[PATCH v3] Add support for OpenSSL Provider API

[Tom Rini]

On Thu, Feb 19, 2026 at 09:51:05AM -0700, Eddie Kovsky wrote:

> On 01/29/26, Mattijs Korpershoek wrote:
> > Hi Eddie,
> > 
> > Thank you for the patch.
> > 
> 
> Hi Mattijs
> 
> Thanks for the review.
> 
> > On Tue, Jan 20, 2026 at 09:45, Eddie Kovsky <ekovsky at redhat.com> wrote:
> > 
> > > The Engine API has been deprecated since the release of OpenSSL 3.0. End
> > > users have been advised to migrate to the new Provider interface.
> > > Several distributions have already removed support for engines, which is
> > > preventing U-Boot from being compiled in those environments.
> > >
> > > Add support for the Provider API while continuing to support the existing
> > > Engine API on distros shipping older releases of OpenSSL.
> > >
> > > This is based on similar work contributed by Jan Stancek updating Linux
> > > to use the Provider interface.
> > >
> > >     commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> > >     Author: Jan Stancek <jstancek at redhat.com>
> > >     Date:   Fri Sep 20 19:52:48 2024 +0300
> > >
> > >         sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> > >
> > > The changes have been tested with the FIT signature verification vboot
> > > tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> > > Engine library installed and with the Provider API.
> > >
> > > Signed-off-by: Eddie Kovsky <ekovsky at redhat.com>
[snip]
> Sure, I can update the comment for v4.

Since we're talking about v4, can you please make sure that for v4 it:
- Passes CI https://docs.u-boot.org/en/latest/develop/ci_testing.html as
  that will cover some non-Linux host builds.
- See if you can get access to a FreeBSD or OpenBSD host and make sure
  the tools build still works there too? I was hoping Mark would have
  commented / tested-by v3 because I do want to make sure the libressl
  case still builds. At worst case, I have a freebie Oracle VM that's
  FreeBSD based, so you can maybe spin one of those up as well?

Thanks!

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20260219/b3a6cc17/attachment.sig>