Re: net/openvpn,mbedtls: add pkcs11 support

03.01.2025 02:29, Jeremie Courreges-Anglas пишет:
> Klemens: could you please test the mbedtls FLAVOR for your use case?

Doesn't work:

OpenVPN 2.6.12 x86_64-unknown-openbsd7.6 [SSL (mbed TLS)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD]
library versions: mbed TLS 2.28.0, LZO 2.10
Cannot initialize 19-'CKR_ATTRIBUTE_VALUE_INVALID'
Exiting due to fatal error

Same result when switching the helper to mbed/polar;
builds and packages, but doesn't link against it - perhaps something's missing?

Index: Makefile
===================================================================
RCS file: /cvs/ports/security/pkcs11-helper/Makefile,v
diff -u -p -r1.3 Makefile
--- Makefile 2 Jan 2025 19:14:02 -0000 1.3
+++ Makefile 3 Jan 2025 00:18:43 -0000
@@ -1,11 +1,11 @@
COMMENT = library with PKCS\#11 providers for end-user applications
CATEGORIES = security
DISTNAME = pkcs11-helper-1.30.0
-REVISION = 0
+REVISION = 1

SHARED_LIBS = pkcs11-helper 0.0 # 1.0

-WANTLIB = crypto
+WANTLIB = # empty

MAINTAINER = Klemens Nanni <kn@openbsd.org>

@@ -22,7 +22,9 @@ CONFIGURE_STYLE = gnu
CONFIGURE_ARGS = --enable-tests \
--with-test-provider=`pkg-config --variable=proxy_module p11-kit-1` \
--disable-crypto-engine-gnutls \
- --disable-crypto-engine-mbedtls \
+ --enable-crypto-engine-mbedtls \
+ --disable-openssl \
+ --disable-crypto-engine-openssl \
--disable-crypto-engine-nss \
--disable-doc \
--disable-static
Index: pkg/PLIST
===================================================================
RCS file: /cvs/ports/security/pkcs11-helper/pkg/PLIST,v
diff -u -p -r1.1.1.1 PLIST
--- pkg/PLIST 2 Jan 2025 14:47:54 -0000 1.1.1.1
+++ pkg/PLIST 3 Jan 2025 00:10:24 -0000
@@ -5,7 +5,6 @@ include/pkcs11-helper-1.0/pkcs11h-core.h
include/pkcs11-helper-1.0/pkcs11h-data.h
include/pkcs11-helper-1.0/pkcs11h-def.h
include/pkcs11-helper-1.0/pkcs11h-engines.h
-include/pkcs11-helper-1.0/pkcs11h-openssl.h
include/pkcs11-helper-1.0/pkcs11h-token.h
include/pkcs11-helper-1.0/pkcs11h-version.h
@comment lib/libpkcs11-helper.la