From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8FDACF557EB for ; Mon, 20 Apr 2026 08:50:33 +0000 (UTC) Received: from mail11.truemail.it (mail11.truemail.it [217.194.8.81]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15549.1776675023505941617 for ; Mon, 20 Apr 2026 01:50:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@dolcini.it header.s=default header.b=jQQTq2S6; spf=pass (domain: dolcini.it, ip: 217.194.8.81, mailfrom: francesco@dolcini.it) Received: from francesco-nb (xcpe-178-82-120-96.dyn.res.sunrise.net [178.82.120.96]) by mail11.truemail.it (Postfix) with ESMTPA id 1D0D51F951; Mon, 20 Apr 2026 10:50:20 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dolcini.it; s=default; t=1776675020; bh=ZL1HvcUy/MlgeMJhI+efhxBSDqBz7QZb7v8EpHkePtc=; h=From:To:Subject; b=jQQTq2S60KLvKtcb44WTFLARMnmY1KOHumbqbdrrI9+5+2UKknqvpbl5ZVX6LAtIo juDajXnForE7ZEt9BVLfSXX48ouw/ziGTjfeWlJCbzkp9GN28fW/refwrtPCNwq15b DSvuz/H50phh2T1f7l140/vd4LZOiy71c2S/B0elDJHS1OBde2k3GyQv9agrM5+y5Q yCt458poqath+zcFgimCojuyaoEcxD3OoBJ8ucwR+YUdX/NcVabUehqy1cmLd82ZdI cR8GDiBcROpHDcQKdujyJO9j8uOEd9cptPaApzra9O9MhhwWM1hco6GezOFOIY3p84 K0sinhB4wZuCw== Date: Mon, 20 Apr 2026 10:50:16 +0200 From: Francesco Dolcini To: Wojciech Dubowik , trini@konsulko.com, openembedded-core@lists.openembedded.org, Paul Barker Cc: Franz Schnyder , u-boot@lists.denx.de, Francesco Dolcini Subject: Re: [PATCH] tools: mkeficapsule: Add disable pkcs11 menu option Message-ID: <20260420085001.GA47182@francesco-nb> References: <20260409074710.1322519-1-Wojciech.Dubowik@mt.com> <7xe72m3tkzultqh3hw4cubfognfryjk5ababajoe6w6zt7jx4c@aaxa2kehv635> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Apr 2026 08:50:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/235557 + Paul Barker Hello all, On Mon, Apr 20, 2026 at 10:14:46AM +0200, Wojciech Dubowik wrote: > On Thu, Apr 16, 2026 at 05:51:13PM +0200, Franz Schnyder wrote: > > On Thu, Apr 09, 2026 at 09:47:07AM +0200, Wojciech Dubowik wrote: > > > Some distros are using gnutls library without pkcs11 support > > > and linking of mkeficapsule will fail. Add disable pkcs11 > > > option with default set to no so distros can control this > > > feature with config option. > > Shouldn't it be the other way around? Use of pkcs11 should be disabled > > by default and enabled if required. As it is now, it would still depend > > on the the gnutls library having pkcs11 support and therefore still > > would break our OE builds with mainline u-boot if we don't change our > > modules defconfig. > > As far as I understand, gnutls is built by default with pkcs11 support. So for > most of the distribution it should be ok. Security by default. > I don't have yn strong opinion for this but default enabled has been suggested > by the maintainer. We are in the very unfortunate situation in which we are not able to run any test at the moment in our CI and automated test infrastructure (not in U-Boot, not in OE), and the reason is that we have pcks11 enabled in U-Boot, and OE core is not picking up the patch to enable it [1]. Any advise to have a way forward? Francesco [1] https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/