From 63b9897c278754c24df5aa3aa1718f4ab5c8fc3f Mon Sep 17 00:00:00 2001 From: Johannes Schneider Date: Sun, 27 Sep 2026 04:16:11 +0000 Subject: [PATCH] signing.bbclass: extract certs via the PKCS#11 provider signing_extract_cert_der() and signing_extract_cert_pem() read the certificate off the token with 'extract-cert '. extract-cert reaches a pkcs11 token through the OpenSSL ENGINE API, which OpenSSL 4.0 removed; meta-oe's own extract-cert now errors "PKCS#11 URIs require OpenSSL < 4.0" on such input. Both exporters are therefore broken on OpenSSL 4. signing_prepare() already configures the pkcs11 provider (OPENSSL_MODULES plus a provider openssl.cnf), so read the certificate through it with 'openssl storeutl -certs' instead. The class is provider-based on both OpenSSL 3 and 4, so this needs no version branching. Make _pem the primitive (storeutl emits PEM) and derive _der from it. storeutl -certs writes every certificate the URI matches; a signing role URI is expected to pin a single object, and _der keeps the first cert should more than one come back. The class no longer invokes extract-cert; drop it from DEPENDS. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj --- meta-oe/classes/signing.bbclass | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index 3dc8b63b8a..b70c5ca462 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -54,7 +54,7 @@ SIGNING_PKCS11_URI ?= "" SIGNING_PKCS11_MODULE ?= "" -DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native extract-cert-native" +DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native" def signing_class_prepare(d): import os.path @@ -440,7 +440,9 @@ signing_extract_cert_der() { local role="${1}" local output="${2}" - extract-cert "$(signing_get_uri $role)" "${output}" + signing_extract_cert_pem "${role}" "${output}.tmp-pem" + openssl x509 -in "${output}.tmp-pem" -outform der -out "${output}" + rm "${output}.tmp-pem" } # signing_extract_cert_pem @@ -451,9 +453,7 @@ signing_extract_cert_pem() { local role="${1}" local output="${2}" - extract-cert "$(signing_get_uri $role)" "${output}.tmp-der" - openssl x509 -inform der -in "${output}.tmp-der" -out "${output}" - rm "${output}.tmp-der" + openssl storeutl -certs -out "${output}" "$(signing_get_uri $role)" } # signing_create_uri_pem