The pre-load entry type signs with Cryptodome, which has no PKCS#11 support, so the private key must be a file. Keys held in an HSM or on a smart card cannot be used.
Add an optional 'engine' property. When set, binman signs by running openssl with that engine and takes 'key-name' as the engine-specific key identifier. Tested with SoftHSM via the new tests (both paddings) and with an RSA-2048 key on a YubiKey PIV slot. The tests are skipped when softhsm2-util or the pkcs11 engine is unavailable. Lorenz Kofler (3): binman: pre-load: Move signing into its own function binman: pre-load: Allow signing with an OpenSSL engine binman: pre-load: Test signing with an OpenSSL engine tools/binman/btool/openssl.py | 28 ++++ tools/binman/etype/pre_load.py | 130 ++++++++++++++---- tools/binman/ftest.py | 91 +++++++++++- .../test/security/pre_load_engine_pkcs11.dts | 24 ++++ .../security/pre_load_engine_pkcs11_pss.dts | 24 ++++ 5 files changed, 266 insertions(+), 31 deletions(-) create mode 100644 tools/binman/test/security/pre_load_engine_pkcs11.dts create mode 100644 tools/binman/test/security/pre_load_engine_pkcs11_pss.dts base-commit: 444aca6d1439e4c4b9955171a7f45c053b540f69 -- 2.55.0
