They share a symptom but have different causes and need different fixes. The noble fix (0.4.12-1.1ubuntu2) does not help resolute.
LP: #2163152 (noble) - Caused by Ubuntu's own SRU delta in 0.4.12-1.1ubuntu1: the backported workaround that calls ENGINE_set_default_string(engine, "PKEY_CRYPTO") in src/eng_front.c. - That code only runs on OpenSSL 3.0.12-3.0.13, 3.1.4-3.1.5 and 3.2.0-3.2.1, which includes noble's 3.0.13. - Fixed by dropping the delta (0.4.12-1.1ubuntu2, verified above on noble). This bug (resolute) - Caused by plain upstream code in 0.4.18-1, which is synced from Debian with no Ubuntu delta, so there is nothing to revert. - Upstream commit 60329e0 (new in 0.4.18) calls EVP_PKEY_meth_add0() in src/p11_rsa.c:307 on every RSA key load. That registers libp11's RSA method for the whole process, whatever the OpenSSL version. - 0.4.18 also contains the noble workaround, but it is inactive on resolutes OpenSSL 3.5.5. Upstream 0.4.17 has the same workaround without 60329e0 and tests CLEAN on resolute; 0.4.18 tests POLLUTED. So 60329e0 is the only cause here. - Fixed upstream in libp11 0.4.21 (PR #675). Resolute needs that fix backported or 60329e0 reverted. What they share: the pkcs11 engine changes OpenSSL state for the whole process. Other RSA code in the same process then fails, which is what breaks tpm2-tss inside wpa_supplicant. The same probe detects both, which is why the symptoms are identical. Neither caused the other. 0.4.18 reached resolute in February 2026, before the noble SRU in August. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172829 Title: EAP-TLS with TPM-backed PKCS#11 keys broken in 26.04: libp11 0.4.18 registers RSA EVP_PKEY_METHOD process-wide To manage notifications about this bug go to: https://bugs.launchpad.net/libp11/+bug/2172829/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
