Re: [PATCH v3] Add support for OpenSSL Provider API

[Eddie Kovsky <ekovsky@redhat.com>]

--->8
> > I finally got to the bottom of this. Debian/Ubuntu ship OpenSSL backends
> > separately. The CI environment is missing the 'pkcs11-provider'
> > package, which is causing the binman tests to fail.
> > 
> >     $ apt show pkcs11-provider
> >     Package: pkcs11-provider
> >     Version: 1.0-3
> >     Priority: optional
> >     Section: libs
> >     Maintainer: Luca Boccassi <bluca@debian.org>
> >     Installed-Size: 410 kB
> >     Depends: libc6 (>= 2.34), libssl3t64 (>= 3.0.7~)
> >     Homepage: https://github.com/latchset/pkcs11-provider
> >     Download-Size: 125 kB
> >     APT-Manual-Installed: yes
> >     APT-Sources: http://ftp.debian.org/debian stable/main amd64 Packages
> >     Description: OpenSSL 3 provider for PKCS11
> >     With this provider for OpenSSL you can use the OpenSSL library
> >     (version 3) and command line tools with any PKCS11 implementation as
> >     backend for the crypto operations.
> > 
> > With this package installed the SSL errors logged on Azure are no longer reproducible.
> > 
> > The results from the first pipeline expired while I was investigating
> > this. I reran the CI job so you can see the error messages.
> > 
> >     https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13035&view=logs&j=c59aff74-743b-5f08-f408-4a608a489153&t=f2ea3536-b291-5a39-ad92-0220c9b8101a
> > 
> > I have looked into the .azure-pipelines.yml file, but it's not clear to
> > me how to configure the CI to install extra packages.
> 
> Ah, OK. So the package needs to be added to tools/docker/Dockerfile (and
> doc/build/gcc.rst). For testing changes out, you can then modify
> .azure-pipelines.yml to point at your image, rather than the default
> image. Or hack in a "sudo apt-get update && sudo apt-get install ..." to
> the job.
> 
> -- 
> Tom

Hi Tom

Updating the dockerfile and documentation was easy enough, but I was
still seeing the Azure pipeline fail with the same errors. It seems to
be ignoring the updated dockerfile.

After digging through the pipeline logs I noticed that Azure is using
the Windows Subsystem for Linux with Arch Linux to set up the test
environment. The package name 'pkcs11-provider' is even the same on
Arch, so I added that to .azure-pipelines.yml.

    https://archlinux.org/packages/extra/x86_64/pkcs11-provider/

And the Azure pipeline now fails because it reports the package doesn't
exist.

    https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13066&view=logs&j=8222cf02-b5ce-5040-5def-6173bf341f71&t=5f6e674b-07e4-5ce5-77ac-ecaae7331dd8

I am not an expert in these CI systems, so I'm not sure what else can be
done to change the test environment.

Eddie