Hi Eddie, On 2026-10-29T20:13:40+11:00, Eddie Kovsky <[email protected]> wrote: > Add pkcs11-provider package to build dependencies > > This package is needed to use PKCS11 with OpenSSL >= 3.0.
As I mentioned on patch 1, rsa_pem_get_priv_key() now loads the pkcs11 provider even for a plain .key file, and calls errx() if that fails. So on any OpenSSL 3 host without pkcs11-provider, all FIT signing in mkimage fails, the vboot tests included. Is that why this package is being added to the Docker image? If so, I don't think it is right. Linux sign-file only loads the pkcs11 provider when the key name starts with 'pkcs11:'. If patch 1 does the same, only the token path (patch 3) needs pkcs11-provider, and this patch becomes optional tooling rather than a fix to keep CI working. If it really must be required, this patch needs to come before patch 1 so the series stays bisectable, and the commit message should explain why. > diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst > @@ -28,8 +28,8 @@ Depending on the build targets further packages maybe needed > - libgnutls28-dev libguestfs-tools libncurses-dev \ > - libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \ > + libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \ > + libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \ This is a runtime dependency for signing with a hardware token, not a build dependency. I think it fits better in doc/usage/fit/signature.rst, which still only says that libp11 / the pkcs11 engine is needed. Please can you update that section to cover the provider for OpenSSL >= 3? > diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile > @@ -122,6 +122,7 @@ RUN > --mount=type=cache,target=/var/cache/apt,sharing=locked \ > openssl \ > picocom \ > parted \ > + pkcs11-provider \ The image is based on noble, which ships OpenSSL 3.0. After patch 1 the engine path is compiled out there, so libengine-pkcs11-openssl seems to be unused. It would be worth dropping it here unless something else still needs it. > > Signed-off-by: Eddie Kovsky <[email protected]> > > doc/build/gcc.rst | 4 ++-- > tools/docker/Dockerfile | 1 + > 2 files changed, 3 insertions(+), 2 deletions(-) Regards, Simon
