diff mbox series

[meta-oe] signing.bbclass: extract certs via the PKCS#11 provider

Message ID 20260927041611.766986-1-johannes.schneider@leica-geosystems.com
State Under Review
Headers show
Series [meta-oe] signing.bbclass: extract certs via the PKCS#11 provider | expand

Commit Message

Johannes Schneider Sept. 27, 2026, 4:16 a.m. UTC
signing_extract_cert_der() and signing_extract_cert_pem() read the
certificate off the token with 'extract-cert <pkcs11-uri>'. extract-cert
reaches a pkcs11 token through the OpenSSL ENGINE API, which OpenSSL 4.0
removed; meta-oe's own extract-cert now errors "PKCS#11 URIs require
OpenSSL < 4.0" on such input. Both exporters are therefore broken on
OpenSSL 4.

signing_prepare() already configures the pkcs11 provider (OPENSSL_MODULES
plus a provider openssl.cnf), so read the certificate through it with
'openssl storeutl -certs' instead. The class is provider-based on both
OpenSSL 3 and 4, so this needs no version branching. Make _pem the
primitive (storeutl emits PEM) and derive _der from it.

storeutl -certs writes every certificate the URI matches; a signing role
URI is expected to pin a single object, and _der keeps the first cert
should more than one come back.

The class no longer invokes extract-cert; drop it from DEPENDS.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
---
 meta-oe/classes/signing.bbclass | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)


base-commit: a6b11ea9145515aa7a70596f29059519f2a4e23e
diff mbox series

Patch

diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass
index a9f657feb6..8ed18569d8 100644
--- a/meta-oe/classes/signing.bbclass
+++ b/meta-oe/classes/signing.bbclass
@@ -54,7 +54,7 @@ 
 SIGNING_PKCS11_URI ?= ""
 SIGNING_PKCS11_MODULE ?= ""
 
-DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native extract-cert-native"
+DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native"
 
 def signing_class_prepare(d):
     import os.path
@@ -447,7 +447,9 @@  signing_extract_cert_der() {
     local role="${1}"
     local output="${2}"
 
-    extract-cert "$(signing_get_uri $role)" "${output}"
+    signing_extract_cert_pem "${role}" "${output}.tmp-pem"
+    openssl x509 -in "${output}.tmp-pem" -outform der -out "${output}"
+    rm "${output}.tmp-pem"
 }
 
 # signing_extract_cert_pem <role> <pem>
@@ -458,9 +460,7 @@  signing_extract_cert_pem() {
     local role="${1}"
     local output="${2}"
 
-    extract-cert "$(signing_get_uri $role)" "${output}.tmp-der"
-    openssl x509 -inform der -in "${output}.tmp-der" -out "${output}"
-    rm "${output}.tmp-der"
+    openssl storeutl -certs -out "${output}" "$(signing_get_uri $role)"
 }
 
 # signing_create_uri_pem <role> <pem>