| Message ID | 20260829173245.5-tFbtxE@breakpoint.cc |
|---|---|
| State | New |
| Delegated to: | David Oberhollenzer |
| Headers | show |
| Series | ubifs-utils: Don't compile engine support if not available | expand |
在 2026/8/30 1:32, Sebastian Andrzej Siewior 写道: > OpenSSL 4.0 dropped engine support which was deprecated since 3.0. The > replacement is the "providers" API. > > Add an ifndef OPENSSL_NO_ENGINE around the engine code so it can be left > out where it is not supported. > > Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> > --- > ubifs-utils/common/sign.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/ubifs-utils/common/sign.c b/ubifs-utils/common/sign.c > index 032a6acc045d..5f94c0ad176f 100644 > --- a/ubifs-utils/common/sign.c > +++ b/ubifs-utils/common/sign.c > @@ -23,11 +23,14 @@ > #include <openssl/bio.h> > #include <openssl/pem.h> > #include <openssl/err.h> > -#include <openssl/engine.h> > #include <openssl/cms.h> > #include <openssl/conf.h> > #include <err.h> > > +#ifndef OPENSSL_NO_ENGINE > +#include <openssl/engine.h> > +#endif > + > #include "linux_types.h" > #include "sign.h" > #include "ubifs.h" > @@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) > *cert = NULL; > > if (!strncmp(private_key_name, "pkcs11:", 7)) { > +#ifndef OPENSSL_NO_ENGINE > ENGINE *e; > struct { > const char *url; > @@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) > } > *cert = parms.cert; > fprintf(stderr, "Using cert %p\n", *cert); > +#else > + ssl_err_msg("PKCS#11 ENGINE support not available."); > + return NULL; Hi Sebastian, Thanks for pointing that. I am wondering whether it would be better to implement PKCS11 encryption in #else branch by the OpenSSL 4.0 API provider. > +#endif > } else { > BIO *b; > >
On 2026-08-31 09:50:18 [+0800], Zhihao Cheng wrote: > 在 2026/8/30 1:32, Sebastian Andrzej Siewior 写道: > > @@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) > > *cert = NULL; > > if (!strncmp(private_key_name, "pkcs11:", 7)) { > > +#ifndef OPENSSL_NO_ENGINE > > ENGINE *e; > > struct { > > const char *url; > > @@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) > > } > > *cert = parms.cert; > > fprintf(stderr, "Using cert %p\n", *cert); > > +#else > > + ssl_err_msg("PKCS#11 ENGINE support not available."); > > + return NULL; > Hi Sebastian, > Thanks for pointing that. I am wondering whether it would be better to > implement PKCS11 encryption in #else branch by the OpenSSL 4.0 API provider. Well. This is a the very least gets it compiled. The provider API is supported since OpenSSL 3.0 so I wouldn't make it available only if ENGINE isn't supported. You still need the actual provider. > > +#endif > > } else { > > BIO *b; > > Sebastian
diff --git a/ubifs-utils/common/sign.c b/ubifs-utils/common/sign.c index 032a6acc045d..5f94c0ad176f 100644 --- a/ubifs-utils/common/sign.c +++ b/ubifs-utils/common/sign.c @@ -23,11 +23,14 @@ #include <openssl/bio.h> #include <openssl/pem.h> #include <openssl/err.h> -#include <openssl/engine.h> #include <openssl/cms.h> #include <openssl/conf.h> #include <err.h> +#ifndef OPENSSL_NO_ENGINE +#include <openssl/engine.h> +#endif + #include "linux_types.h" #include "sign.h" #include "ubifs.h" @@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) *cert = NULL; if (!strncmp(private_key_name, "pkcs11:", 7)) { +#ifndef OPENSSL_NO_ENGINE ENGINE *e; struct { const char *url; @@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) } *cert = parms.cert; fprintf(stderr, "Using cert %p\n", *cert); +#else + ssl_err_msg("PKCS#11 ENGINE support not available."); + return NULL; +#endif } else { BIO *b;
OpenSSL 4.0 dropped engine support which was deprecated since 3.0. The replacement is the "providers" API. Add an ifndef OPENSSL_NO_ENGINE around the engine code so it can be left out where it is not supported. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> --- ubifs-utils/common/sign.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)