mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-23 20:58:33 +00:00
Johannes Schneider
63b9897c27
signing_extract_cert_der() and signing_extract_cert_pem() read the certificate off the token with 'extract-cert <pkcs11-uri>'. extract-cert reaches a pkcs11 token through the OpenSSL ENGINE API, which OpenSSL 4.0 removed; meta-oe's own extract-cert now errors "PKCS#11 URIs require OpenSSL < 4.0" on such input. Both exporters are therefore broken on OpenSSL 4. signing_prepare() already configures the pkcs11 provider (OPENSSL_MODULES plus a provider openssl.cnf), so read the certificate through it with 'openssl storeutl -certs' instead. The class is provider-based on both OpenSSL 3 and 4, so this needs no version branching. Make _pem the primitive (storeutl emits PEM) and derive _der from it. storeutl -certs writes every certificate the URI matches; a signing role URI is expected to pin a single object, and _der keeps the first cert should more than one come back. The class no longer invokes extract-cert; drop it from DEPENDS. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>