Build with CONFIG_TOOLS_LIBCRYPTO disabled is broken

Build with CONFIG_TOOLS_LIBCRYPTO disabled is broken

[Alexander Dahl]

Hei hei,

once again I tried building U-Boot with CONFIG_TOOLS_LIBCRYPTO disabled and 
with no libssl-dev installed on the build machine. It does not work. 

Even porting the patch disabling the build with kwbimage (see links below) 
does not help anymore, because since commit 6e052d1cbafb ("mkimage: add public 
key for image pre-load stage") there's a new hard dependency on host openssl 
in tools/image-host.c and the corresponding kconfig symbol CONFIG_TOOLS_FIT 
can not be disabled through menuconfig.

Just read those discussions again, but not sure what can be done to proceed 
here? Can I help somehow?

(Board to be built here is based on at91 sama5d27 SoC, no fit image required.)

Greets
Alex

Link: https://patchwork.ozlabs.org/project/uboot/patch/
20220111153120.1276641-1-marex@denx.de/
Link: https://patchwork.ozlabs.org/project/uboot/patch/20211021093304.25399-1-pali@kernel.org/

Re: Build with CONFIG_TOOLS_LIBCRYPTO disabled is broken

[Simon Glass]

Hi Alexander,

On Tue, 26 Jul 2022 at 02:27, Alexander Dahl <ada@thorsis.com> wrote:
>
> Hei hei,
>
> once again I tried building U-Boot with CONFIG_TOOLS_LIBCRYPTO disabled and
> with no libssl-dev installed on the build machine. It does not work.
>
> Even porting the patch disabling the build with kwbimage (see links below)
> does not help anymore, because since commit 6e052d1cbafb ("mkimage: add public
> key for image pre-load stage") there's a new hard dependency on host openssl
> in tools/image-host.c and the corresponding kconfig symbol CONFIG_TOOLS_FIT
> can not be disabled through menuconfig.
>
> Just read those discussions again, but not sure what can be done to proceed
> here? Can I help somehow?
>
> (Board to be built here is based on at91 sama5d27 SoC, no fit image required.)

One thing that might help here is to add a build which disables that
option, something like:

buildman -a ~TOOLS_LIBCRYPTO --board sandbox

that could go in .gitlab-... and .azure

That would stop it happening again.

Regards,
Simon

Re: Build with CONFIG_TOOLS_LIBCRYPTO disabled is broken

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 978 bytes --]

On Tue, Jul 26, 2022 at 10:27:01AM +0200, Alexander Dahl wrote:
> Hei hei,
> 
> once again I tried building U-Boot with CONFIG_TOOLS_LIBCRYPTO disabled and 
> with no libssl-dev installed on the build machine. It does not work. 
> 
> Even porting the patch disabling the build with kwbimage (see links below) 
> does not help anymore, because since commit 6e052d1cbafb ("mkimage: add public 
> key for image pre-load stage") there's a new hard dependency on host openssl 
> in tools/image-host.c and the corresponding kconfig symbol CONFIG_TOOLS_FIT 
> can not be disabled through menuconfig.
> 
> Just read those discussions again, but not sure what can be done to proceed 
> here? Can I help somehow?

I think we need a new patch that guards the new functions / calls under
CONFIG_TOOLS_LIBCRYPTO and then a new CI job that removes libssl-dev
before building tools-only so we don't re-introduce the problem is what
we need to move forward here.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: Build with CONFIG_TOOLS_LIBCRYPTO disabled is broken

[Alexander Dahl]

Hello everyone,

Am Mittwoch, 27. Juli 2022, 15:08:56 CEST schrieb Tom Rini:
> On Tue, Jul 26, 2022 at 10:27:01AM +0200, Alexander Dahl wrote:
> > Hei hei,
> > 
> > once again I tried building U-Boot with CONFIG_TOOLS_LIBCRYPTO disabled
> > and
> > with no libssl-dev installed on the build machine. It does not work.
> > 
> > Even porting the patch disabling the build with kwbimage (see links below)
> > does not help anymore, because since commit 6e052d1cbafb ("mkimage: add
> > public key for image pre-load stage") there's a new hard dependency on
> > host openssl in tools/image-host.c and the corresponding kconfig symbol
> > CONFIG_TOOLS_FIT can not be disabled through menuconfig.
> > 
> > Just read those discussions again, but not sure what can be done to
> > proceed
> > here? Can I help somehow?
> 
> I think we need a new patch that guards the new functions / calls under
> CONFIG_TOOLS_LIBCRYPTO and then a new CI job that removes libssl-dev
> before building tools-only so we don't re-introduce the problem is what
> we need to move forward here.

Apart from that kwbimage stuff, the changeset 6e052d1cbafb mentioned above 
touches the following files:

- include/image.h
- tools/fit_image.c
- tools/image-host.c

Conditional building for CONFIG_TOOLS_LIBCRYPTO can currently only be found in 
tools/Makefile (not through #ifdefs in header or source files).  

I'm not sure if fit_image.o and image-host.o should be moved away from 
FIT_OBJS-y to something else, though.  This probably requires a better 
understanding of those objects than I have. :-/

Greets
Alex