Re: [PATCH v4] Add support for OpenSSL Provider API

Hi Eddie, Quentin,

We're currently working on upgrading OpenEmbedded-Core (Yocto Project) to
OpenSSL 4.0.1 and hit this exact issue — mkimage fails at FIT image signing
because it unconditionally tries to load the pkcs11 provider, which isn't
available in our build environment.

For our purposes, file-based key signing with just the default provider works
fine. We're carrying this patch with a local modification that makes the pkcs11
provider load non-fatal:

    if (!OSSL_PROVIDER_try_load(NULL, "default", true))
        ERR(1, "OSSL_PROVIDER_try_load(default)");
    /* pkcs11 provider is optional; only needed for pkcs11: URIs */
    if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
        ERR_clear_error();

This allows signing to work without pkcs11-provider installed while still
loading it when available (for pkcs11: URI keys).

Is there a v5 in the works? Happy to test if it would help move this forward.

Thanks,
Jaipaul