Re: [PATCH] tools: mkeficapsule: Add disable pkcs11 menu option

[Francesco Dolcini <francesco@dolcini.it>]

On Tue, Apr 21, 2026 at 11:07:21AM +0100, Paul Barker wrote:
> On Mon, 2026-04-20 at 10:50 +0200, Francesco Dolcini wrote:
> > + Paul Barker
> > 
> > Hello all,
> > 
> > On Mon, Apr 20, 2026 at 10:14:46AM +0200, Wojciech Dubowik wrote:
> > > On Thu, Apr 16, 2026 at 05:51:13PM +0200, Franz Schnyder wrote:
> > > > On Thu, Apr 09, 2026 at 09:47:07AM +0200, Wojciech Dubowik wrote:
> > > > > Some distros are using gnutls library without pkcs11 support
> > > > > and linking of mkeficapsule will fail. Add disable pkcs11
> > > > > option with default set to no so distros can control this
> > > > > feature with config option.
> > > > Shouldn't it be the other way around? Use of pkcs11 should be disabled 
> > > > by default and enabled if required. As it is now, it would still depend
> > > > on the the gnutls library having pkcs11 support and therefore still 
> > > > would break our OE builds with mainline u-boot if we don't change our
> > > > modules defconfig.
> > > 
> > > As far as I understand, gnutls is built by default with pkcs11 support. So for
> > > most of the distribution it should be ok. Security by default.
> > > I don't have yn strong opinion for this but default enabled has been suggested
> > > by the maintainer.
> > 
> > We are in the very unfortunate situation in which we are not able to run
> > any test at the moment in our CI and automated test infrastructure (not
> > in U-Boot, not in OE), and the reason is that we have pcks11 enabled in
> > U-Boot, and OE core is not picking up the patch to enable it [1].
> > 
> > Any advise to have a way forward?
> > 
> > Francesco
> > 
> > [1] https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/
> 
> Which versions of U-Boot and openembedded-core are you trying to build?

U-Boot master + openembedded-core master.

Francesco