Debian Patches

Status for imx-code-signing-tool/4.0.1+dfsg-3

Patch Description Author Forwarded Bugs Origin Last update
pkcs11-migrate-engine-to-provider.patch Migrate PKCS#11 backend from OpenSSL ENGINE to provider API
The OpenSSL ENGINE API is deprecated and removed in OpenSSL 4.0. Rework
the PKCS#11 backend to use the modern provider and OSSL_STORE APIs
instead.

Library changes:
- Replace engine_ctx helpers with pkcs11_ctx ones that load and unload
the "pkcs11" provider via OSSL_PROVIDER_load()/OSSL_PROVIDER_unload().
- Implement pkcs11_load_certificate() and pkcs11_load_key() on top of
OSSL_STORE_open_ex()/OSSL_STORE_load(). Strip "type=" attributes from
the user provided URI to delegate object selection to
OSSL_STORE_expect(..., type), where type is determined by the use case.
- Rename engine_read_certificate/engine_gen_sig_data to their pkcs11_
counterparts and update the backend selector in cst.c.
- Drop the now unused <openssl/engine.h> includes and the static
bind_engine() fallback.

Build system:
- Remove the OPENSSL_USE_STATIC_LIBS requirement and the libpkcs11.a /
libp11 dependency, no longer needed with the provider based backend.

Scripts:
- Switch the HSM helper scripts from "-engine pkcs11 -keyform engine" to
"-provider default -provider pkcs11" with pkcs11: URIs, and export
PKCS11_PROVIDER_MODULE so the provider uses the configured module.		 Bastian Germann <bage@debian.org> no 2026-10-10
unbreak-scripts.patch Undo 3.3.1 changes which break the script for no good reason
Fall back to the installed openssl configuration directory if none is given.

Based on the original patch by Sean Anderson <seanga2@gmail.com>		 Andrej Shadura <andrew.shadura@collabora.co.uk> no 2025-06-02
fix-shell-syntax.patch Remove commented out lines resulting in incorrect shell syntax Andrej Shadura <andrew.shadura@collabora.co.uk> no 2025-06-03
be-compat.patch Use ntohl instead of a custom macro for big-endian compat Andrej Shadura <andrew.shadura@collabora.co.uk> no 2025-06-03
fix_scripts_shebang.patch Fix shebang in hab_srktool_scripts The shebang has to be the first line, *above* the copyrights. Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
check_return_values.patch Check return value of fgets
The cmake project has a reasonable default setting
CMAKE_COMPILE_WARNING_AS_ERROR=ON in cmake/compiler_options.cmake. With this
setting our build will fail on unchecked return values from fgets(). This
patch fixes the issue by adding return value checks.
This is not just to silence the errors. C99 defines for fgets: "If a read
error occurs during the operation, the array contents are indeterminate and a
null pointer is returned". We should actually check the return value to avoid
undefined behavior from processing indeterminate data.

Let get_passcode_to_key_file return -1 on error, since it is used as callback
to OpenSSLs PEM_read_bio_PrivateKey_ex where documentation states "The
callback must return the number of characters in the passphrase or -1 if an
error occurred".		 Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
hidapi_libusb_dynlink.patch Link libhidapi-libusb as shared system library
The hab_log_parser tool requires libhidapi-libusb. Upstream hardcodes static
linking.
We want to link the system shared library instead and must thus change the
related cmake find function.		 Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
libjson_c_dynlink.patch Link libjson-c as shared system library
The ahab_signed_message tool requires libjson-c. Upstream hardcodes static linking.
We want to link the system shared library instead and must thus change the
related cmake find function.		 Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
libusb_dynlink.patch Link libusb as shared system library
The hab_log_parser tool requires libusb. Upstream hardcodes static linking.
We want to link the system shared library instead and must thus change the
related cmake find function.		 Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
formatstr-compat.patch Fix -Wformat errors on i386
gcc -Wformat ahab_image_verifier.c fails on i386 with the following errors:
"format '%zu' expects argument of type 'size_t', but argument has type 'long int'"
"format '%ld' expects argument of type 'long int', but argument has type 'size_t' {aka 'unsigned int'}"

'printf("%zu", (long) 0);' and 'printf("%ld", (size_t) 0);' work by chance on
architectures like amd64 where size_t expands to 'typedef long unsigned int
size_t;'. However, on i386, size_t expands to 'typedef unsigned int size_t;'
and thus -Wformat triggers an compilation error.

To fix it, we replace the format specifier with the actual variable types.
Upstream should have done this anyway, there is no obvious reason to use the
conversion specifiers.		 Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
fix_add_key_md.patch Fix setting message digest in non-interactive mode for HABv4 add_key must hard code message digest to sha256 if HABv4 is selected. However, this was only done in interactive mode. In non-interactive mode, the variable remained uninitialized and OpenSSL then failed in EVP_DigestSignInit_ex. This patch moves hard coding to a place where it's effective for all modes. Tobias Deiminger <tobias.deiminger@linutronix.de> no 2026-01-30
fix-openssl4-asn1-opaque.patch Fix FTBFS with OpenSSL 4.0: use ASN1_STRING accessors
OpenSSL 4.0 makes ASN1_INTEGER (aka struct asn1_string_st) fully opaque.
Direct access to the ->data and ->length members is no longer allowed.

Replace the direct struct member accesses in get_certificate_serial_number_length()
with the public accessor functions ASN1_STRING_get0_data() and
ASN1_STRING_length(), which have been available since OpenSSL 1.1.0 and are
compatible with all supported Debian releases.		 Andrej Shadura <andrew.shadura@collabora.co.uk> no debian 2026-06-02

All known versions for source package 'imx-code-signing-tool'

Links