From: Jan Stancek <jstancek@redhat.com>

commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.

ENGINE API has been deprecated since OpenSSL version 3.0 [1].
Distros have started dropping support from headers and in future
it will likely disappear also from library.

It has been superseded by the PROVIDER API, so use it instead
for OPENSSL MAJOR >= 3.

[1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md

[jarkko: fixed up alignment issues reported by checkpatch.pl --strict]

Signed-off-by: Jan Stancek <jstancek@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
---
 certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
 scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
 2 files changed, 138 insertions(+), 58 deletions(-)

diff --git a/certs/extract-cert.c b/certs/extract-cert.c
index 61bbe0085671..7d6d468ed612 100644
--- a/certs/extract-cert.c
+++ b/certs/extract-cert.c
@@ -21,17 +21,18 @@
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
-#include <openssl/engine.h>
-
+#if OPENSSL_VERSION_MAJOR >= 3
+# define USE_PKCS11_PROVIDER
+# include <openssl/provider.h>
+# include <openssl/store.h>
+#else
+# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
+#  define USE_PKCS11_ENGINE
+#  include <openssl/engine.h>
+# endif
+#endif
 #include "ssl-common.h"
 
-/*
- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
- *
- * Remove this if/when that API is no longer used
- */
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-
 #define PKEY_ID_PKCS7 2
 
 static __attribute__((noreturn))
@@ -61,6 +62,66 @@ static void write_cert(X509 *x509)
 		fprintf(stderr, "Extracted cert: %s\n", buf);
 }
 
+static X509 *load_cert_pkcs11(const char *cert_src)
+{
+	X509 *cert = NULL;
+#ifdef USE_PKCS11_PROVIDER
+	OSSL_STORE_CTX *store;
+
+	if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
+		ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
+	if (!OSSL_PROVIDER_try_load(NULL, "default", true))
+		ERR(1, "OSSL_PROVIDER_try_load(default)");
+
+	store = OSSL_STORE_open(cert_src, NULL, NULL, NULL, NULL);
+	ERR(!store, "OSSL_STORE_open");
+
+	while (!OSSL_STORE_eof(store)) {
+		OSSL_STORE_INFO *info = OSSL_STORE_load(store);
+
+		if (!info) {
+			drain_openssl_errors(__LINE__, 0);
+			continue;
+		}
+		if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) {
+			cert = OSSL_STORE_INFO_get1_CERT(info);
+			ERR(!cert, "OSSL_STORE_INFO_get1_CERT");
+		}
+		OSSL_STORE_INFO_free(info);
+		if (cert)
+			break;
+	}
+	OSSL_STORE_close(store);
+#elif defined(USE_PKCS11_ENGINE)
+		ENGINE *e;
+		struct {
+			const char *cert_id;
+			X509 *cert;
+		} parms;
+
+		parms.cert_id = cert_src;
+		parms.cert = NULL;
+
+		ENGINE_load_builtin_engines();
+		drain_openssl_errors(__LINE__, 1);
+		e = ENGINE_by_id("pkcs11");
+		ERR(!e, "Load PKCS#11 ENGINE");
+		if (ENGINE_init(e))
+			drain_openssl_errors(__LINE__, 1);
+		else
+			ERR(1, "ENGINE_init");
+		if (key_pass)
+			ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
+		ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
+		ERR(!parms.cert, "Get X.509 from PKCS#11");
+		cert = parms.cert;
+#else
+		fprintf(stderr, "no pkcs11 engine/provider available\n");
+		exit(1);
+#endif
+	return cert;
+}
+
 int main(int argc, char **argv)
 {
 	char *cert_src;
@@ -89,28 +150,10 @@ int main(int argc, char **argv)
 		fclose(f);
 		exit(0);
 	} else if (!strncmp(cert_src, "pkcs11:", 7)) {
-		ENGINE *e;
-		struct {
-			const char *cert_id;
-			X509 *cert;
-		} parms;
+		X509 *cert = load_cert_pkcs11(cert_src);
 
