OpenSSL 4.0 removed the ENGINE API. <openssl/engine.h> still exists as a
source-compatibility stub, so both binaries fail to link:
ld.lld: error: undefined symbol: ENGINE_load_builtin_engines
ld.lld: error: undefined symbol: ENGINE_by_id
ld.lld: error: undefined symbol: ENGINE_init
ld.lld: error: undefined symbol: ENGINE_ctrl_cmd_string
ld.lld: error: undefined symbol: ENGINE_load_public_key
The ENGINE use is confined to the "pkcs11:" input branch of each tool, so
compile that branch out on OpenSSL 4 and diagnose the unsupported input
instead. Reading certificates and public keys from PEM files, which is
what the kernel build and most other users do, is unaffected.
Providers supersede engines, but none exposes an equivalent of the pkcs11
engine's LOAD_CERT_CTRL command, so there is nothing to port to yet.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Please see
https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265
for what changes are needed, and sed commands that can be used to make them en masse.
I've verified that bitbake -c patch world works with these, but did not run a world
build; the majority of recipes shouldn't need further fixups, but if there are
some that still fall out, they can be fixed in followups.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The extract-cert tool is used to fetch the X.509 certificate associated
with a key from a PKCS#11 token (such as a HSM or YubiKey). This version
is derived from certs/extract-cert in the Linux kernel as a stand-alone
tool to make it available when signing other software components besides
the kernel.
Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Khem Raj
Alexander Kanavin
Jan Luebbe