Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option

[David Lechner <dlechner@baylibre.com>]

On 4/20/26 5:15 PM, David Lechner wrote:
> On 4/20/26 3:38 AM, Wojciech Dubowik wrote:
>> Some distros are using gnutls library without pkcs11 support
>> and linking of mkeficapsule will fail. Add disable pkcs11
>> option with default set to no so distros can control this
>> feature with config option.
>>
>> Suggested-by: Tom Rini <trini@konsulko.com>
>> Cc: Franz Schnyder <fra.schnyder@gmail.com>
>> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@mt.com>
>> ---
>> Changes in v2:
>> - make use of stderr more consistent
>> - add missing ifndef around pkcs11 deinit functions
>> ---
>>  tools/Kconfig        |  8 ++++++++
>>  tools/Makefile       |  3 +++
>>  tools/mkeficapsule.c | 17 ++++++++++++++++-
>>  3 files changed, 27 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/Kconfig b/tools/Kconfig
>> index ef33295b8ecd..ccc878595d3b 100644
>> --- a/tools/Kconfig
>> +++ b/tools/Kconfig
>> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE
>>  	  optionally sign that file. If you want to enable UEFI capsule
>>  	  update feature on your target, you certainly need this.
>>  
>> +config MKEFICAPSULE_DISABLE_PKCS11
> 
> Options that disable something instead of enabling it are confusing.
> Can we make this MKEFICAPSULE_PKCS11 instead and invert the logic?
> 
>> +	bool "Disable pkcs11 support"
>> +	depends on TOOLS_MKEFICAPSULE
>> +	default n
> 
> I think it would be more convenient if we did not require PKS11 by
> default. Otherwise, everyone using Open Embedded that doesn't have
> the "p11-kit" PACKAGECONFIG option set for GnuTLS set (which is the
> default) is going to get a build failure and have to research this
> and find the option and modify their config to fix the build.
> 
> It seems like it would be better to make people who actually need
> PKCS11 possibly get an error by default instead and enable the
> option. This is pure speculation on my part, but it seems like
> this would be the smaller group.
> 
Or maybe we could avoid the config option altogether and do something
with `pkg-config --libs gnutls --print-requires-private` at build time
to detect if `p11-kit-1` is used by gnutls or not?