_PROVIDER_try_load(default)");
+ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
+ ERR_clear_error();
+
+ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
+ ERR(!store, "OSSL_STORE_open");