On 10/30/26, Quentin Schulz wrote: > Hi Eddie, > > On 10/29/26 9:13 PM, Eddie Kovsky wrote: > > The Engine API has been deprecated since the release of OpenSSL 3.0. End > > users have been advised to migrate to the new Provider interface. > > Several distributions have already removed support for engines, which is > > preventing U-Boot from being compiled in those environments. > > > > This series adds support for the OpenSSL Provider API while continuing > > to support the existing Engine API on distros shipping older releases of > > OpenSSL. Build dependencies for local development and CI are also > > updated, while the final patch adds support for using hardware tokens > > with the Provider API. > > > > The changes have been tested with the FIT signature verification vboot > > tests on Fedora 44, Debian 13, and RHEL 8 with OpenSSL 1.1.1. All 37 > > tests pass with both the legacy Engine library installed and with the > > Provider API. > > > > I'm NACKing this series quickly because we are having pressure from multiple > projects and Tom would like to see this fixed ASAP, and this version here > should not be merged. From a cursory look a lot of feedback was ignored, > possibly because I did too many rounds of reviews and it got difficult to > follow. I'll therefore spend time next week to collect the reviews I made on > v4 and that sill apply and post them condensed on this thread. > > Please, we just need to fix the build issue for 2027.01. We don't need > providers in 2027.01, just the ability to build on OpenSSL 4 and on distros > with OpenSSL3 with engines disabled, without breaking OpenSSL engine support > for other cases. If you get a patch to fix this, please send it whenever you > can, I'll still collect the reviews from v4 and post it here. If you're not > interested in doing that, lemme know and I'll take over this part and you > can always test the patch(es) if you want to. > > Cheers, > Quentin >
Hi Quentin I designed this change from the very beginning to maintain the existing code base and preserve backward compatibility for users of older OpenSSL releases who are still using the Engine API. We cannot add support for OpenSSL 3 or later without moving to the Provider API because of the way the OpenSSL project has changed their interface. Both I and other reviewers have tested the proposed changes on different distributions using different OpenSSL releases. The build failure is resolved on OpenSSL >= 3, while building with the Engine API still works as expected. (The only obstacle we found was that signing with a hardware token key using Providers didn't work, partly because the existing code doesn't make the pkcs11 uri parsing available on all paths. But Johannes already proposed a solution that resolves that issue.) What are your specific concerns about the code in this version of the patch series? Eddie