-		parms.cert_id = cert_src;
-		parms.cert = NULL;
-
-		ENGINE_load_builtin_engines();
-		drain_openssl_errors(__LINE__, 1);
-		e = ENGINE_by_id("pkcs11");
-		ERR(!e, "Load PKCS#11 ENGINE");
-		if (ENGINE_init(e))
-			drain_openssl_errors(__LINE__, 1);
-		else
-			ERR(1, "ENGINE_init");
-		if (key_pass)
-			ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
-		ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
-		ERR(!parms.cert, "Get X.509 from PKCS#11");
-		write_cert(parms.cert);
+		ERR(!cert, "load_cert_pkcs11 failed");
+		write_cert(cert);
 	} else {
 		BIO *b;
 		X509 *x509;
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index bb3fdf1a617c..7070245edfc1 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -27,17 +27,18 @@
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
-#include <openssl/engine.h>
-
+#if OPENSSL_VERSION_MAJOR >= 3
+# define USE_PKCS11_PROVIDER
+# include <openssl/provider.h>
+# include <openssl/store.h>
+#else
+# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
+#  define USE_PKCS11_ENGINE
+#  include <openssl/engine.h>
+# endif
+#endif
 #include "ssl-common.h"
 
-/*
- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
- *
- * Remove this if/when that API is no longer used
- */
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-
 /*
  * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to
  * assume that it's not available and its header file is missing and that we
@@ -106,28 +107,64 @@ static int pem_pw_cb(char *buf, int len, int w, void *v)
 	return pwlen;
 }
 
-static EVP_PKEY *read_private_key(const char *private_key_name)
+static EVP_PKEY *read_private_key_pkcs11(const char *private_key_name)
 {
-	EVP_PKEY *private_key;
+	EVP_PKEY *private_key = NULL;
+#ifdef USE_PKCS11_PROVIDER
+	OSSL_STORE_CTX *store;
 
-	if (!strncmp(private_key_name, "pkcs11:", 7)) {
-		ENGINE *e;
+	if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
+		ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
+	if (!OSSL_PROVIDER_try_load(NULL, "default", true))
+		ERR(1, "OSSL_PROVIDER_try_load(default)");
+
+	store = OSSL_STORE_open(private_key_name, NULL, NULL, NULL, NULL);
+	ERR(!store, "OSSL_STORE_open");
 
-		ENGINE_load_builtin_engines();
+	while (!OSSL_STORE_eof(store)) {
+		OSSL_STORE_INFO *info = OSSL_STORE_load(store);
+
+		if (!info) {
+			drain_openssl_errors(__LINE__, 0);
+			continue;
+		}
+		if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
+			private_key = OSSL_STORE_INFO_get1_PKEY(info);
+			ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
+		}
+		OSSL_STORE_INFO_free(info);
+		if (private_key)
+			break;
+	}
+	OSSL_STORE_close(store);
+#elif defined(USE_PKCS11_ENGINE)
+	ENGINE *e;
+
+	ENGINE_load_builtin_engines();
+	drain_openssl_errors(__LINE__, 1);
+	e = ENGINE_by_id("pkcs11");
+	ERR(!e, "Load PKCS#11 ENGINE");
+	if (ENGINE_init(e))
 		drain_openssl_errors(__LINE__, 1);
-		e = ENGINE_by_id("pkcs11");
-		ERR(!e, "Load PKCS#11 ENGINE");
-		if (ENGINE_init(e))
-			drain_openssl_errors(__LINE__, 1);
-		else
-			ERR(1, "ENGINE_init");
-		if (key_pass)
-			ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0),
-			    "Set PKCS#11 PIN");
-		private_key = ENGINE_load_private_key(e, private_key_name,
-						      NULL, NULL);
-		ERR(!private_key, "%s", private_key_name);
+	else
+		ERR(1, "ENGINE_init");
+	if (key_pass)
+		ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
+	private_key = ENGINE_load_private_key(e, private_key_name, NULL, NULL);
+	ERR(!private_key, "%s", private_key_name);
+#else
+	fprintf(stderr, "no pkcs11 engine/provider available\n");
+	exit(1);
+#endif
+	return private_key;
+}
+
+static EVP_PKEY *read_private_key(const char *private_key_name)
+{
+	if (!strncmp(private_key_name, "pkcs11:", 7)) {
+		return read_private_key_pkcs11(private_key_name);
 	} else {
+		EVP_PKEY *private_key;
 		BIO *b;
 
 		b = BIO_new_file(private_key_name, "rb");
@@ -136,9 +173,9 @@ static EVP_PKEY *read_private_key(const char *private_key_name)
 						      NULL);
 		ERR(!private_key, "%s", private_key_name);
 		BIO_free(b);
-	}
 
