[PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option

[Wojciech Dubowik]

On Mon, Apr 20, 2026 at 05:58:45PM -0500, David Lechner wrote:

Hello David,

> On 4/20/26 5:15 PM, David Lechner wrote:
> > On 4/20/26 3:38 AM, Wojciech Dubowik wrote:
> >> Some distros are using gnutls library without pkcs11 support
> >> and linking of mkeficapsule will fail. Add disable pkcs11
> >> option with default set to no so distros can control this
> >> feature with config option.
> >>
> >> Suggested-by: Tom Rini <trini at konsulko.com>
> >> Cc: Franz Schnyder <fra.schnyder at gmail.com>
> >> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik at mt.com>
> >> ---
> >> Changes in v2:
> >> - make use of stderr more consistent
> >> - add missing ifndef around pkcs11 deinit functions
> >> ---
> >>  tools/Kconfig        |  8 ++++++++
> >>  tools/Makefile       |  3 +++
> >>  tools/mkeficapsule.c | 17 ++++++++++++++++-
> >>  3 files changed, 27 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/tools/Kconfig b/tools/Kconfig
> >> index ef33295b8ecd..ccc878595d3b 100644
> >> --- a/tools/Kconfig
> >> +++ b/tools/Kconfig
> >> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE
> >>  	  optionally sign that file. If you want to enable UEFI capsule
> >>  	  update feature on your target, you certainly need this.
> >>  
> >> +config MKEFICAPSULE_DISABLE_PKCS11
> > 
> > Options that disable something instead of enabling it are confusing.
> > Can we make this MKEFICAPSULE_PKCS11 instead and invert the logic?
> > 
> >> +	bool "Disable pkcs11 support"
> >> +	depends on TOOLS_MKEFICAPSULE
> >> +	default n
> > 
> > I think it would be more convenient if we did not require PKS11 by
> > default. Otherwise, everyone using Open Embedded that doesn't have
> > the "p11-kit" PACKAGECONFIG option set for GnuTLS set (which is the
> > default) is going to get a build failure and have to research this
> > and find the option and modify their config to fix the build.
> > 
> > It seems like it would be better to make people who actually need
> > PKCS11 possibly get an error by default instead and enable the
> > option. This is pure speculation on my part, but it seems like
> > this would be the smaller group.
> > 
> Or maybe we could avoid the config option altogether and do something
> with `pkg-config --libs gnutls --print-requires-private` at build time
> to detect if `p11-kit-1` is used by gnutls or not?
I will have a look into it and your previous proposal. I guess from 
discussions that this feature is quite urgent.

Regards,
Wojtek