[Buildroot] [PATCH 1/4] package/uboot-tools: do not require OpenSSL PKCS#11 provider

[Buildroot] [PATCH 1/4] package/uboot-tools: do not require OpenSSL PKCS#11 provider

[Fiona Klute via buildroot]

From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>

Patch 0003-Add-support-for-OpenSSL-Provider-API.patch makes
package/uboot-tools build without the OpenSSL engine API, but it fails
at runtime if pkcs11-provider [1] is not available. That provider is
not packaged in Buildroot, and should not be required when not
actually using PKCS#11 keys.

The problem has been discussed on the U-Boot mailing list [2], and
part of the reason this patch has not been merged into U-Boot yet. It
causes tests.package.test_uboot_tools.TestHostUbootTools to fail with:

=== STDOUT/STDERR ===
At main.c:259:
- SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_dlfcn.c:115
- SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_lib.c:147
- SSL error:07880025:common libcrypto routines::reason(37): crypto/provider_core.c:1026
mkimage: OSSL_PROVIDER_try_load(pkcs11)

This commit adjust the patch as suggested in [2] to continue if the
PKCS#11 provider fails to load, making the test work. However,
actually using PKCS#11 keys will not work until pkcs11-provider [1] is
packaged.

[1] https://github.com/openssl-projects/pkcs11-provider
[2] https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html

Fixes: f87cf2d6239d676147dec1fef088d81ee873277a ("package/uboot-tools: Fix build with OpenSSL 4.0.0")

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
The alternative is to revert f87cf2d6239d676147dec1fef088d81ee873277a
until a fixed version is available. In any case I think either revert or
a package for pkcs11-provider are needed before the 2026.11 release,
support for PKCS#11 is important outside testing.

 .../0003-Add-support-for-OpenSSL-Provider-API.patch         | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch b/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch
index 9a5071cae3..2403e3ebab 100644
--- a/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch
+++ b/package/uboot-tools/0003-Add-support-for-OpenSSL-Provider-API.patch
@@ -29,6 +29,8 @@ Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
 Upstream: https://github.com/u-boot/u-boot/pull/918
 
 Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+[Fiona: apply fix from https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html to make pkcs11 provider optional]
+Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
 ---
  lib/aes/aes-encrypt.c |   4 +-
  lib/rsa/rsa-sign.c    | 102 +++++++++++++++++++++++++++++++++++++++---
@@ -149,10 +151,10 @@ index 0e38c9e802f..f456f3c58e6 100644
 +	EVP_PKEY *private_key = NULL;
 +	OSSL_STORE_CTX *store;
 +
-+	if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
-+		ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
 +	if (!OSSL_PROVIDER_try_load(NULL, "default", true))
 +		ERR(1, "OSSL_PROVIDER_try_load(default)");
++	if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++		ERR_clear_error();
 +
 +	store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
 +	ERR(!store, "OSSL_STORE_open");
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/4] support/testing/tests/package/test_uboot_tools.py: fix typos

[Fiona Klute via buildroot]

From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
 support/testing/tests/package/test_uboot_tools.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/support/testing/tests/package/test_uboot_tools.py b/support/testing/tests/package/test_uboot_tools.py
index 8cff6fda21..13f77c3379 100644
--- a/support/testing/tests/package/test_uboot_tools.py
+++ b/support/testing/tests/package/test_uboot_tools.py
@@ -96,7 +96,7 @@ class TestHostUbootTools(infra.basetest.BRHostPkgTest):
         keydir = Path(self.builddir) / "keys"
         keydir.mkdir(exist_ok=True)
 
-        # We generate a prublic/private key pair to sign the image.
+        # We generate a public/private key pair to sign the image.
         cmd = [
             "host/bin/openssl", "req", "-batch", "-new", "-x509", "-nodes",
             "-newkey", "rsa:2048", "-keyout", str(keydir / "dev.key"),
@@ -150,7 +150,7 @@ class TestHostUbootTools(infra.basetest.BRHostPkgTest):
         ]
         infra.run_cmd_on_host(self.builddir, cmd)
 
-        # We check again the siganute, and expect a failure.
+        # We check again the signature, and expect a failure.
         cmd = [
             "host/bin/fit_check_sign", "-f", "signed.fit",
             "-k", "test-key.dtb",
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 3/4] package/uboot-tools: fix target FIT signature support

[Fiona Klute via buildroot]

From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>

Commit 928cc5dc5cb82e6f2cb43f853488309eb806ef89 ("package/uboot-tools:
fix host FIT signature support") fixed building host-uboot-tools with
FIT signature support after upstream changes to the config included
since v2026.04, added to Buildroot with commit
e049f6fef1fd1e1b0b6095e0ff9113312a7d7f81 ("package/uboot-tools: bump
to version 2026.04"). This commit applies the same fixes to
configuration for target uboot-tools.

