* Re: EXTERNAL - Host GnuTLS now needs pkcs11 support
2026-04-08 6:50 ` - Host GnuTLS now needs pkcs11 support Wojciech Dubowik
@ 2026-04-08 14:16 ` Franz Schnyder
2026-04-08 16:14 ` Tom Rini
1 sibling, 0 replies; 3+ messages in thread
From: Franz Schnyder @ 2026-04-08 14:16 UTC (permalink / raw)
To: Wojciech Dubowik
Cc: openembedded-core, u-boot, simon.glass, Francesco Dolcini
Hello
On Wed, Apr 08, 2026 at 08:50:41AM +0200, Wojciech Dubowik wrote:
> I could add disable compile flag in mkeficapsule if there are no objections. Sth
> like this in pkcs11 places:
>
> +#ifndef DISABLE_PKCS11
> ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
> [...]
> +#else
> + fprintf(stdout, "Pkcs11 support is disabled\n");
> + return -1;
> +#endif
>
I think it makes sense, given that some U-Boot users might not want to
have pkcs11 and deal with the dependencies.
> This way OE or possibly openwrt don't need to patch.
In any case, I've sent this patch to OE to have pkcs11 support on
the host side if it's wanted.
https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/
Kind regards
Franz
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: EXTERNAL - Host GnuTLS now needs pkcs11 support
2026-04-08 6:50 ` - Host GnuTLS now needs pkcs11 support Wojciech Dubowik
2026-04-08 14:16 ` EXTERNAL " Franz Schnyder
@ 2026-04-08 16:14 ` Tom Rini
1 sibling, 0 replies; 3+ messages in thread
From: Tom Rini @ 2026-04-08 16:14 UTC (permalink / raw)
To: Wojciech Dubowik
Cc: Franz Schnyder, openembedded-core, u-boot, simon.glass,
Francesco Dolcini
[-- Attachment #1: Type: text/plain, Size: 1704 bytes --]
On Wed, Apr 08, 2026 at 08:50:41AM +0200, Wojciech Dubowik wrote:
> On Tue, Apr 07, 2026 at 06:15:13PM +0200, Franz Schnyder wrote:
> Hello Franz,
> > Hello Wojciech,
> >
> > with commit 0c716a157be ("tools: mkeficapsule: Add support for pkcs11"),
> > mkeficapsule now references to pkcs11 related symbols.
> >
> > This breaks our OE builds because it causes link failures for
> > configurations that build mkeficapsule when the host gnutls is
> > built without pkcs11 support:
> > ```
> > undefined reference to `gnutls_pkcs11_obj_list_import_url4'
> > undefined reference to `gnutls_x509_crt_import_pkcs11'
> > undefined reference to `gnutls_pkcs11_init'
> > undefined reference to `gnutls_pkcs11_add_provider'
> > undefined reference to `gnutls_pkcs11_deinit'
> > ```
> > On the OE side, enabling support in gnutls via p11-kit fixes the failures.
> > However, I wonder what the cleanest solution would be. Should this new
> > host requirement for pkcs11 be handled in the U-Boot OE recipe, or is
> > there a better way to approach this correctly?
> >
> > Any ideas?
> I could add disable compile flag in mkeficapsule if there are no objections. Sth
> like this in pkcs11 places:
>
> +#ifndef DISABLE_PKCS11
> ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
> [...]
> +#else
> + fprintf(stdout, "Pkcs11 support is disabled\n");
> + return -1;
> +#endif
>
> This way OE or possibly openwrt don't need to patch.
We should do this as a Kconfig symbol (which shouldn't be enabled by
default), and make sure that tools-only_defconfig does enable it and let
distros disable it as desired.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread