@@ -54,7 +54,7 @@
SIGNING_PKCS11_URI ?= ""
SIGNING_PKCS11_MODULE ?= ""
-DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native extract-cert-native"
+DEPENDS += "softhsm-native pkcs11-provider-native libp11-native opensc-native openssl-native"
def signing_class_prepare(d):
import os.path
@@ -447,7 +447,9 @@ signing_extract_cert_der() {
local role="${1}"
local output="${2}"
- extract-cert "$(signing_get_uri $role)" "${output}"
+ signing_extract_cert_pem "${role}" "${output}.tmp-pem"
+ openssl x509 -in "${output}.tmp-pem" -outform der -out "${output}"
+ rm "${output}.tmp-pem"
}
# signing_extract_cert_pem <role> <pem>
@@ -458,9 +460,7 @@ signing_extract_cert_pem() {
local role="${1}"
local output="${2}"
- extract-cert "$(signing_get_uri $role)" "${output}.tmp-der"
- openssl x509 -inform der -in "${output}.tmp-der" -out "${output}"
- rm "${output}.tmp-der"
+ openssl storeutl -certs -out "${output}" "$(signing_get_uri $role)"
}
# signing_create_uri_pem <role> <pem>
signing_extract_cert_der() and signing_extract_cert_pem() read the certificate off the token with 'extract-cert <pkcs11-uri>'. extract-cert reaches a pkcs11 token through the OpenSSL ENGINE API, which OpenSSL 4.0 removed; meta-oe's own extract-cert now errors "PKCS#11 URIs require OpenSSL < 4.0" on such input. Both exporters are therefore broken on OpenSSL 4. signing_prepare() already configures the pkcs11 provider (OPENSSL_MODULES plus a provider openssl.cnf), so read the certificate through it with 'openssl storeutl -certs' instead. The class is provider-based on both OpenSSL 3 and 4, so this needs no version branching. Make _pem the primitive (storeutl emits PEM) and derive _der from it. storeutl -certs writes every certificate the URI matches; a signing role URI is expected to pin a single object, and _der keeps the first cert should more than one come back. The class no longer invokes extract-cert; drop it from DEPENDS. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com> --- meta-oe/classes/signing.bbclass | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) base-commit: a6b11ea9145515aa7a70596f29059519f2a4e23e