From 6d666b46f2d35adf6462300dbc959ecccbd4a5b0 Mon Sep 17 00:00:00 2001 From: "Fiona Klute (othermo GmbH)" Date: Fri, 16 Oct 2026 17:28:08 +0200 Subject: [PATCH] package/uboot-tools: do not require OpenSSL PKCS#11 provider Patch 0003-Add-support-for-OpenSSL-Provider-API.patch makes package/uboot-tools build without the OpenSSL engine API, but it fails at runtime if pkcs11-provider [1] is not available. That provider is not packaged in Buildroot, and should not be required when not actually using PKCS#11 keys. The problem has been discussed on the U-Boot mailing list [2], and part of the reason this patch has not been merged into U-Boot yet. It causes tests.package.test_uboot_tools.TestHostUbootTools to fail with: === STDOUT/STDERR === At main.c:259: - SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_dlfcn.c:115 - SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_lib.c:147 - SSL error:07880025:common libcrypto routines::reason(37): crypto/provider_core.c:1026 mkimage: OSSL_PROVIDER_try_load(pkcs11) This commit adjust the patch as suggested in [2] to continue if the PKCS#11 provider fails to load, making the test work. However, actually using PKCS#11 keys will not work until pkcs11-provider [1] is packaged. [1] https://github.com/openssl-projects/pkcs11-provider [2] https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html Fixes: f87cf2d6239d676147dec1fef088d81ee873277a ("package/uboot-tools: Fix build with OpenSSL 4.0.0") Signed-off-by: Fiona Klute (othermo GmbH) Signed-off-by: Julien Olivain --- .../0003-Add-support-for-OpenSSL-Provider-API.patch | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch b/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch index 9a5071cae3..2403e3ebab 100644 --- a/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch +++ b/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch @@ -29,6 +29,8 @@ Signed-off-by: Eddie Kovsky Upstream: https://github.com/u-boot/u-boot/pull/918 Signed-off-by: Bernd Kuhls +[Fiona: apply fix from https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html to make pkcs11 provider optional] +Signed-off-by: Fiona Klute (othermo GmbH) --- lib/aes/aes-encrypt.c | 4 +- lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++--- @@ -149,10 +151,10 @@ index 0e38c9e802f..f456f3c58e6 100644 + EVP_PKEY *private_key = NULL; + OSSL_STORE_CTX *store; + -+ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) -+ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)"); + if (!OSSL_PROVIDER_try_load(NULL, "default", true)) + ERR(1, "OSSL_PROVIDER_try_load(default)"); ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) ++ ERR_clear_error(); + + store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL); + ERR(!store, "OSSL_STORE_open");