From a1c389825ea46ddd400536b9b5551c31ac186587 Mon Sep 17 00:00:00 2001 From: Jaipaul Cheernam Date: Thu, 27 Aug 2026 20:53:09 +0200 Subject: [PATCH] pkcs11-helper: fix build with OpenSSL 4.0 OpenSSL 4.0 makes ASN1_TIME opaque. Replace manual field access with ASN1_TIME_to_tm() API. Upstream-Status: Backport [https://github.com/OpenSC/pkcs11-helper/commit/59cc22b8d656] Signed-off-by: Jaipaul Cheernam Signed-off-by: Khem Raj --- ...1-crypto-openssl-use-ASN1_TIME_to_tm.patch | 45 +++++++++++++++++++ .../pkcs11-helper/pkcs11-helper_1.31.0.bb | 4 +- 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper/0001-crypto-openssl-use-ASN1_TIME_to_tm.patch diff --git a/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper/0001-crypto-openssl-use-ASN1_TIME_to_tm.patch b/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper/0001-crypto-openssl-use-ASN1_TIME_to_tm.patch new file mode 100644 index 0000000000..3bc5d3d817 --- /dev/null +++ b/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper/0001-crypto-openssl-use-ASN1_TIME_to_tm.patch @@ -0,0 +1,45 @@ +From 59cc22b8d65669da599f1c435fdfe35d4e07db0e Mon Sep 17 00:00:00 2001 +From: Ravi Kant Sharma +Date: Thu, 4 Jun 2026 12:49:44 +0200 +Subject: [PATCH] crypto-openssl: use ASN1_TIME_to_tm + +Introduced in openssl-1.1.1 and is required for openssl-4. +Upstream-Status: Backport [https://github.com/OpenSC/pkcs11-helper/commit/59cc22b8d656] + +Note: ChangeLog hunk dropped as it does not apply to the released tarball. +Signed-off-by: Jaipaul Cheernam +--- + lib/_pkcs11h-crypto-openssl.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +diff --git a/lib/_pkcs11h-crypto-openssl.c b/lib/_pkcs11h-crypto-openssl.c +index 05af65e1..aa58722c 100644 +--- a/lib/_pkcs11h-crypto-openssl.c ++++ b/lib/_pkcs11h-crypto-openssl.c +@@ -148,21 +148,15 @@ __pkcs11h_crypto_openssl_certificate_get_expiration ( + notBefore != NULL && + notAfter != NULL && + X509_cmp_current_time (notBefore) <= 0 && +- X509_cmp_current_time (notAfter) >= 0 && +- notAfter->length >= 12 ++ X509_cmp_current_time (notAfter) >= 0 + ) { + struct tm tm1; + + memset (&tm1, 0, sizeof (tm1)); +- tm1.tm_year = (notAfter->data[ 0] - '0') * 10 + (notAfter->data[ 1] - '0') + 100; +- tm1.tm_mon = (notAfter->data[ 2] - '0') * 10 + (notAfter->data[ 3] - '0') - 1; +- tm1.tm_mday = (notAfter->data[ 4] - '0') * 10 + (notAfter->data[ 5] - '0'); +- tm1.tm_hour = (notAfter->data[ 6] - '0') * 10 + (notAfter->data[ 7] - '0'); +- tm1.tm_min = (notAfter->data[ 8] - '0') * 10 + (notAfter->data[ 9] - '0'); +- tm1.tm_sec = (notAfter->data[10] - '0') * 10 + (notAfter->data[11] - '0'); +- +- *expiration = mktime (&tm1); +- *expiration += (int)(mktime (localtime (expiration)) - mktime (gmtime (expiration))); ++ if (ASN1_TIME_to_tm (notAfter, &tm1)) { ++ *expiration = mktime (&tm1); ++ *expiration += (int)(mktime (localtime (expiration)) - mktime (gmtime (expiration))); ++ } + } + + cleanup: diff --git a/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper_1.31.0.bb b/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper_1.31.0.bb index 3e776993f4..fd81ad888d 100644 --- a/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper_1.31.0.bb +++ b/meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper_1.31.0.bb @@ -14,7 +14,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=008a5b65f5d167bd0f646530ad3d3293 \ file://COPYING.GPL;md5=8a71d0475d08eee76d8b6d0c6dbec543 \ file://COPYING.BSD;md5=66b7a37c3c10483c1fd86007726104d7 \ " -SRC_URI = "git://github.com/OpenSC/${BPN}.git;branch=master;protocol=https" +SRC_URI = "git://github.com/OpenSC/${BPN}.git;branch=master;protocol=https \ + file://0001-crypto-openssl-use-ASN1_TIME_to_tm.patch \ + " # master SRCREV = "286b4415b95f298ab35d62508a37c2aefc055037"