Host GnuTLS now needs pkcs11 support

Host GnuTLS now needs pkcs11 support

[Franz Schnyder]

Hello Wojciech,

with commit 0c716a157be ("tools: mkeficapsule: Add support for pkcs11"),
mkeficapsule now references to pkcs11 related symbols.

This breaks our OE builds because it causes link failures for 
configurations that build mkeficapsule when the host gnutls is 
built without pkcs11 support:
```
undefined reference to `gnutls_pkcs11_obj_list_import_url4'
undefined reference to `gnutls_x509_crt_import_pkcs11'
undefined reference to `gnutls_pkcs11_init'
undefined reference to `gnutls_pkcs11_add_provider'
undefined reference to `gnutls_pkcs11_deinit'
```
On the OE side, enabling support in gnutls via p11-kit fixes the failures.
However, I wonder what the cleanest solution would be. Should this new 
host requirement for pkcs11 be handled in the U-Boot OE recipe,  or is
there a better way to approach this correctly?

Any ideas?

Kind regards

Franz

Re: EXTERNAL - Host GnuTLS now needs pkcs11 support

[Wojciech Dubowik]

On Tue, Apr 07, 2026 at 06:15:13PM +0200, Franz Schnyder wrote:
Hello Franz,
> Hello Wojciech,
> 
> with commit 0c716a157be ("tools: mkeficapsule: Add support for pkcs11"),
> mkeficapsule now references to pkcs11 related symbols.
> 
> This breaks our OE builds because it causes link failures for 
> configurations that build mkeficapsule when the host gnutls is 
> built without pkcs11 support:
> ```
> undefined reference to `gnutls_pkcs11_obj_list_import_url4'
> undefined reference to `gnutls_x509_crt_import_pkcs11'
> undefined reference to `gnutls_pkcs11_init'
> undefined reference to `gnutls_pkcs11_add_provider'
> undefined reference to `gnutls_pkcs11_deinit'
> ```
> On the OE side, enabling support in gnutls via p11-kit fixes the failures.
> However, I wonder what the cleanest solution would be. Should this new 
> host requirement for pkcs11 be handled in the U-Boot OE recipe,  or is
> there a better way to approach this correctly?
> 
> Any ideas?
I could add disable compile flag in mkeficapsule if there are no objections. Sth
like this in pkcs11 places:

+#ifndef DISABLE_PKCS11
                ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
[...]
+#else
+               fprintf(stdout, "Pkcs11 support is disabled\n");
+               return -1;
+#endif

This way OE or possibly openwrt don't need to patch.

Regards,
Wojtek

> 
> Kind regards
> 
> Franz

Re: EXTERNAL - Host GnuTLS now needs pkcs11 support

[Franz Schnyder]

Hello
On Wed, Apr 08, 2026 at 08:50:41AM +0200, Wojciech Dubowik wrote:
> I could add disable compile flag in mkeficapsule if there are no objections. Sth
> like this in pkcs11 places:
> 
> +#ifndef DISABLE_PKCS11
>                 ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
> [...]
> +#else
> +               fprintf(stdout, "Pkcs11 support is disabled\n");
> +               return -1;
> +#endif
> 
I think it makes sense, given that some U-Boot users might not want to 
have pkcs11 and deal with the dependencies. 
> This way OE or possibly openwrt don't need to patch.
In any case, I've sent this patch to OE to have pkcs11 support on 
the host side if it's wanted.
https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/

Kind regards

Franz

Re: EXTERNAL - Host GnuTLS now needs pkcs11 support

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1704 bytes --]

On Wed, Apr 08, 2026 at 08:50:41AM +0200, Wojciech Dubowik wrote:
> On Tue, Apr 07, 2026 at 06:15:13PM +0200, Franz Schnyder wrote:
> Hello Franz,
> > Hello Wojciech,
> > 
> > with commit 0c716a157be ("tools: mkeficapsule: Add support for pkcs11"),
> > mkeficapsule now references to pkcs11 related symbols.
> > 
> > This breaks our OE builds because it causes link failures for 
> > configurations that build mkeficapsule when the host gnutls is 
> > built without pkcs11 support:
> > ```
> > undefined reference to `gnutls_pkcs11_obj_list_import_url4'
> > undefined reference to `gnutls_x509_crt_import_pkcs11'
> > undefined reference to `gnutls_pkcs11_init'
> > undefined reference to `gnutls_pkcs11_add_provider'
> > undefined reference to `gnutls_pkcs11_deinit'
> > ```
> > On the OE side, enabling support in gnutls via p11-kit fixes the failures.
> > However, I wonder what the cleanest solution would be. Should this new 
> > host requirement for pkcs11 be handled in the U-Boot OE recipe,  or is
> > there a better way to approach this correctly?
> > 
> > Any ideas?
> I could add disable compile flag in mkeficapsule if there are no objections. Sth
> like this in pkcs11 places:
> 
> +#ifndef DISABLE_PKCS11
>                 ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
> [...]
> +#else
> +               fprintf(stdout, "Pkcs11 support is disabled\n");
> +               return -1;
> +#endif
> 
> This way OE or possibly openwrt don't need to patch.

We should do this as a Kconfig symbol (which shouldn't be enabled by
default), and make sure that tools-only_defconfig does enable it and let
distros disable it as desired.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]