Hi Tom, Eddie, On 10/27/26 7:23 PM, Tom Rini wrote:
On Wed, Apr 29, 2026 at 12:02:45PM -0600, Eddie Kovsky wrote:The Engine API has been deprecated since the release of OpenSSL 3.0. End users have been advised to migrate to the new Provider interface. Several distributions have already removed support for engines, which is preventing U-Boot from being compiled in those environments. Add support for the Provider API while continuing to support the existing Engine API on distros shipping older releases of OpenSSL. This is based on similar work contributed by Jan Stancek updating Linux to use the Provider interface. commit 558bdc45dfb2669e1741384a0c80be9c82fa052c Author: Jan Stancek <[email protected]> Date: Fri Sep 20 19:52:48 2024 +0300 sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 The changes have been tested with the FIT signature verification vboot tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy Engine library installed and with the Provider API. Tested-by Enric Balletbo i Serra <[email protected]> Tested-by Mark Kettenis <[email protected]> Signed-off-by: Eddie Kovsky <[email protected]> --- Changes in v4: - Add comment that @engine pointer is null when using pkcs11 provider - Remove extra line break - Add pkcs11-provider package to build dependencies v3: https://lore.kernel.org/u-boot/[email protected]/Hey folks. So I think at this point we're still expecting a v5, and that should be able to be merged, yes? If so, is there some update on status there, or some way the rest of the community can help out? I think this is something that will really need to be sorted out for the v2027.01 release or a lot more projects are going to start having problems building U-Boot. Thanks!
I think we really should focus on gating the engine code for now, so we can compile on Fedora 44 without openssl-devel-engine, and the other distros that have switched to OpenSSL 4 already (Fedora 45, Yocto, etc...).
Note that Yocto has decided to take the v4 of this patch a few months back, c.f. https://git.openembedded.org/openembedded-core/commit/?id=e7692ccf13484c8064f45dbaecd67ed8ea119cbc
We can then spend more time implementing actual OpenSSL provider support later, as this will be a new feature and doesn't have time pressure (well, for upstream U-Boot that is :) ).
Cheers, Quentin
