Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH] package/pkcs11-provider: new package
@ 2026-10-20 22:50 Waldemar Brodkorb
  0 siblings, 0 replies; only message in thread
From: Waldemar Brodkorb @ 2026-10-20 22:50 UTC (permalink / raw)
  To: buildroot

An OpenSSL 3.x provider to access Hardware and Software Tokens using the
PKCS#11 Cryptographic Token Interface.

https://github.com/openssl-projects/pkcs11-provider

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
---
 DEVELOPERS                                    |  1 +
 package/Config.in                             |  1 +
 ...rovider-fix-OpenSSL-provider-install.patch | 53 +++++++++++++++++++
 package/pkcs11-provider/Config.in             |  9 ++++
 package/pkcs11-provider/pkcs11-provider.hash  |  7 +++
 package/pkcs11-provider/pkcs11-provider.mk    | 15 ++++++
 6 files changed, 86 insertions(+)
 create mode 100644 package/pkcs11-provider/0001-package-pkcs11-provider-fix-OpenSSL-provider-install.patch
 create mode 100644 package/pkcs11-provider/Config.in
 create mode 100644 package/pkcs11-provider/pkcs11-provider.hash
 create mode 100644 package/pkcs11-provider/pkcs11-provider.mk

diff --git a/DEVELOPERS b/DEVELOPERS
index 1ecf7c991d..71f28df2cd 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -3519,6 +3519,7 @@ F:	package/perl-cgi-session/
 F:	package/perl-log-message/
 F:	package/perl-log-message-simple/
 F:	package/perl-switch/
+F:	package/pkcs11-provider/
 F:	package/ruby/
 F:	package/uclibc/
 F:	package/uclibc-ng-test/
diff --git a/package/Config.in b/package/Config.in
index a7c2433e08..24f0466a76 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -1688,6 +1688,7 @@ menu "Crypto"
 	source "package/parsec/Config.in"
 	source "package/parsec-tool/Config.in"
 	source "package/pkcs11-helper/Config.in"
+	source "package/pkcs11-provider/Config.in"
 	source "package/rhash/Config.in"
 	source "package/sigsum-c/Config.in"
 	source "package/tinydtls/Config.in"
diff --git a/package/pkcs11-provider/0001-package-pkcs11-provider-fix-OpenSSL-provider-install.patch b/package/pkcs11-provider/0001-package-pkcs11-provider-fix-OpenSSL-provider-install.patch
new file mode 100644
index 0000000000..e2e9e57f87
--- /dev/null
+++ b/package/pkcs11-provider/0001-package-pkcs11-provider-fix-OpenSSL-provider-install.patch
@@ -0,0 +1,53 @@
+From aa14490c8c1fd693a44726a77f78b45abd9512db Mon Sep 17 00:00:00 2001
+From: Waldemar Brodkorb <wbx@openadk.org>
+Date: Mon, 19 Oct 2026 13:21:41 +0200
+Subject: [PATCH] package/pkcs11-provider: fix OpenSSL provider install path
+
+When cross-compiling pkcs11-provider with Buildroot, Meson queries
+OpenSSL's libcrypto.pc file to determine the provider installation
+directory through the modulesdir variable.
+
+The pkg-config file defines modulesdir in terms of libdir, which
+in turn depends on prefix. During cross-compilation, pkgconf uses
+PKG_CONFIG_SYSROOT_DIR to prepend the target sysroot to the
+resolved absolute path. Consequently, Meson receives a host-side
+path such as:
+
+$(HOST_DIR)/$(GNU_TARGET_NAME)/sysroot/usr/lib64/ossl-modules
+
+Using this path as the shared module's install_dir causes the
+module to be installed under the host sysroot directory inside
+TARGET_DIR. Buildroot then rejects the package because it installs
+files outside the expected target filesystem layout.
+
+Just strip the sysroot prefix from the resulting path. This ensures that
+pkcs11.so is installed into the target's OpenSSL provider directory, for
+example /usr/lib64/ossl-modules, rather than a host-specific directory.
+
+Upstream: https://github.com/openssl-projects/pkcs11-provider/commit/4e0be5aa9606b5ffe1cbeaf19efb70a0b4c9a5d0
+Assisted-by: LLM
+Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
+---
+ meson.build | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/meson.build b/meson.build
+index fd14952..98cc114 100644
+--- a/meson.build
++++ b/meson.build
+@@ -50,6 +50,12 @@ if not libcrypto.found()
+   libcrypto = dependency('libcrypto3', version: '>= 3.0.7', required: true)
+ endif
+ provider_path = libcrypto.get_variable(pkgconfig: 'modulesdir')
++
++sys_root = meson.get_external_property('sys_root', '')
++if sys_root != '' and provider_path.startswith(sys_root)
++  provider_path = provider_path.replace(sys_root, '')
++endif
++
+ libssl = dependency('libssl', version: '>= 3.0.7', required: false)
+ if not libssl.found()
+   libssl = dependency('libssl3', version: '>= 3.0.7', required: true, method: 'pkg-config')
+-- 
+2.47.3
+
diff --git a/package/pkcs11-provider/Config.in b/package/pkcs11-provider/Config.in
new file mode 100644
index 0000000000..851bdff70d
--- /dev/null
+++ b/package/pkcs11-provider/Config.in
@@ -0,0 +1,9 @@
+config BR2_PACKAGE_PKCS11_PROVIDER
+	bool "pkcs11-provider"
+	select BR2_PACKAGE_OPENSSL
+	help
+	  an OpenSSL 3.x provider to access Hardware and 
+	  Software Tokens using the PKCS#11 Cryptographic
+	  Token Interface.
+
+	  https://github.com/openssl-projects/pkcs11-provider
diff --git a/package/pkcs11-provider/pkcs11-provider.hash b/package/pkcs11-provider/pkcs11-provider.hash
new file mode 100644
index 0000000000..73df0f0870
--- /dev/null
+++ b/package/pkcs11-provider/pkcs11-provider.hash
@@ -0,0 +1,7 @@
+# Locally calculated
+sha256 b8bbc30cfb7865603fff1dd0fb516cce90437d8ddb267e331cd89d6121960538  pkcs11-provider-1.3.0.tar.xz
+
+# Hash for license files
+sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSES/Apache-2.0.txt
+sha256  4c42a835e1a5754dc85a3ac746b482005fec41205cb8843d335d9231550eaa66  LICENSES/LicenseRef-Public-Domain-PKCS11-Headers.txt
+
diff --git a/package/pkcs11-provider/pkcs11-provider.mk b/package/pkcs11-provider/pkcs11-provider.mk
new file mode 100644
index 0000000000..6eda9a0507
--- /dev/null
+++ b/package/pkcs11-provider/pkcs11-provider.mk
@@ -0,0 +1,15 @@
+################################################################################
+#
+# pkcs11-provider
+#
+################################################################################
+
+PKCS11_PROVIDER_VERSION = 1.3.0
+PKCS11_PROVIDER_SOURCE = pkcs11-provider-$(PKCS11_PROVIDER_VERSION).tar.xz
+PKCS11_PROVIDER_SITE = https://github.com/openssl-projects/pkcs11-provider/releases/download/v$(PKCS11_PROVIDER_VERSION)
+PKCS11_PROVIDER_LICENSE = Apache-2.0, Public Domain (src/pkcs11.h)
+PKCS11_PROVIDER_LICENSE_FILES = LICENSES/Apache-2.0.txt LICENSES/LicenseRef-Public-Domain-PKCS11-Headers.txt
+
+PKCS11_PROVIDER_DEPENDENCIES = openssl
+
+$(eval $(meson-package))
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] only message in thread
only message in thread, other threads:[~2026-10-20 22:50 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-20 22:50 [Buildroot] [PATCH] package/pkcs11-provider: new package Waldemar Brodkorb

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox