mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-09 17:03:35 -09:00
6597563da7
Future U-Boot 2026.07 will build mkeficapsule with pkcs11 support. [1]
This causes link errors with Buildroot, such as the following one:
mkeficapsule.c:(.text.startup+0xcd3): undefined reference to `gnutls_pkcs11_init'
(Other symbols the linker complains about are: gnutls_pkcs11_add_provider,
gnutls_pkcs11_obj_list_import_url4, gnutls_x509_crt_import_pkcs11 and
gnutls_pkcs11_deinit.)
The following example commands can be used to reproduce the issue:
make qemu_aarch64_ebbr_defconfig
echo 'BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.07-rc3"' >>.config
echo 'BR2_TARGET_UBOOT_NEEDS_GNUTLS=y' >>.config
echo '# BR2_DOWNLOAD_FORCE_CHECK_HASHES is not set' >>.config
make olddefconfig
make uboot
This commit adds the pkcs11 support for host-gnutls.
In Buildroot, since host-gnutls is currently only needed by uboot
(and other uboot derivatives such as uboot-tools) the pkcs11 support
is added unconditionally to host-gnutls.
Link: 0c716a157b [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
135 lines
3.7 KiB
Makefile
135 lines
3.7 KiB
Makefile
################################################################################
|
|
#
|
|
# gnutls
|
|
#
|
|
################################################################################
|
|
|
|
# When bumping, make sure *all* --without-libfoo-prefix options are in GNUTLS_CONF_OPTS
|
|
GNUTLS_VERSION_MAJOR = 3.8
|
|
GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).13
|
|
GNUTLS_SOURCE = gnutls-$(GNUTLS_VERSION).tar.xz
|
|
GNUTLS_SITE = https://www.gnupg.org/ftp/gcrypt/gnutls/v$(GNUTLS_VERSION_MAJOR)
|
|
GNUTLS_LICENSE = LGPL-2.1+ (core library)
|
|
GNUTLS_LICENSE_FILES = COPYING.LESSERv2 README.md
|
|
|
|
GNUTLS_DEPENDENCIES = host-pkgconf libtasn1 libunistring nettle
|
|
GNUTLS_CPE_ID_VENDOR = gnu
|
|
# Don't add an optional dependency on tpm2-tss as it creates a
|
|
# circular dependency: tpm2-tss -> libcurl -> gnutls -> tmp2-tss.
|
|
GNUTLS_CONF_OPTS = \
|
|
--disable-doc \
|
|
--disable-libdane \
|
|
--disable-rpath \
|
|
--disable-tests \
|
|
--without-included-unistring \
|
|
--without-libcrypto-prefix \
|
|
--without-libdl-prefix \
|
|
--without-libev-prefix \
|
|
--without-libiconv-prefix \
|
|
--without-libintl-prefix \
|
|
--without-libpthread-prefix \
|
|
--without-libseccomp-prefix \
|
|
--without-librt-prefix \
|
|
--without-libz-prefix \
|
|
--without-tpm \
|
|
--without-tpm2 \
|
|
$(if $(BR2_PACKAGE_GNUTLS_TOOLS),--enable-tools,--disable-tools) \
|
|
$(if $(BR2_PACKAGE_GNUTLS_ENABLE_SSL2),--enable,--disable)-ssl2-support \
|
|
$(if $(BR2_PACKAGE_GNUTLS_ENABLE_GOST),--enable,--disable)-gost
|
|
GNUTLS_CONF_ENV = gl_cv_socket_ipv6=yes \
|
|
ac_cv_header_wchar_h=$(if $(BR2_USE_WCHAR),yes,no) \
|
|
gt_cv_c_wchar_t=$(if $(BR2_USE_WCHAR),yes,no) \
|
|
gt_cv_c_wint_t=$(if $(BR2_USE_WCHAR),yes,no) \
|
|
gl_cv_func_gettimeofday_clobber=no
|
|
GNUTLS_INSTALL_STAGING = YES
|
|
|
|
HOST_GNUTLS_DEPENDENCIES = host-pkgconf host-libtasn1 host-libunistring \
|
|
host-nettle host-p11-kit
|
|
HOST_GNUTLS_CONF_OPTS = \
|
|
--disable-doc \
|
|
--disable-libdane \
|
|
--disable-rpath \
|
|
--disable-tests \
|
|
--without-included-unistring \
|
|
--without-libcrypto-prefix \
|
|
--without-libdl-prefix \
|
|
--without-libev-prefix \
|
|
--without-libiconv-prefix \
|
|
--without-libintl-prefix \
|
|
--without-libpthread-prefix \
|
|
--without-libseccomp-prefix \
|
|
--without-librt-prefix \
|
|
--without-libz-prefix \
|
|
--without-tpm \
|
|
--without-tpm2 \
|
|
--disable-openssl-compatibility \
|
|
--without-brotli \
|
|
--without-idn \
|
|
--with-p11-kit \
|
|
--without-zlib \
|
|
--without-zstd
|
|
|
|
ifeq ($(BR2_PACKAGE_GNUTLS_OPENSSL),y)
|
|
GNUTLS_LICENSE += , GPL-3.0+ (gnutls-openssl library)
|
|
GNUTLS_LICENSE_FILES += COPYING
|
|
GNUTLS_CONF_OPTS += --enable-openssl-compatibility
|
|
else
|
|
GNUTLS_CONF_OPTS += --disable-openssl-compatibility
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_BROTLI),y)
|
|
GNUTLS_CONF_OPTS += --with-brotli
|
|
GNUTLS_DEPENDENCIES += brotli
|
|
else
|
|
GNUTLS_CONF_OPTS += --without-brotli
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_CRYPTODEV_LINUX),y)
|
|
GNUTLS_CONF_OPTS += --enable-cryptodev
|
|
GNUTLS_DEPENDENCIES += cryptodev-linux
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBIDN2),y)
|
|
GNUTLS_CONF_OPTS += --with-idn
|
|
GNUTLS_DEPENDENCIES += libidn2
|
|
else
|
|
GNUTLS_CONF_OPTS += --without-idn
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_P11_KIT),y)
|
|
GNUTLS_CONF_OPTS += --with-p11-kit
|
|
GNUTLS_DEPENDENCIES += p11-kit
|
|
else
|
|
GNUTLS_CONF_OPTS += --without-p11-kit
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
GNUTLS_CONF_OPTS += --with-zlib
|
|
GNUTLS_DEPENDENCIES += zlib
|
|
else
|
|
GNUTLS_CONF_OPTS += --without-zlib
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZSTD),y)
|
|
GNUTLS_CONF_OPTS += --with-zstd
|
|
GNUTLS_DEPENDENCIES += zstd
|
|
else
|
|
GNUTLS_CONF_OPTS += --without-zstd
|
|
endif
|
|
|
|
# Provide a default CA cert location
|
|
ifeq ($(BR2_PACKAGE_P11_KIT),y)
|
|
GNUTLS_CONF_OPTS += --with-default-trust-store-pkcs11=pkcs11:model=p11-kit-trust
|
|
else ifeq ($(BR2_PACKAGE_CA_CERTIFICATES),y)
|
|
GNUTLS_CONF_OPTS += --with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
|
|
GNUTLS_LIBS += -latomic
|
|
endif
|
|
|
|
GNUTLS_CONF_ENV += LIBS="$(GNUTLS_LIBS)"
|
|
|
|
$(eval $(autotools-package))
|
|
$(eval $(host-autotools-package))
|