Re: [PATCH] tools: mkeficapsule: Add disable pkcs11 menu option

[Francesco Dolcini <francesco@dolcini.it>]

+ Paul Barker

Hello all,

On Mon, Apr 20, 2026 at 10:14:46AM +0200, Wojciech Dubowik wrote:
> On Thu, Apr 16, 2026 at 05:51:13PM +0200, Franz Schnyder wrote:
> > On Thu, Apr 09, 2026 at 09:47:07AM +0200, Wojciech Dubowik wrote:
> > > Some distros are using gnutls library without pkcs11 support
> > > and linking of mkeficapsule will fail. Add disable pkcs11
> > > option with default set to no so distros can control this
> > > feature with config option.
> > Shouldn't it be the other way around? Use of pkcs11 should be disabled 
> > by default and enabled if required. As it is now, it would still depend
> > on the the gnutls library having pkcs11 support and therefore still 
> > would break our OE builds with mainline u-boot if we don't change our
> > modules defconfig.
> 
> As far as I understand, gnutls is built by default with pkcs11 support. So for
> most of the distribution it should be ok. Security by default.
> I don't have yn strong opinion for this but default enabled has been suggested
> by the maintainer.

We are in the very unfortunate situation in which we are not able to run
any test at the moment in our CI and automated test infrastructure (not
in U-Boot, not in OE), and the reason is that we have pcks11 enabled in
U-Boot, and OE core is not picking up the patch to enable it [1].

Any advise to have a way forward?

Francesco

[1] https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/