signing.bbclass: extract certs via the PKCS#11 provider

signing_extract_cert_der() and signing_extract_cert_pem() read the
certificate off the token with 'extract-cert <pkcs11-uri>'. extract-cert
reaches a pkcs11 token through the OpenSSL ENGINE API, which OpenSSL 4.0
removed; meta-oe's own extract-cert now errors "PKCS#11 URIs require
OpenSSL < 4.0" on such input. Both exporters are therefore broken on
OpenSSL 4.

signing_prepare() already configures the pkcs11 provider (OPENSSL_MODULES
plus a provider openssl.cnf), so read the certificate through it with
'openssl storeutl -certs' instead. The class is provider-based on both
OpenSSL 3 and 4, so this needs no version branching. Make _pem the
primitive (storeutl emits PEM) and derive _der from it.

storeutl -certs writes every certificate the URI matches; a signing role
URI is expected to pin a single object, and _der keeps the first cert
should more than one come back.

The class no longer invokes extract-cert; drop it from DEPENDS.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/classes/signing.bbclass

@@ -54,7 +54,7 @@
 SIGNING_PKCS11_URI ?= ""
 SIGNING_PKCS11_MODULE ?= ""
 
-DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native extract-cert-native"
+DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native"
 
 def signing_class_prepare(d):
     import os.path
@@ -440,7 +440,9 @@ signing_extract_cert_der() {
     local role="${1}"
     local output="${2}"
 
-    extract-cert "$(signing_get_uri $role)" "${output}"
+    signing_extract_cert_pem "${role}" "${output}.tmp-pem"
+    openssl x509 -in "${output}.tmp-pem" -outform der -out "${output}"
+    rm "${output}.tmp-pem"
 }
 
 # signing_extract_cert_pem <role> <pem>
@@ -451,9 +453,7 @@ signing_extract_cert_pem() {
     local role="${1}"
     local output="${2}"
 
-    extract-cert "$(signing_get_uri $role)" "${output}.tmp-der"
-    openssl x509 -inform der -in "${output}.tmp-der" -out "${output}"
-    rm "${output}.tmp-der"
+    openssl storeutl -certs -out "${output}" "$(signing_get_uri $role)"
 }
 
 # signing_create_uri_pem <role> <pem>