On Sat, Oct 31, 2026 at 07:11:51AM -0700, Simon Glass wrote: > Hi Eddie, > > On 2026-10-29T20:13:40+11:00, Eddie Kovsky <[email protected]> wrote: > > > This series adds support for the OpenSSL Provider API while continuing > > to support the existing Engine API on distros shipping older releases of > > OpenSSL. Build dependencies for local development and CI are also > > updated, while the final patch adds support for using hardware tokens > > with the Provider API. > > One thing I'd like to check before this series goes in. The provider > path does not accept the same command line as the engine path. -k must > be the full 'pkcs11:' URI, the key-name-hint is ignored and -N is > silently dropped (see my comments on patches 1 and 3). So the same > mkimage command works on one host and fails on another, depending on > the OpenSSL version. It would be worth keeping the existing command > line working with the provider if you can. > > > The changes have been tested with the FIT signature verification vboot > > tests on Fedora 44, Debian 13, and RHEL 8 with OpenSSL 1.1.1. All 37 > > tests pass with both the legacy Engine library installed and with the > > Provider API. > > Just to check, none of the vboot tests use an engine or a pkcs11 > token? If that's right, these 30-odd tests only cover the PEM-file > path, and nothing uses the pkcs11-provider package that the Dockerfile > change adds to CI. Since you already tested with SoftHSM, please can > you add a test which signs with a SoftHSM token? That would give the > CI package a purpose and would have caught the gap between patches 1 > and 3.
Can you please catch up on emails before replying with a bunch of feedback. Quentin has already replied stressing that we need to go with just fixing the build issues for now and dealing with all of the other stuff, of which he has already provided feedback, but will summarize again, as a follow-up. -- Tom
signature.asc
Description: PGP signature
