On Tue, 2026-07-21 at 09:53 +0200, Heinrich Schuchardt via U-Boot wrote:
>
> > +#ifdef MKEFICAPSULE_PKCS11
> > +static int pkcs11_init(void)
> > +{
> > + const char *lib;
> > + int ret;
> > +
> > + lib = getenv("PKCS11_MODULE_PATH");
>
> Nowhere in our documentation we describe this environment variable. How
> should a user know what value is expected?
>
> I guess doc/mkeficapsule.1 and doc/develop/uefi/uefi.rst need an update.
>
> > + if (!lib) {
> > + fprintf(stdout,
> > + "PKCS11_MODULE_PATH not set in the environment\n");
> > + return -1;
> > + }
> > +It shouldn't be needed at all. You should always just be able to use a PKCS#11 URI in place of a key or cert filename, and it should Just Work™.
smime.p7s
Description: S/MIME cryptographic signature
