Hi Eddie,
On 10/29/26 9:13 PM, Eddie Kovsky wrote:
The Engine API has been deprecated since the release of OpenSSL 3.0. End
users have been advised to migrate to the new Provider interface.
Several distributions have already removed support for engines, which is
preventing U-Boot from being compiled in those environments.
This series adds support for the OpenSSL Provider API while continuing
to support the existing Engine API on distros shipping older releases of
OpenSSL. Build dependencies for local development and CI are also
updated, while the final patch adds support for using hardware tokens
with the Provider API.
The changes have been tested with the FIT signature verification vboot
tests on Fedora 44, Debian 13, and RHEL 8 with OpenSSL 1.1.1. All 37
tests pass with both the legacy Engine library installed and with the
Provider API.
I'm NACKing this series quickly because we are having pressure from
multiple projects and Tom would like to see this fixed ASAP, and this
version here should not be merged. From a cursory look a lot of feedback
was ignored, possibly because I did too many rounds of reviews and it
got difficult to follow. I'll therefore spend time next week to collect
the reviews I made on v4 and that sill apply and post them condensed on
this thread.
Please, we just need to fix the build issue for 2027.01. We don't need
providers in 2027.01, just the ability to build on OpenSSL 4 and on
distros with OpenSSL3 with engines disabled, without breaking OpenSSL
engine support for other cases. If you get a patch to fix this, please
send it whenever you can, I'll still collect the reviews from v4 and
post it here. If you're not interested in doing that, lemme know and
I'll take over this part and you can always test the patch(es) if you
want to.
Cheers,
Quentin