-	return private_key;
+		return private_key;
+	}
 }
 
 static X509 *read_x509(const char *x509_name)
-- 
2.47.1

On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> From: Jan Stancek <jstancek@redhat.com>
> 
> commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> 
> ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> Distros have started dropping support from headers and in future
> it will likely disappear also from library.
> 
> It has been superseded by the PROVIDER API, so use it instead
> for OPENSSL MAJOR >= 3.
> 
> [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> 
> [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> 
> Signed-off-by: Jan Stancek <jstancek@redhat.com>
> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> Reviewed-by: Neal Gompa <neal@gompa.dev>
> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> ---
>  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
>  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
>  2 files changed, 138 insertions(+), 58 deletions(-)

This seems to differ from what is upstream by a lot, please document
what you changed from it and why when you resend this series again.

thanks,

greg k-h

On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
>On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
>> From: Jan Stancek <jstancek@redhat.com>
>>
>> commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
>>
>> ENGINE API has been deprecated since OpenSSL version 3.0 [1].
>> Distros have started dropping support from headers and in future
>> it will likely disappear also from library.
>>
>> It has been superseded by the PROVIDER API, so use it instead
>> for OPENSSL MAJOR >= 3.
>>
>> [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
>>
>> [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
>>
>> Signed-off-by: Jan Stancek <jstancek@redhat.com>
>> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
>> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
>> Reviewed-by: Neal Gompa <neal@gompa.dev>
>> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
>> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
>> ---
>>  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
>>  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
>>  2 files changed, 138 insertions(+), 58 deletions(-)
>
>This seems to differ from what is upstream by a lot, please document
>what you changed from it and why when you resend this series again.

Hunks are arranged differently, but code appears to be identical.
When I apply the series to v6.6.83 and compare with upstream I get:

$ git range-diff HEAD~3..HEAD 558bdc45dfb2~3..558bdc45dfb2
1:  02ea9f7368c6 ! 1:  300e6d4116f9 sign-file,extract-cert: move common SSL helper functions to a header
     @@ Metadata
       ## Commit message ##
          sign-file,extract-cert: move common SSL helper functions to a header

     -    commit 300e6d4116f956b035281ec94297dc4dc8d4e1d3 upstream.
     -
          Couple error handling helpers are repeated in both tools, so
          move them to a common header.

     @@ Commit message
          Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
          Reviewed-by: Neal Gompa <neal@gompa.dev>
          Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
     -    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>

       ## MAINTAINERS ##
      @@ MAINTAINERS: S: Maintained
2:  0a81fb059cfd ! 2:  467d60eddf55 sign-file,extract-cert: avoid using deprecated ERR_get_error_line()
     @@ Metadata
       ## Commit message ##
          sign-file,extract-cert: avoid using deprecated ERR_get_error_line()

     -    commit 467d60eddf55588add232feda325da7215ddaf30 upstream.
     -
          ERR_get_error_line() is deprecated since OpenSSL 3.0.

          Use ERR_peek_error_line() instead, and combine display_openssl_errors()
     @@ Commit message
          Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
          Reviewed-by: Neal Gompa <neal@gompa.dev>
          Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
     -    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>

       ## certs/extract-cert.c ##
      @@ certs/extract-cert.c: int main(int argc, char **argv)
3:  0882f379a1f5 ! 3:  558bdc45dfb2 sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
     @@ Metadata
       ## Commit message ##
          sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3

     -    commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
     -
          ENGINE API has been deprecated since OpenSSL version 3.0 [1].
          Distros have started dropping support from headers and in future
          it will likely disappear also from library.
     @@ Commit message
          Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
          Reviewed-by: Neal Gompa <neal@gompa.dev>
          Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
     -    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>

       ## certs/extract-cert.c ##
      @@

Regards,
Jan

On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > From: Jan Stancek <jstancek@redhat.com>
> > > 
> > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > 
> > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > Distros have started dropping support from headers and in future
> > > it will likely disappear also from library.
> > > 
> > > It has been superseded by the PROVIDER API, so use it instead
> > > for OPENSSL MAJOR >= 3.
> > > 
> > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > 
> > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > 
> > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > ---
> > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > 
> > This seems to differ from what is upstream by a lot, please document
> > what you changed from it and why when you resend this series again.
> 
> Hunks are arranged differently, but code appears to be identical.
> When I apply the series to v6.6.83 and compare with upstream I get:

If so, why is the diffstat different?  Also why are the hunks arranged
differently, that's a hint to me that something went wrong and I can't
trust the patch at all.

thanks,

greg k-h

On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > From: Jan Stancek <jstancek@redhat.com>
> > > >
> > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > >
> > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > Distros have started dropping support from headers and in future
> > > > it will likely disappear also from library.
> > > >
> > > > It has been superseded by the PROVIDER API, so use it instead
> > > > for OPENSSL MAJOR >= 3.
> > > >
> > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > >
> > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > >
> > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > ---
> > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > >
> > > This seems to differ from what is upstream by a lot, please document
> > > what you changed from it and why when you resend this series again.
> >
> > Hunks are arranged differently, but code appears to be identical.
> > When I apply the series to v6.6.83 and compare with upstream I get:
>
> If so, why is the diffstat different?  Also why are the hunks arranged
> differently,

He appears to be using "--diff-algorithm=minimal", while you probably
patience or histogram.

$ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
grep -A3 -m1 -- "---"
---
 certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
 scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
 2 files changed, 138 insertions(+), 58 deletions(-)

Should be easy to regenerate with different diff-alg for v4.

Regards,
Jan

> that's a hint to me that something went wrong and I can't
> trust the patch at all.
>
> thanks,
>
> greg k-h
>

On Thu, Mar 20, 2025 at 12:53 AM Jan Stancek <jstancek@redhat.com> wrote:
>
> On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > > From: Jan Stancek <jstancek@redhat.com>
> > > > >
> > > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > > >
> > > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > > Distros have started dropping support from headers and in future
> > > > > it will likely disappear also from library.
> > > > >
> > > > > It has been superseded by the PROVIDER API, so use it instead
> > > > > for OPENSSL MAJOR >= 3.
> > > > >
> > > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > > >
> > > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > > >
> > > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > > ---
> > > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > > >
> > > > This seems to differ from what is upstream by a lot, please document
> > > > what you changed from it and why when you resend this series again.
> > >
> > > Hunks are arranged differently, but code appears to be identical.
> > > When I apply the series to v6.6.83 and compare with upstream I get:
> >
> > If so, why is the diffstat different?  Also why are the hunks arranged
> > differently,
>
> He appears to be using "--diff-algorithm=minimal", while you probably
> patience or histogram.
Hi, Jan,

I tried --diff-algorithm=minimal/patience/histogram from the upstream
commit, they all give the same result as this patch. But Sasha said
the upstream diffstat is different, so how does he generate the patch?

Huacai

>
> $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> grep -A3 -m1 -- "---"
> ---
>  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
>  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
>  2 files changed, 138 insertions(+), 58 deletions(-)
>
> Should be easy to regenerate with different diff-alg for v4.
>
> Regards,
> Jan
>
> > that's a hint to me that something went wrong and I can't
> > trust the patch at all.
> >
> > thanks,
> >
> > greg k-h
> >
>

On Sun, Mar 30, 2025 at 3:08 PM Huacai Chen <chenhuacai@kernel.org> wrote:
>
> On Thu, Mar 20, 2025 at 12:53 AM Jan Stancek <jstancek@redhat.com> wrote:
> >
> > On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > > > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > > > From: Jan Stancek <jstancek@redhat.com>
> > > > > >
> > > > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > > > >
> > > > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > > > Distros have started dropping support from headers and in future
> > > > > > it will likely disappear also from library.
> > > > > >
> > > > > > It has been superseded by the PROVIDER API, so use it instead
> > > > > > for OPENSSL MAJOR >= 3.
> > > > > >
> > > > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > > > >
> > > > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > > > >
> > > > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > > > ---
> > > > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > > > >
> > > > > This seems to differ from what is upstream by a lot, please document
> > > > > what you changed from it and why when you resend this series again.
> > > >
> > > > Hunks are arranged differently, but code appears to be identical.
> > > > When I apply the series to v6.6.83 and compare with upstream I get:
> > >
> > > If so, why is the diffstat different?  Also why are the hunks arranged
> > > differently,
> >
> > He appears to be using "--diff-algorithm=minimal", while you probably
> > patience or histogram.
> Hi, Jan,
>
> I tried --diff-algorithm=minimal/patience/histogram from the upstream
> commit, they all give the same result as this patch. But Sasha said
> the upstream diffstat is different, so how does he generate the patch?

