Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option

[David Lechner <dlechner@baylibre.com>]

On 4/20/26 3:38 AM, Wojciech Dubowik wrote:
> Some distros are using gnutls library without pkcs11 support
> and linking of mkeficapsule will fail. Add disable pkcs11
> option with default set to no so distros can control this
> feature with config option.
> 
> Suggested-by: Tom Rini <trini@konsulko.com>
> Cc: Franz Schnyder <fra.schnyder@gmail.com>
> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@mt.com>
> ---
> Changes in v2:
> - make use of stderr more consistent
> - add missing ifndef around pkcs11 deinit functions
> ---
>  tools/Kconfig        |  8 ++++++++
>  tools/Makefile       |  3 +++
>  tools/mkeficapsule.c | 17 ++++++++++++++++-
>  3 files changed, 27 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/Kconfig b/tools/Kconfig
> index ef33295b8ecd..ccc878595d3b 100644
> --- a/tools/Kconfig
> +++ b/tools/Kconfig
> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE
>  	  optionally sign that file. If you want to enable UEFI capsule
>  	  update feature on your target, you certainly need this.
>  
> +config MKEFICAPSULE_DISABLE_PKCS11

Options that disable something instead of enabling it are confusing.
Can we make this MKEFICAPSULE_PKCS11 instead and invert the logic?

> +	bool "Disable pkcs11 support"
> +	depends on TOOLS_MKEFICAPSULE
> +	default n

I think it would be more convenient if we did not require PKS11 by
default. Otherwise, everyone using Open Embedded that doesn't have
the "p11-kit" PACKAGECONFIG option set for GnuTLS set (which is the
default) is going to get a build failure and have to research this
and find the option and modify their config to fix the build.

It seems like it would be better to make people who actually need
PKCS11 possibly get an error by default instead and enable the
option. This is pure speculation on my part, but it seems like
this would be the smaller group.

> +	help
> +	  Disable pkcs11 support. Can be used in cases when host GnuTLS
> +	  library doesn't support it.
> +
>  menuconfig FSPI_CONF_HEADER
>  	bool "FlexSPI Header Configuration"
>  	help