The pre-load entry type signs with Cryptodome, which has no PKCS#11 support, so the private key must be a file. Keys held in an HSM or on a smart card cannot be used.
Add an optional 'engine' property. When set, binman signs by running openssl with that engine and takes 'key-name' as the engine-specific key identifier. Tested with SoftHSM via the new tests (both paddings) and with an RSA-2048 key on a YubiKey PIV slot. Simon, thank you for reviewing v1. I hope this version addresses your feedback. Changes in v2: - Reject a missing engine key-name before attempting to sign. - Remove automatic PKCS#11 URI construction. Pass the engine key identifiers unchanged. - Explain that, when OpenSSL is missing, _sign_engine() returns exactly RSAS[sign_name] zero-filled bytes so binman can report the missing tool without failing the signature-size check. - Move the change to the testPreLoadInvalidKey() test to patch 1. - Add a separate SoftHSM setup refactor (patch 3). - Use one device-tree for both paddings. - Add tests for a missing engine key name and an incorrect signature size. Lorenz Kofler (4): binman: pre-load: Move signing into its own function binman: pre-load: Allow signing with an OpenSSL engine binman: tests: Share SoftHSM token setup binman: pre-load: Test signing with an OpenSSL engine tools/binman/btool/openssl.py | 28 +++ tools/binman/etype/pre_load.py | 131 +++++++++--- tools/binman/ftest.py | 189 +++++++++++++----- .../test/security/pre_load_engine_pkcs11.dts | 24 +++ 4 files changed, 291 insertions(+), 81 deletions(-) create mode 100644 tools/binman/test/security/pre_load_engine_pkcs11.dts -- 2.55.0