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
 package/uboot-tools/uboot-tools.mk | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/package/uboot-tools/uboot-tools.mk b/package/uboot-tools/uboot-tools.mk
index b5924f6954..32fe9f1d7b 100644
--- a/package/uboot-tools/uboot-tools.mk
+++ b/package/uboot-tools/uboot-tools.mk
@@ -33,7 +33,10 @@ define UBOOT_TOOLS_CONFIGURE_CMDS
 	mkdir -p $(@D)/include/generated
 	$(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT),$(UBOOT_TOOLS_ENABLE_HASH_ALGOS))
 	$(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT),echo '#define CONFIG_TOOLS_FIT_PRINT 1' >> $(@D)/include/generated/autoconf.h)
-	echo $(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),'#define CONFIG_FIT_SIGNATURE 1') >> $(@D)/include/generated/autoconf.h
+	$(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),echo '#define CONFIG_TOOLS_IMAGE_PRE_LOAD 1' >> $(@D)/include/generated/autoconf.h)
+	$(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),echo '#define CONFIG_TOOLS_RSASSA_PSS 1' >> $(@D)/include/generated/autoconf.h)
+	$(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),echo '#define CONFIG_TOOLS_FIT_SIGNATURE 1' >> $(@D)/include/generated/autoconf.h)
+	$(if $(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),echo '#define CONFIG_TOOLS_FIT_SIGNATURE_MAX_SIZE 0x10000000' >> $(@D)/include/generated/autoconf.h)
 	mkdir -p $(@D)/include/asm
 	touch $(@D)/include/asm/linkage.h
 endef
@@ -50,7 +53,7 @@ UBOOT_TOOLS_DEPENDENCIES += dtc
 endif
 
 ifeq ($(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),y)
-UBOOT_TOOLS_MAKE_OPTS += CONFIG_FIT_SIGNATURE=y CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
+UBOOT_TOOLS_MAKE_OPTS += CONFIG_TOOLS_LIBCRYPTO=y CONFIG_FIT_SIGNATURE=y
 UBOOT_TOOLS_DEPENDENCIES += openssl host-pkgconf
 endif
 
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 4/4] support/testing/tests/package/test_uboot_tools.py: test FIT signature on target

[Fiona Klute via buildroot]

From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>

Adapt the code added to the host test with
928cc5dc5cb82e6f2cb43f853488309eb806ef89 ("package/uboot-tools: fix
host FIT signature support") to run on the target.

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
 .../testing/tests/package/test_uboot_tools.py | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/support/testing/tests/package/test_uboot_tools.py b/support/testing/tests/package/test_uboot_tools.py
index 13f77c3379..7caff3e66c 100644
--- a/support/testing/tests/package/test_uboot_tools.py
+++ b/support/testing/tests/package/test_uboot_tools.py
@@ -38,7 +38,10 @@ class TestUbootTools(infra.basetest.BRTest):
         BR2_PACKAGE_UBOOT_TOOLS=y
         BR2_PACKAGE_UBOOT_TOOLS_DUMPIMAGE=y
         BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+        BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+        BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
         BR2_PACKAGE_UBOOT_TOOLS_MKIMAGE=y
+        BR2_PACKAGE_LIBOPENSSL_BIN=y
         BR2_ROOTFS_OVERLAY="{rootfs_overlay}"
         BR2_TARGET_ROOTFS_CPIO=y
         # BR2_TARGET_ROOTFS_TAR is not set
@@ -68,6 +71,65 @@ class TestUbootTools(infra.basetest.BRTest):
         # Python does not have built-in CRC16 support, just check it is present
         self.assertIn("crc16-ccitt", reported)
 
