[PATCH master] scripts: make build compatible with OpenSSL v4.0

[PATCH master] scripts: make build compatible with OpenSSL v4.0

[Ahmad Fatoum]

In addition to normal key files, rkimage supports resolving
pkcs11 URIs via both OpenSSL providers and engines.
keytoc only supports engines in addition to keyfiles.

OpenSSL v4.0 removes engine support failing the build of these two host
tools[1]. Define OPENSSL_ENGINE_STUBS[2], so the engine functions return
errors and the fallback path, if available, is taken instead.

Normal key file usage remains unaffected.

[1]: https://autobuilder.yoctoproject.org/valkyrie/api/v2/logs/8469870/rawk
[2]: https://openssl-library.org/post/2025-12-18-remove-engines/

Reported-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Cc: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 scripts/keytoc.c  | 3 +++
 scripts/rkimage.c | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/scripts/keytoc.c b/scripts/keytoc.c
index e78d01048107..664753ecbbe2 100644
--- a/scripts/keytoc.c
+++ b/scripts/keytoc.c
@@ -10,6 +10,9 @@
 
 #pragma GCC diagnostic ignored "-Wdeprecated-declarations" /* ENGINE deprecated in OpenSSL 3.0 */
 
+/* OpenSSL 4.0 removed the ENGINE symbols; ask for the no-op stubs instead */
+#define OPENSSL_ENGINE_STUBS
+
 #include "include/string_util.h"
 
 #include <stdio.h>
diff --git a/scripts/rkimage.c b/scripts/rkimage.c
index 8243742d659f..268ce56c1728 100644
--- a/scripts/rkimage.c
+++ b/scripts/rkimage.c
@@ -1,4 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
+
+/* OpenSSL 4.0 removed the ENGINE symbols; ask for the no-op stubs instead */
+#define OPENSSL_ENGINE_STUBS
+
 #include <stdio.h>
 #include <unistd.h>
 #include <getopt.h>
-- 
2.47.3

Re: [PATCH master] scripts: make build compatible with OpenSSL v4.0

[Sascha Hauer]

On Mon, 24 Aug 2026 14:21:06 +0200, Ahmad Fatoum wrote:
> In addition to normal key files, rkimage supports resolving
> pkcs11 URIs via both OpenSSL providers and engines.
> keytoc only supports engines in addition to keyfiles.
> 
> OpenSSL v4.0 removes engine support failing the build of these two host
> tools[1]. Define OPENSSL_ENGINE_STUBS[2], so the engine functions return
> errors and the fallback path, if available, is taken instead.
> 
> [...]

Applied, thanks!

[1/1] scripts: make build compatible with OpenSSL v4.0
      https://git.pengutronix.de/cgit/barebox/commit/?id=7152488b9548 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>