The Engine API has been deprecated since the release of OpenSSL 3.0. End users have been advised to migrate to the new Provider interface. Several distributions have already removed support for engines, which is preventing U-Boot from being compiled in those environments.
This series adds support for the OpenSSL Provider API while continuing to support the existing Engine API on distros shipping older releases of OpenSSL. Build dependencies for local development and CI are also updated, while the final patch adds support for using hardware tokens with the Provider API. The changes have been tested with the FIT signature verification vboot tests on Fedora 44, Debian 13, and RHEL 8 with OpenSSL 1.1.1. All 37 tests pass with both the legacy Engine library installed and with the Provider API. Signed-off-by: Eddie Kovsky <[email protected]> --- Changes in v5: - Fix Tested-by trailers - Change error string in drain_openssl_errors() - Additional testing on RHEL 8 with openssl 1.1.1 - Tested hardware token signing path with SoftHSM v4: https://lore.kernel.org/u-boot/[email protected]/ Changes in v4: - Add comment that @engine pointer is null when using pkcs11 provider - Remove extra line break - Add pkcs11-provider package to build dependencies v3: https://lore.kernel.org/u-boot/[email protected]/ Changes in v3: - Removed Kconfig option - Changed macro symbol from CONFIG_OPENSSL_NO_DEPRECATED to USE_PKCS11_PROVIDER or USE_PKCS11_ENGINE v2: https://lore.kernel.org/u-boot/[email protected]/ Changes in v2: - Remove default for new Kconfig option - Use #ifdef instead of IS_ENABLED macro - Remove comment after #endif - Remove unrelated checkpatch cleanup of 'sslErr' variable name v1: https://lore.kernel.org/u-boot/[email protected]/ --- Eddie Kovsky (3): Add support for OpenSSL Provider API Add pkcs11-provider package to build dependencies rsa: load a pkcs11 token key through OSSL_STORE in the provider path doc/build/gcc.rst | 4 +- lib/aes/aes-encrypt.c | 4 +- lib/rsa/rsa-sign.c | 194 ++++++++++++++++++++++++++++++++++++++-- tools/docker/Dockerfile | 1 + 4 files changed, 195 insertions(+), 8 deletions(-) -- 2.56.0
