Hi Eddie, On 2026-10-29T20:13:40+11:00, Eddie Kovsky <[email protected]> wrote:
> This series adds support for the OpenSSL Provider API while continuing > to support the existing Engine API on distros shipping older releases of > OpenSSL. Build dependencies for local development and CI are also > updated, while the final patch adds support for using hardware tokens > with the Provider API. One thing I'd like to check before this series goes in. The provider path does not accept the same command line as the engine path. -k must be the full 'pkcs11:' URI, the key-name-hint is ignored and -N is silently dropped (see my comments on patches 1 and 3). So the same mkimage command works on one host and fails on another, depending on the OpenSSL version. It would be worth keeping the existing command line working with the provider if you can. > The changes have been tested with the FIT signature verification vboot > tests on Fedora 44, Debian 13, and RHEL 8 with OpenSSL 1.1.1. All 37 > tests pass with both the legacy Engine library installed and with the > Provider API. Just to check, none of the vboot tests use an engine or a pkcs11 token? If that's right, these 30-odd tests only cover the PEM-file path, and nothing uses the pkcs11-provider package that the Dockerfile change adds to CI. Since you already tested with SoftHSM, please can you add a test which signs with a SoftHSM token? That would give the CI package a purpose and would have caught the gap between patches 1 and 3. Regards, Simon