Hi,

I don't know how he generates the patch, but with git-2.43 I get noticable
different patches and diff stats for minimal vs. histogram. "minimal" one
matches your v3 patch. I don't know details of Greg's workflow, just offered
one possible explanation that would allow this series to progress further.

$ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
grep -A3 -m1 -- "---"
---
 certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
 scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
 2 files changed, 138 insertions(+), 58 deletions(-)

$ git format-patch -1 --stdout --diff-algorithm=histogram 558bdc45dfb2
| grep -A3 -m1 -- "---"
---
 certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
 scripts/sign-file.c  |  95 +++++++++++++++++++++++++++------------
 2 files changed, 139 insertions(+), 59 deletions(-)

Regards,
Jan

>
> Huacai
>
> >
> > $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> > grep -A3 -m1 -- "---"
> > ---
> >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> >  2 files changed, 138 insertions(+), 58 deletions(-)
> >
> > Should be easy to regenerate with different diff-alg for v4.
> >
> > Regards,
> > Jan
> >
> > > that's a hint to me that something went wrong and I can't
> > > trust the patch at all.
> > >
> > > thanks,
> > >
> > > greg k-h
> > >
> >
>

Hi, Greg and Sasha,

On Sun, Mar 30, 2025 at 9:40 PM Jan Stancek <jstancek@redhat.com> wrote:
>
> On Sun, Mar 30, 2025 at 3:08 PM Huacai Chen <chenhuacai@kernel.org> wrote:
> >
> > On Thu, Mar 20, 2025 at 12:53 AM Jan Stancek <jstancek@redhat.com> wrote:
> > >
> > > On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > > > > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > > > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > > > > From: Jan Stancek <jstancek@redhat.com>
> > > > > > >
> > > > > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > > > > >
> > > > > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > > > > Distros have started dropping support from headers and in future
> > > > > > > it will likely disappear also from library.
> > > > > > >
> > > > > > > It has been superseded by the PROVIDER API, so use it instead
> > > > > > > for OPENSSL MAJOR >= 3.
> > > > > > >
> > > > > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > > > > >
> > > > > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > > > > >
> > > > > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > > > > ---
> > > > > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > > > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > > > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > > > > >
> > > > > > This seems to differ from what is upstream by a lot, please document
> > > > > > what you changed from it and why when you resend this series again.
> > > > >
> > > > > Hunks are arranged differently, but code appears to be identical.
> > > > > When I apply the series to v6.6.83 and compare with upstream I get:
> > > >
> > > > If so, why is the diffstat different?  Also why are the hunks arranged
> > > > differently,
> > >
> > > He appears to be using "--diff-algorithm=minimal", while you probably
> > > patience or histogram.
> > Hi, Jan,
> >
> > I tried --diff-algorithm=minimal/patience/histogram from the upstream
> > commit, they all give the same result as this patch. But Sasha said
> > the upstream diffstat is different, so how does he generate the patch?
>
> Hi,
>
> I don't know how he generates the patch, but with git-2.43 I get noticable
> different patches and diff stats for minimal vs. histogram. "minimal" one
> matches your v3 patch. I don't know details of Greg's workflow, just offered
> one possible explanation that would allow this series to progress further.
>
> $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> grep -A3 -m1 -- "---"
Could you please tell me how you generate patches? I always get the
same result from the upstream repo.

