[PATCH] tools: mkeficapsule: Add disable pkcs11 menu option

[Paul Barker]

On Mon, 2026-04-20 at 10:50 +0200, Francesco Dolcini wrote:
> + Paul Barker
> 
> Hello all,
> 
> On Mon, Apr 20, 2026 at 10:14:46AM +0200, Wojciech Dubowik wrote:
> > On Thu, Apr 16, 2026 at 05:51:13PM +0200, Franz Schnyder wrote:
> > > On Thu, Apr 09, 2026 at 09:47:07AM +0200, Wojciech Dubowik wrote:
> > > > Some distros are using gnutls library without pkcs11 support
> > > > and linking of mkeficapsule will fail. Add disable pkcs11
> > > > option with default set to no so distros can control this
> > > > feature with config option.
> > > Shouldn't it be the other way around? Use of pkcs11 should be disabled 
> > > by default and enabled if required. As it is now, it would still depend
> > > on the the gnutls library having pkcs11 support and therefore still 
> > > would break our OE builds with mainline u-boot if we don't change our
> > > modules defconfig.
> > 
> > As far as I understand, gnutls is built by default with pkcs11 support. So for
> > most of the distribution it should be ok. Security by default.
> > I don't have yn strong opinion for this but default enabled has been suggested
> > by the maintainer.
> 
> We are in the very unfortunate situation in which we are not able to run
> any test at the moment in our CI and automated test infrastructure (not
> in U-Boot, not in OE), and the reason is that we have pcks11 enabled in
> U-Boot, and OE core is not picking up the patch to enable it [1].
> 
> Any advise to have a way forward?
> 
> Francesco
> 
> [1] https://lore.kernel.org/all/20260408130553.819420-1-fra.schnyder@gmail.com/

Hi Francesco,

Which versions of U-Boot and openembedded-core are you trying to build?

Thanks,

-- 
Paul Barker

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: This is a digitally signed message part
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20260421/69858b45/attachment.sig>