On 10/31/26, Simon Glass wrote:
> Hi Eddie,
>
> On 2026-10-29T20:13:40+11:00, Eddie Kovsky <[email protected]> wrote:
>
> > This series adds support for the OpenSSL Provider API while continuing
> > to support the existing Engine API on distros shipping older releases of
> > OpenSSL. Build dependencies for local development and CI are also
> > updated, while the final patch adds support for using hardware tokens
> > with the Provider API.
>
> One thing I'd like to check before this series goes in. The provider
> path does not accept the same command line as the engine path. -k must
> be the full 'pkcs11:' URI, the key-name-hint is ignored and -N is
> silently dropped (see my comments on patches 1 and 3). So the same
> mkimage command works on one host and fails on another, depending on
> the OpenSSL version. It would be worth keeping the existing command
> line working with the provider if you can.
>
I have not seen this happen when testing different versions of OpenSSL.
I've been using the test suite to run the vboot tests, which drives
mkimage. I've also been running mkimage directly to test hardware key
signing and not seen any problems.
> > The changes have been tested with the FIT signature verification vboot
> > tests on Fedora 44, Debian 13, and RHEL 8 with OpenSSL 1.1.1. All 37
> > tests pass with both the legacy Engine library installed and with the
> > Provider API.
>
> Just to check, none of the vboot tests use an engine or a pkcs11
> token? If that's right, these 30-odd tests only cover the PEM-file
> path, and nothing uses the pkcs11-provider package that the Dockerfile
> change adds to CI. Since you already tested with SoftHSM, please can
> you add a test which signs with a SoftHSM token? That would give the
> CI package a purpose and would have caught the gap between patches 1
> and 3.
The U-Boot documentation states that an easy way to test signing and
verification is to use the vboot tests provided in the test suite. We
did discover late in the review process that these tests do not exercise
hardware key signing and that the existing pkcs11 uri parsing code was
not available when using Providers. Without an actual hardware token I
used SoftHSM to troubleshoot that issue.
However, I'm not certain it's viable to create an automated hardware
token test (even using software emulation). Both the keys and token
themselves generate unique identifiers. And the setup requires some user
interaction which we may not be able to automate. I suspect those
challenges are why we don't already have a hardware token test.
For reference, this is what the end result looks like with my series
applied and after all of the manual configuration:
$ sudo ./tools/mkimage -F -N pkcs11 -k
"pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=1255c2240187e29e;token=uboot-token;id=%01;object=uboot-key;pin-value=1234"
-K mock.dtb -r fitImage
Warning: configuration 'config-1/signature-1': 'sign-images' is ignored;
all referenced images will be signed
FIT description: Dummy FIT image for testing providers
Created: Mon Oct 26 14:08:58 2026
Image 0 (kernel-1)
Description: Dummy Kernel
Created: Mon Oct 26 14:08:58 2026
Type: Kernel Image
Compression: Unknown Compression
Data Size: 100 Bytes = 0.10 KiB = 0.00 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80008000
Entry Point: 0x80008000
Hash algo: sha256
Hash value:
cd00e292c5970d3c5e2f0ffa5171e555bc46bfc4faddfb4a418b6840b86e79a3
Default Configuration: 'config-1'
Configuration 0 (config-1)
Description: Boot configuration
Kernel: kernel-1
Sign algo: sha256,rsa2048:dev
Sign value:
5d66409984c25fccd5e28b6b148b0804c3dcb9abcf2ba1fb16a3fc26e15fcece69a7172ea59c90ec6e3d24735fa22bb3e1a37b85e93a3cece462fad8370ae80cd9a38626907a3cf7fd7ac48456395ea55bfac9892e29c99e39abb81c7bae971ed612534092db804fc31fe36e58c2271e4023deece17c504d2cf5cfaade4de5dd582ce9d25bc65264f2bcad56d20d9fa7671ad50018c32fd13601046f3489ded2bc483cc22ef45299b05cb3bc4968f5339f3b296da3d00621a3762e84df3c5c166265041921481271d68d505690cd18e87ec338eea0cbade2291a5b14556966e969c6d69bb67faddfd532aa90e14a9b714de9bb57294bb6816fc6493f4691c3ba
Timestamp: Wed Oct 28 10:36:43 2026
Signature written to 'fitImage', node '/configurations/config-1/signature-1'
Public key written to 'mock.dtb', node '/signature/key-dev'