Huacai

> ---
>  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
>  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
>  2 files changed, 138 insertions(+), 58 deletions(-)
>
> $ git format-patch -1 --stdout --diff-algorithm=histogram 558bdc45dfb2
> | grep -A3 -m1 -- "---"
> ---
>  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
>  scripts/sign-file.c  |  95 +++++++++++++++++++++++++++------------
>  2 files changed, 139 insertions(+), 59 deletions(-)
>
> Regards,
> Jan
>
> >
> > Huacai
> >
> > >
> > > $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> > > grep -A3 -m1 -- "---"
> > > ---
> > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > >
> > > Should be easy to regenerate with different diff-alg for v4.
> > >
> > > Regards,
> > > Jan
> > >
> > > > that's a hint to me that something went wrong and I can't
> > > > trust the patch at all.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > > >
> > >
> >
>
>

On Mon, Apr 14, 2025 at 09:52:35PM +0800, Huacai Chen wrote:
> Hi, Greg and Sasha,
> 
> On Sun, Mar 30, 2025 at 9:40 PM Jan Stancek <jstancek@redhat.com> wrote:
> >
> > On Sun, Mar 30, 2025 at 3:08 PM Huacai Chen <chenhuacai@kernel.org> wrote:
> > >
> > > On Thu, Mar 20, 2025 at 12:53 AM Jan Stancek <jstancek@redhat.com> wrote:
> > > >
> > > > On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
> > > > <gregkh@linuxfoundation.org> wrote:
> > > > >
> > > > > On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > > > > > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > > > > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > > > > > From: Jan Stancek <jstancek@redhat.com>
> > > > > > > >
> > > > > > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > > > > > >
> > > > > > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > > > > > Distros have started dropping support from headers and in future
> > > > > > > > it will likely disappear also from library.
> > > > > > > >
> > > > > > > > It has been superseded by the PROVIDER API, so use it instead
> > > > > > > > for OPENSSL MAJOR >= 3.
> > > > > > > >
> > > > > > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > > > > > >
> > > > > > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > > > > > >
> > > > > > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > > > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > > > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > > > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > > > > > ---
> > > > > > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > > > > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > > > > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > > > > > >
> > > > > > > This seems to differ from what is upstream by a lot, please document
> > > > > > > what you changed from it and why when you resend this series again.
> > > > > >
> > > > > > Hunks are arranged differently, but code appears to be identical.
> > > > > > When I apply the series to v6.6.83 and compare with upstream I get:
> > > > >
> > > > > If so, why is the diffstat different?  Also why are the hunks arranged
> > > > > differently,
> > > >
> > > > He appears to be using "--diff-algorithm=minimal", while you probably
> > > > patience or histogram.
> > > Hi, Jan,
> > >
> > > I tried --diff-algorithm=minimal/patience/histogram from the upstream
> > > commit, they all give the same result as this patch. But Sasha said
> > > the upstream diffstat is different, so how does he generate the patch?
> >
> > Hi,
> >
> > I don't know how he generates the patch, but with git-2.43 I get noticable
> > different patches and diff stats for minimal vs. histogram. "minimal" one
> > matches your v3 patch. I don't know details of Greg's workflow, just offered
> > one possible explanation that would allow this series to progress further.
> >
> > $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> > grep -A3 -m1 -- "---"
> Could you please tell me how you generate patches? I always get the
> same result from the upstream repo.a

A simple 'git show' is all I use.  Try it again and submit what you have
if you can't get anything different here.

Note, my algorithm is set to "algorithm = histogram" in my .gitconfig
file.