+        keydir = "/tmp/keys"
+        self.assertRunOk(f"mkdir {keydir}")
+        # We generate a public/private key pair to sign the image.
+        self.assertRunOk(
+            "openssl req -batch -new -x509 -nodes "
+            f"-newkey rsa:2048 -keyout {keydir}/dev.key "
+            f"-out {keydir}/dev.crt -subj '/CN=Buildroot FIT test'",
+            timeout=30)
+
+        # We compile the empty dtb that will be used to store the
+        # public key.
+        self.assertRunOk(
+            f"dtc -I dts -O dtb -p 0x1000 -o test-key.dtb /{KEY_DTS.name}")
+
+        # We sign the image and write the public key in our key
+        # storage dtb.
+        self.assertRunOk(
+            f"mkimage -f /{SIGNED_ITS.name} -k {keydir} -K test-key.dtb "
+            "-r signed.fit")
+
+        # We check there is a signature present in the FIT image.
+        out, exit_code = self.emulator.run(
+            "fdtget -t bx signed.fit "
+            "/configurations/config-1/signature-1 value",
+            -1)
+        self.assertEqual(
+            exit_code,
+            0,
+            "\nFailed to run: {}\noutput was:\n{}".format(cmd, '  '+'\n  '.join(out))
+        )
+        self.assertEqual(len(out[0].split()), 256)
+
+        # We check the key is marked as required for the configuration.
+        out, exit_code = self.emulator.run(
+            "fdtget -t s test-key.dtb /signature/key-dev required", -1)
+        self.assertEqual(
+            exit_code,
+            0,
+            "\nFailed to run: {}\noutput was:\n{}".format(cmd, '  '+'\n  '.join(out))
+        )
+        self.assertEqual(out[0], "conf")
+
+        # We actually check the signature is valid.
+        self.assertRunOk("fit_check_sign -f signed.fit -k test-key.dtb")
+
+        # We "corrupt" the signature, by setting it to zero.
+        self.assertRunOk(
+            "fdtput -t bx signed.fit "
+            "/configurations/config-1/signature-1 value 00")
+
+        # We check again the signature, and expect a failure.
+        out, exit_code = self.emulator.run(
+            "fit_check_sign -f signed.fit -k test-key.dtb", -1)
+        self.assertNotEqual(
+            exit_code,
+            0,
+            "\nfit_check_sign did not fail as expected: {}\noutput was:\n{}".format(cmd, '  '+'\n  '.join(out))
+        )
+
 
 class TestHostUbootTools(infra.basetest.BRHostPkgTest):
     hostpkgs = ["host-uboot-tools"]
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/4] package/uboot-tools: do not require OpenSSL PKCS#11 provider

[Julien Olivain via buildroot]

On 16/10/2026 17:28, Fiona Klute via buildroot wrote:
> From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
> 
> Patch 0003-Add-support-for-OpenSSL-Provider-API.patch makes
> package/uboot-tools build without the OpenSSL engine API, but it fails
> at runtime if pkcs11-provider [1] is not available. That provider is
> not packaged in Buildroot, and should not be required when not
> actually using PKCS#11 keys.
> 
> The problem has been discussed on the U-Boot mailing list [2], and
> part of the reason this patch has not been merged into U-Boot yet. It
> causes tests.package.test_uboot_tools.TestHostUbootTools to fail with:
> 
> === STDOUT/STDERR ===
> At main.c:259:
> - SSL error:12800067:DSO support routines::could not load the shared 
> library: crypto/dso/dso_dlfcn.c:115
> - SSL error:12800067:DSO support routines::could not load the shared 
> library: crypto/dso/dso_lib.c:147
> - SSL error:07880025:common libcrypto routines::reason(37): 
> crypto/provider_core.c:1026
> mkimage: OSSL_PROVIDER_try_load(pkcs11)
> 
> This commit adjust the patch as suggested in [2] to continue if the
> PKCS#11 provider fails to load, making the test work. However,
> actually using PKCS#11 keys will not work until pkcs11-provider [1] is
> packaged.
> 
> [1] https://github.com/openssl-projects/pkcs11-provider
> [2] 
> https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html
> 
> Fixes: f87cf2d6239d676147dec1fef088d81ee873277a ("package/uboot-tools: 
> Fix build with OpenSSL 4.0.0")
> 
> Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot