Re: OpenSSL engine removal and fsverity-utils compilation issue

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Jan 23, 2025 at 06:24:36PM +0000, Eric Biggers wrote:
> On Thu, Jan 23, 2025 at 04:02:46PM +0530, Disha Goel wrote:
> > Hi,
> > 
> > Some distributions have started removing OpenSSL engine support, replacing
> > engine.h with an empty dummy header file. As a result, fsverity-utils fails
> > to compile with the following error.
> > 
> > Is there any plan to address this issue and support these distributions?
> > 
> > Please seehttps://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine for more details.
> > 
> > # make
> >   CC       lib/compute_digest.o
> >   CC       lib/enable.o
> >   CC       lib/hash_algs.o
> >   CC       lib/sign_digest.o
> > lib/sign_digest.c: In function ‘load_pkcs11_private_key’:
> > lib/sign_digest.c:350:9: error: implicit declaration of function ‘ENGINE_load_dynamic’ [-Wimplicit-function-declaration]
> >   350 |         ENGINE_load_dynamic();
> >       |         ^~~~~~~~~~~~~~~~~~~
> 
> This is my first time hearing about this, but yes this has to be fixed.  Thanks
> for reporting it.
> 
> It's just the PKCS#11 token feature that is causing problems.  This feature was
> contributed by Aleksander Adamowski <olo@fb.com> (Cc'ed) several years ago.  I
> don't have much context on how/whether it is still being used.
> 
> I'm tempted to just make the PKCS#11 token support conditional on
> !defined(OPENSSL_NO_ENGINE) for now.  If someone still cares about PKCS#11 token
> support they can look into finding a way to keep it working with latest OpenSSL.
> 

Now fixed in the master branch of fsverity-utils.

- Eric