[PATCH] Add support for OpenSSL Provider API

[Eddie Kovsky]

On 10/18/25, Mark Kettenis wrote:
> > From: Eddie Kovsky <ekovsky at redhat.com>
> > Date: Fri, 17 Oct 2025 11:13:27 -0600
> > 
> > The Engine API has been deprecated since the release of OpenSSL
> > 3.0. End users have been advised to migrate to the new Provider
> > interface. Several distributions have already removed support for
> > engines, which is preventing U-Boot from being compiled in those
> > environments.
> > 
> > The Kconfig option OPENSSL_NO_DEPRECATED introduces support for the
> > Provider API while continuing to use the existing Engine API on
> > distros shipping older releases of OpenSSL.
> > 
> > This is based on similar work contributed by Jan Stancek
> > updating Linux to use the Provider interface.
> > 
> >     commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> >     Author: Jan Stancek <jstancek at redhat.com>
> >     Date:   Fri Sep 20 19:52:48 2024 +0300
> > 
> >         sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> > 
> > The changes have been tested with the FIT signature verification
> > vboot tests on Fedora 42 and Debian 13. All 30 tests pass with both
> > the legacy Engine library installed and with the Provider API.
> 
> Did you test this with LibreSSL?
> 

Hi Mark

No, I did not test this patch with LibreSSL. OpenSSL is the build
dependency for U-Boot, so that's what I was focused on. The LibreSSL
project states that "The OpenSSL 3 API is not currently supported."

I did make sure to add #ifdef guards throughout the existing code so
that users who do not enable this configuration option can continue to
use the engine interface. That should also work for users who substitute
LibreSSL on their systems.

I did attempt to use the libretls package since you first asked about
this, but I wasn't able to get the build to compile. Is this something
you would be able to verify? I'd be happy to add your Tested-by.

Thanks

Eddie