thanks,

greg k-h

On Tue, Apr 22, 2025 at 3:53 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Apr 14, 2025 at 09:52:35PM +0800, Huacai Chen wrote:
> > Hi, Greg and Sasha,
> >
> > On Sun, Mar 30, 2025 at 9:40 PM Jan Stancek <jstancek@redhat.com> wrote:
> > >
> > > On Sun, Mar 30, 2025 at 3:08 PM Huacai Chen <chenhuacai@kernel.org> wrote:
> > > >
> > > > On Thu, Mar 20, 2025 at 12:53 AM Jan Stancek <jstancek@redhat.com> wrote:
> > > > >
> > > > > On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
> > > > > <gregkh@linuxfoundation.org> wrote:
> > > > > >
> > > > > > On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > > > > > > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > > > > > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > > > > > > From: Jan Stancek <jstancek@redhat.com>
> > > > > > > > >
> > > > > > > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > > > > > > >
> > > > > > > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > > > > > > Distros have started dropping support from headers and in future
> > > > > > > > > it will likely disappear also from library.
> > > > > > > > >
> > > > > > > > > It has been superseded by the PROVIDER API, so use it instead
> > > > > > > > > for OPENSSL MAJOR >= 3.
> > > > > > > > >
> > > > > > > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > > > > > > >
> > > > > > > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > > > > > > >
> > > > > > > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > > > > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > > > > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > > > > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > > > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > > > > > > ---
> > > > > > > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > > > > > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > > > > > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > > > > > > >
> > > > > > > > This seems to differ from what is upstream by a lot, please document
> > > > > > > > what you changed from it and why when you resend this series again.
> > > > > > >
> > > > > > > Hunks are arranged differently, but code appears to be identical.
> > > > > > > When I apply the series to v6.6.83 and compare with upstream I get:
> > > > > >
> > > > > > If so, why is the diffstat different?  Also why are the hunks arranged
> > > > > > differently,
> > > > >
> > > > > He appears to be using "--diff-algorithm=minimal", while you probably
> > > > > patience or histogram.
> > > > Hi, Jan,
> > > >
> > > > I tried --diff-algorithm=minimal/patience/histogram from the upstream
> > > > commit, they all give the same result as this patch. But Sasha said
> > > > the upstream diffstat is different, so how does he generate the patch?
> > >
> > > Hi,
> > >
> > > I don't know how he generates the patch, but with git-2.43 I get noticable
> > > different patches and diff stats for minimal vs. histogram. "minimal" one
> > > matches your v3 patch. I don't know details of Greg's workflow, just offered
> > > one possible explanation that would allow this series to progress further.
> > >
> > > $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> > > grep -A3 -m1 -- "---"
> > Could you please tell me how you generate patches? I always get the
> > same result from the upstream repo.a
>
> A simple 'git show' is all I use.  Try it again and submit what you have
> if you can't get anything different here.
>
> Note, my algorithm is set to "algorithm = histogram" in my .gitconfig
> file.
OK, it seems I can generate the correct patches as yours now, I will
send V4 later.

Huacai

>
> thanks,
>
> greg k-h

Hi, all,

On Thu, Mar 20, 2025 at 12:53 AM Jan Stancek <jstancek@redhat.com> wrote:
>
> On Wed, Mar 19, 2025 at 5:26 PM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Mar 19, 2025 at 03:44:19PM +0100, Jan Stancek wrote:
> > > On Wed, Mar 19, 2025 at 07:13:13AM -0700, Greg Kroah-Hartman wrote:
> > > > On Wed, Mar 19, 2025 at 02:40:31PM +0800, Huacai Chen wrote:
> > > > > From: Jan Stancek <jstancek@redhat.com>
> > > > >
> > > > > commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream.
> > > > >
> > > > > ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> > > > > Distros have started dropping support from headers and in future
> > > > > it will likely disappear also from library.
> > > > >
> > > > > It has been superseded by the PROVIDER API, so use it instead
> > > > > for OPENSSL MAJOR >= 3.
> > > > >
> > > > > [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> > > > >
> > > > > [jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> > > > >
> > > > > Signed-off-by: Jan Stancek <jstancek@redhat.com>
> > > > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> > > > > Reviewed-by: Neal Gompa <neal@gompa.dev>
> > > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > > Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
> > > > > ---
> > > > >  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
> > > > >  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
> > > > >  2 files changed, 138 insertions(+), 58 deletions(-)
> > > >
> > > > This seems to differ from what is upstream by a lot, please document
> > > > what you changed from it and why when you resend this series again.
> > >
> > > Hunks are arranged differently, but code appears to be identical.
> > > When I apply the series to v6.6.83 and compare with upstream I get:
> >
> > If so, why is the diffstat different?  Also why are the hunks arranged
> > differently,
>
> He appears to be using "--diff-algorithm=minimal", while you probably
> patience or histogram.
>
> $ git format-patch -1 --stdout --diff-algorithm=minimal 558bdc45dfb2 |
> grep -A3 -m1 -- "---"
> ---
>  certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++-------------
>  scripts/sign-file.c  |  93 ++++++++++++++++++++++++++------------
>  2 files changed, 138 insertions(+), 58 deletions(-)
>
> Should be easy to regenerate with different diff-alg for v4.
I use the default configuration to generate patches, and since the
code is identical, should I really send a V4?

Huacai

>
> Regards,
> Jan
>
> > that's a hint to me that something went wrong and I can't
> > trust the patch at all.
> >
> > thanks,
> >
> > greg k-h
> >
>