Re: [ptxdist] [PATCH v2 3/3] code-signing: enable provider support

[Sascha Hauer <s.hauer@pengutronix.de>]

On Fri, Apr 24, 2026 at 09:12:35AM +0200, Michael Olbrich wrote:
> > diff --git a/rules/pre/010-code-signing.make b/rules/pre/010-code-signing.make
> > index 6141a7b19..238f37934 100644
> > --- a/rules/pre/010-code-signing.make
> > +++ b/rules/pre/010-code-signing.make
> > @@ -8,7 +8,7 @@
> >  
> >  CODE_SIGNING_ENV = \
> >  	SO_PATH=$(PTXDIST_SYSROOT_HOST)/usr/lib/engines-3/pkcs11.so \
> > -	OPENSSL_CONF="$(PTXDIST_SYSROOT_HOST)/usr/ssl/openssl.cnf" \
> > +	OPENSSL_CONF="$(PTXDIST_SYSROOT_HOST)/usr/ssl/openssl-pkcs11.cnf" \
> >  	OPENSSL_ENGINES="$(PTXDIST_SYSROOT_HOST)/usr/lib/engines-3"
> 
> So with that, we have support for openssl engines and providers in the
> common parts, right?

Right, both works.

> A BSP specific ptxdist code-signing-provider can still use engines, if it
> sets 'PKCS11_MODULE_PATH' to e.g. 'opensc-pkcs11.so', or does the openssl
> config prevent that?

Yes, should work. I haven't tested explicitly, but softhsm still sets
PKCS11_MODULE_PATH to libsofthsm2.so and that works.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |