EXTERNAL - Host GnuTLS now needs pkcs11 support

[Tom Rini]

On Wed, Apr 08, 2026 at 08:50:41AM +0200, Wojciech Dubowik wrote:
> On Tue, Apr 07, 2026 at 06:15:13PM +0200, Franz Schnyder wrote:
> Hello Franz,
> > Hello Wojciech,
> > 
> > with commit 0c716a157be ("tools: mkeficapsule: Add support for pkcs11"),
> > mkeficapsule now references to pkcs11 related symbols.
> > 
> > This breaks our OE builds because it causes link failures for 
> > configurations that build mkeficapsule when the host gnutls is 
> > built without pkcs11 support:
> > ```
> > undefined reference to `gnutls_pkcs11_obj_list_import_url4'
> > undefined reference to `gnutls_x509_crt_import_pkcs11'
> > undefined reference to `gnutls_pkcs11_init'
> > undefined reference to `gnutls_pkcs11_add_provider'
> > undefined reference to `gnutls_pkcs11_deinit'
> > ```
> > On the OE side, enabling support in gnutls via p11-kit fixes the failures.
> > However, I wonder what the cleanest solution would be. Should this new 
> > host requirement for pkcs11 be handled in the U-Boot OE recipe,  or is
> > there a better way to approach this correctly?
> > 
> > Any ideas?
> I could add disable compile flag in mkeficapsule if there are no objections. Sth
> like this in pkcs11 places:
> 
> +#ifndef DISABLE_PKCS11
>                 ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
> [...]
> +#else
> +               fprintf(stdout, "Pkcs11 support is disabled\n");
> +               return -1;
> +#endif
> 
> This way OE or possibly openwrt don't need to patch.

We should do this as a Kconfig symbol (which shouldn't be enabled by
default), and make sure that tools-only_defconfig does enable it and let
distros disable it as desired.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20260408/b922950e/attachment.sig>