[PATCH] ubifs-utils: Don't compile engine support if not available

[PATCH] ubifs-utils: Don't compile engine support if not available

[Sebastian Andrzej Siewior]

OpenSSL 4.0 dropped engine support which was deprecated since 3.0. The
replacement is the "providers" API.

Add an ifndef OPENSSL_NO_ENGINE around the engine code so it can be left
out where it is not supported.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
---
 ubifs-utils/common/sign.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/ubifs-utils/common/sign.c b/ubifs-utils/common/sign.c
index 032a6acc045d..5f94c0ad176f 100644
--- a/ubifs-utils/common/sign.c
+++ b/ubifs-utils/common/sign.c
@@ -23,11 +23,14 @@
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
-#include <openssl/engine.h>
 #include <openssl/cms.h>
 #include <openssl/conf.h>
 #include <err.h>
 
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+
 #include "linux_types.h"
 #include "sign.h"
 #include "ubifs.h"
@@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
 	*cert = NULL;
 
 	if (!strncmp(private_key_name, "pkcs11:", 7)) {
+#ifndef OPENSSL_NO_ENGINE
 		ENGINE *e;
 		struct {
 			const char *url;
@@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
 		}
 		*cert = parms.cert;
 		fprintf(stderr, "Using cert %p\n", *cert);
+#else
+		ssl_err_msg("PKCS#11 ENGINE support not available.");
+		return NULL;
+#endif
 	} else {
 		BIO *b;
 
-- 
2.55.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] ubifs-utils: Don't compile engine support if not available

[Zhihao Cheng]

在 2026/8/30 1:32, Sebastian Andrzej Siewior 写道:
> OpenSSL 4.0 dropped engine support which was deprecated since 3.0. The
> replacement is the "providers" API.
> 
> Add an ifndef OPENSSL_NO_ENGINE around the engine code so it can be left
> out where it is not supported.
> 
> Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
> ---
>   ubifs-utils/common/sign.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/ubifs-utils/common/sign.c b/ubifs-utils/common/sign.c
> index 032a6acc045d..5f94c0ad176f 100644
> --- a/ubifs-utils/common/sign.c
> +++ b/ubifs-utils/common/sign.c
> @@ -23,11 +23,14 @@
>   #include <openssl/bio.h>
>   #include <openssl/pem.h>
>   #include <openssl/err.h>
> -#include <openssl/engine.h>
>   #include <openssl/cms.h>
>   #include <openssl/conf.h>
>   #include <err.h>
>   
> +#ifndef OPENSSL_NO_ENGINE
> +#include <openssl/engine.h>
> +#endif
> +
>   #include "linux_types.h"
>   #include "sign.h"
>   #include "ubifs.h"
> @@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
>   	*cert = NULL;
>   
>   	if (!strncmp(private_key_name, "pkcs11:", 7)) {
> +#ifndef OPENSSL_NO_ENGINE
>   		ENGINE *e;
>   		struct {
>   			const char *url;
> @@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
>   		}
>   		*cert = parms.cert;
>   		fprintf(stderr, "Using cert %p\n", *cert);
> +#else
> +		ssl_err_msg("PKCS#11 ENGINE support not available.");
> +		return NULL;
Hi Sebastian,
Thanks for pointing that. I am wondering whether it would be better to 
implement PKCS11 encryption in #else branch by the OpenSSL 4.0 API provider.
> +#endif
>   	} else {
>   		BIO *b;
>   
> 


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] ubifs-utils: Don't compile engine support if not available

[Sebastian Andrzej Siewior]

On 2026-08-31 09:50:18 [+0800], Zhihao Cheng wrote:
> 在 2026/8/30 1:32, Sebastian Andrzej Siewior 写道:
> > @@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
> >   	*cert = NULL;
> >   	if (!strncmp(private_key_name, "pkcs11:", 7)) {
> > +#ifndef OPENSSL_NO_ENGINE
> >   		ENGINE *e;
> >   		struct {
> >   			const char *url;
> > @@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
> >   		}
> >   		*cert = parms.cert;
> >   		fprintf(stderr, "Using cert %p\n", *cert);
> > +#else
> > +		ssl_err_msg("PKCS#11 ENGINE support not available.");
> > +		return NULL;
> Hi Sebastian,
> Thanks for pointing that. I am wondering whether it would be better to
> implement PKCS11 encryption in #else branch by the OpenSSL 4.0 API provider.

Well. This is a the very least gets it compiled. The provider API is
supported since OpenSSL 3.0 so I wouldn't make it available only if
ENGINE isn't supported. You still need the actual provider.

> > +#endif
> >   	} else {
> >   		BIO *b;
> > 

Sebastian

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/