Skip to content

disable OpenSSL engine usage#1326

Open
zpc0 wants to merge 1 commit into
QubesOS:mainfrom
zpc0:drop-openssl-engine
Open

disable OpenSSL engine usage#1326
zpc0 wants to merge 1 commit into
QubesOS:mainfrom
zpc0:drop-openssl-engine

Conversation

@zpc0

@zpc0 zpc0 commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

OpenSSL 4.0 removed engine support.
Fedora 45+ will use OpenSSL 4.x, so prepare for it.

@zpc0

zpc0 commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

I'm not sure where OpenSSL engine is used, so this is draft.

Comment thread kernel.spec.in Outdated
%undefine __brp_mangle_shebangs

# Disable OpenSSL engine
%global _pkg_extra_cflags -DOPENSSL_NO_ENGINE

@marmarek marmarek Jul 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is necessary. Both places where kernel build may use engines already switch to providers on openssl >= 3.0

@marmarek

Copy link
Copy Markdown
Member

I'm not sure where OpenSSL engine is used, so this is draft.

Hint: grep openssl/engine.h in kernel sources.

OpenSSL 4.0 does not have engine support.
Fedora 45+ will use OpenSSL 4.x, so prepare for it.

In Linux, sign-file.c and extract-cert.c uses <openssl/engine.h>,
but 6.1 or later LTS kernel does not use engine if OpenSSL is 3.0+.
@zpc0
zpc0 force-pushed the drop-openssl-engine branch from 514a97f to dbd21cd Compare July 13, 2026 03:51
@zpc0

zpc0 commented Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Thank you for information! It seems scripts/sign-file.c and certs/extract-cert.c has <openssl/engine.h>, but 6.1+ LTS kernel exclude engine.h if OpenSSL is 3.0+.
I updated commit.

@zpc0
zpc0 marked this pull request as ready for review July 13, 2026 03:58
@zpc0 zpc0 changed the title [DRAFT] disable OpenSSL engine usage disable OpenSSL engine usage Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants