[PATCH] tools: mkeficapsule: Add disable pkcs11 menu option

[Simon Glass]

Hi Wojciech,

On 2026-04-09T07:47:07, Wojciech Dubowik <Wojciech.Dubowik at mt.com> wrote:
> tools: mkeficapsule: Add disable pkcs11 menu option
>
> Some distros are using gnutls library without pkcs11 support
> and linking of mkeficapsule will fail. Add disable pkcs11
> option with default set to no so distros can control this
> feature with config option.
>
> Suggested-by: Tom Rini <trini at konsulko.com>
> Cc: Franz Schnyder <fra.schnyder at gmail.com>
> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik at mt.com>
>
> tools/Kconfig        |  8 ++++++++
>  tools/Makefile       |  3 +++
>  tools/mkeficapsule.c | 14 ++++++++++++++
>  3 files changed, 25 insertions(+)

> diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c
> @@ -301,6 +305,7 @@ static int create_auth_data(struct auth_context *ctx)
> +#else
> +             fprintf(stdout, "Pkcs11 support is disabled\n");
> +             return -1;

Please can you use stderr here for consistency with surrounding error handling.

> diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c
> @@ -301,6 +305,7 @@ static int create_auth_data(struct auth_context *ctx)

The cleanup code at lines 420-423 calls gnutls_pkcs11_deinit() when
pkcs11_cert || pkcs11_key is true. When
CONFIG_MKEFICAPSULE_DISABLE_PKCS11 is defined, these can still be set
if the user provides a "pkcs11:" URL, but gnutls_pkcs11_deinit() will
not be available. Please can you wrap that cleanup block with #ifndef
CONFIG_MKEFICAPSULE_DISABLE_PKCS11 as well, or ensure the function
returns before reaching that code path.

Regards,
Simon