Re: [PATCH] tools: mkeficapsule: Add disable pkcs11 menu option

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 1724 bytes --]

On Mon, 2026-04-20 at 10:50 +0200, Francesco Dolcini wrote:
> + Paul Barker
> 
> Hello all,
> 
> On Mon, Apr 20, 2026 at 10:14:46AM +0200, Wojciech Dubowik wrote:
> > On Thu, Apr 16, 2026 at 05:51:13PM +0200, Franz Schnyder wrote:
> > > On Thu, Apr 09, 2026 at 09:47:07AM +0200, Wojciech Dubowik wrote:
> > > > Some distros are using gnutls library without pkcs11 support
> > > > and linking of mkeficapsule will fail. Add disable pkcs11
> > > > option with default set to no so distros can control this
> > > > feature with config option.
> > > Shouldn't it be the other way around? Use of pkcs11 should be disabled 
> > > by default and enabled if required. As it is now, it would still depend
> > > on the the gnutls library having pkcs11 support and therefore still 
> > > would break our OE builds with mainline u-boot if we don't change our
> > > modules defconfig.
> > 
> > As far as I understand, gnutls is built by default with pkcs11 support. So for
> > most of the distribution it should be ok. Security by default.
> > I don't have yn strong opinion for this but default enabled has been suggested
> > by the maintainer.
> 
> We are in the very unfortunate situation in which we are not able to run
> any test at the moment in our CI and automated test infrastructure (not
> in U-Boot, not in OE), and the reason is that we have pcks11 enabled in
> U-Boot, and OE core is not picking up the patch to enable it [1].
> 
> Any advise to have a way forward?
> 
> Francesco
> 
> [1] https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/

Hi Francesco,

Which versions of U-Boot and openembedded-core are you trying to build?

Thanks,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]