Re: [PATCH] tools: mkeficapsule: Add disable pkcs11 menu option

[Wojciech Dubowik <Wojciech.Dubowik@mt.com>]

On Mon, Apr 20, 2026 at 04:27:03PM +1200, Simon Glass wrote:
Hello Simon,

> Hi Wojciech,
> 
> On 2026-04-09T07:47:07, Wojciech Dubowik <Wojciech.Dubowik@mt.com> wrote:
> > tools: mkeficapsule: Add disable pkcs11 menu option
> >
> > Some distros are using gnutls library without pkcs11 support
> > and linking of mkeficapsule will fail. Add disable pkcs11
> > option with default set to no so distros can control this
> > feature with config option.
> >
> > Suggested-by: Tom Rini <trini@konsulko.com>
> > Cc: Franz Schnyder <fra.schnyder@gmail.com>
> > Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@mt.com>
> >
> > tools/Kconfig        |  8 ++++++++
> >  tools/Makefile       |  3 +++
> >  tools/mkeficapsule.c | 14 ++++++++++++++
> >  3 files changed, 25 insertions(+)
> 
> > diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c
> > @@ -301,6 +305,7 @@ static int create_auth_data(struct auth_context *ctx)
> > +#else
> > +             fprintf(stdout, "Pkcs11 support is disabled\n");
> > +             return -1;
> 
> Please can you use stderr here for consistency with surrounding error handling.
> 
> > diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c
> > @@ -301,6 +305,7 @@ static int create_auth_data(struct auth_context *ctx)
> 
> The cleanup code at lines 420-423 calls gnutls_pkcs11_deinit() when
> pkcs11_cert || pkcs11_key is true. When
> CONFIG_MKEFICAPSULE_DISABLE_PKCS11 is defined, these can still be set
> if the user provides a "pkcs11:" URL, but gnutls_pkcs11_deinit() will
> not be available. Please can you wrap that cleanup block with #ifndef
> CONFIG_MKEFICAPSULE_DISABLE_PKCS11 as well, or ensure the function
> returns before reaching that code path.

Will do it and send V2.

Regards,
Wojtek

> 
> Regards,
> Simon