Package: sbsigntool Followup-For: Bug #1138427 X-Debbugs-Cc: [email protected] Control: tags -1 patch ftbfs
Dear Maintainer, The following pactches fixes the build issue by migrating from engine to provider API. The patch is same as efitools since it is essentially the same code. I have backported the fix for kernel module signing in the d/p/u. I tested the provider code using softhsm2, pkcs11-provider, and opensc. -- System Information: Debian Release: trixie/sid APT prefers noble-updates APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, 'noble'), (100, 'noble-backports') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.8.0-124-generic (SMP w/12 CPU threads; PREEMPT) Kernel taint flags: TAINT_WARN Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
Description: Fix FTBFS with OpenSSL 4.0 by replacing ENGINE API with provider API OpenSSL 4.0 removes the ENGINE API entirely. Replace the ENGINE-based key loading with the modern OSSL_PROVIDER + OSSL_STORE API: load the named provider with OSSL_PROVIDER_load(), then iterate OSSL_STORE to retrieve the private key. The --engine flag continues to work but now names an OpenSSL provider (e.g. "pkcs11") instead of a legacy engine. Author: Ravi Kant Sharma <[email protected]> Bug-Ubuntu: https://bugs.launchpad.net/bugs/2154972 Bug-Debian: https://bugs.debian.org/1138427 Last-Update: 2026-07-16 Index: sbsigntool/src/fileio.c =================================================================== --- sbsigntool.orig/src/fileio.c 2026-07-16 12:52:07.745173498 +0200 +++ sbsigntool/src/fileio.c 2026-07-16 12:53:14.977573518 +0200 @@ -39,7 +39,9 @@ #include <openssl/bio.h> #include <openssl/pem.h> #include <openssl/err.h> -#include <openssl/engine.h> +#include <openssl/provider.h> +#include <openssl/store.h> +#include <openssl/ui.h> #include <ccan/talloc/talloc.h> #include <ccan/read_write_all/read_write_all.h> @@ -55,7 +57,7 @@ if (UI_get_string_type(uis) != UIT_PROMPT) return 0; - EVP_read_pw_string(password, sizeof(password), "Enter engine key pass phrase:", 0); + EVP_read_pw_string(password, sizeof(password), "Enter provider key pass phrase:", 0); UI_set_result(ui, uis, password); return 1; } @@ -63,14 +65,14 @@ EVP_PKEY *fileio_read_engine_key(const char *engine, const char *filename) { UI_METHOD *ui; - ENGINE *e; + OSSL_PROVIDER *prov; + OSSL_STORE_CTX *store_ctx; + OSSL_STORE_INFO *info; EVP_PKEY *pkey = NULL; - ENGINE_load_builtin_engines(); - e = ENGINE_by_id(engine); - - if (!e) { - fprintf(stderr, "Failed to load engine: %s\n", engine); + prov = OSSL_PROVIDER_load(NULL, engine); + if (!prov) { + fprintf(stderr, "Failed to load provider: %s\n", engine); ERR_print_errors_fp(stderr); return NULL; } @@ -79,21 +81,36 @@ if (!ui) { fprintf(stderr, "Failed to create UI method\n"); ERR_print_errors_fp(stderr); - goto out_free; + goto out_unload; } UI_method_set_reader(ui, ui_read); - if (!ENGINE_init(e)) { - fprintf(stderr, "Failed to initialize engine %s\n", engine); + store_ctx = OSSL_STORE_open(filename, ui, NULL, NULL, NULL); + if (!store_ctx) { + fprintf(stderr, "Failed to open key store for: %s\n", filename); ERR_print_errors_fp(stderr); - goto out_free; + goto out_free_ui; } - pkey = ENGINE_load_private_key(e, filename, ui, NULL); - ENGINE_finish(e); + while (!OSSL_STORE_eof(store_ctx)) { + info = OSSL_STORE_load(store_ctx); + if (!info) + break; + if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) { + pkey = OSSL_STORE_INFO_get1_PKEY(info); + OSSL_STORE_INFO_free(info); + break; + } + OSSL_STORE_INFO_free(info); + } + OSSL_STORE_close(store_ctx); - out_free: - ENGINE_free(e); + out_free_ui: + UI_destroy_method(ui); + out_unload: + if (!pkey) + OSSL_PROVIDER_unload(prov); + /* Provider stays loaded while pkey is in use; freed on process exit */ return pkey; }
Description: Fix kmodsign FTBFS with OpenSSL 4.0 by replacing ENGINE with provider API OpenSSL 4.0 removes the ENGINE API. kmodsign.c is the kernel's scripts/sign-file.c; adapt its PKCS#11 handling from upstream Linux by loading the pkcs11 and default providers and retrieving the key via OSSL_STORE instead of ENGINE_load_private_key(). Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=558bdc45dfb2 Forwarded: no Bug-Ubuntu: https://bugs.launchpad.net/bugs/2154972 Bug-Debian: https://bugs.debian.org/1138427 Last-Update: 2026-07-16 Index: sbsigntool/src/kmodsign.c =================================================================== --- sbsigntool.orig/src/kmodsign.c 2026-07-16 13:51:13.881990300 +0200 +++ sbsigntool/src/kmodsign.c 2026-07-16 13:51:22.865018105 +0200 @@ -25,7 +25,8 @@ #include <openssl/evp.h> #include <openssl/pem.h> #include <openssl/err.h> -#include <openssl/engine.h> +#include <openssl/provider.h> +#include <openssl/store.h> /* * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to @@ -160,7 +161,7 @@ unsigned long module_size, sig_size; unsigned int use_signed_attrs; const EVP_MD *digest_algo; - EVP_PKEY *private_key; + EVP_PKEY *private_key = NULL; #ifndef USE_PKCS7 CMS_ContentInfo *cms; unsigned int use_keyid = 0; @@ -229,20 +230,29 @@ * will point to. */ if (!strncmp(private_key_name, "pkcs11:", 7)) { - ENGINE *e; + OSSL_STORE_CTX *store_ctx; + OSSL_STORE_INFO *info; - ENGINE_load_builtin_engines(); + ERR(!OSSL_PROVIDER_try_load(NULL, "pkcs11", 1), "Load pkcs11 provider"); + ERR(!OSSL_PROVIDER_try_load(NULL, "default", 1), "Load default provider"); drain_openssl_errors(); - e = ENGINE_by_id("pkcs11"); - ERR(!e, "Load PKCS#11 ENGINE"); - if (ENGINE_init(e)) - drain_openssl_errors(); - else - ERR(1, "ENGINE_init"); - if (key_pass) - ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); - private_key = ENGINE_load_private_key(e, private_key_name, NULL, - NULL); + store_ctx = OSSL_STORE_open(private_key_name, NULL, NULL, NULL, NULL); + ERR(!store_ctx, "%s", private_key_name); + while (!OSSL_STORE_eof(store_ctx)) { + info = OSSL_STORE_load(store_ctx); + if (!info) { + drain_openssl_errors(); + continue; + } + if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) { + private_key = OSSL_STORE_INFO_get1_PKEY(info); + ERR(!private_key, "%s", private_key_name); + } + OSSL_STORE_INFO_free(info); + if (private_key) + break; + } + OSSL_STORE_close(store_ctx); ERR(!private_key, "%s", private_key_name); } else { b = BIO_new_file(private_key_name, "rb");
