On 08/22/26, Jaipaul Cheernam wrote: > Hi Eddie, Quentin, > > We're currently working on upgrading OpenEmbedded-Core (Yocto Project) to > OpenSSL 4.0.1 and hit this exact issue — mkimage fails at FIT image signing > because it unconditionally tries to load the pkcs11 provider, which isn't > available in our build environment. > > For our purposes, file-based key signing with just the default provider works > fine. We're carrying this patch with a local modification that makes the > pkcs11 > provider load non-fatal: > > if (!OSSL_PROVIDER_try_load(NULL, "default", true)) > ERR(1, "OSSL_PROVIDER_try_load(default)"); > /* pkcs11 provider is optional; only needed for pkcs11: URIs */ > if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) > ERR_clear_error(); > > This allows signing to work without pkcs11-provider installed while still > loading it when available (for pkcs11: URI keys). > > Is there a v5 in the works? Happy to test if it would help move this forward. > > Thanks, > Jaipaul >
Hi Jaipaul Yes, I still intend to do a version 5. I have been very busy with my day job recently. And refactoring the PKCS11 URI parsing adds another wrinkle to sort out before I can provide an update. Eddie
