[PATCH] scripts: bareboxtlv-generator: add PKCS#11 engine support

[Sascha Hauer]

From: Sascha Hauer <sascha at saschahauer.de>

When a PKCS#11 URI (pkcs11:...) is passed as the signing key, the
openssl pkey and pkeyutl invocations need extra engine arguments to
route key operations through the pkcs11 engine. Detect pkcs11: URIs
and add -engine pkcs11 with the appropriate key format flag (-inform
for pkey, -keyform for pkeyutl).

Co-Authored-By: Claude Opus 4.6 <noreply at anthropic.com>
Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
---
 .../bareboxtlv-generator/bareboxtlv-generator.py    | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/scripts/bareboxtlv-generator/bareboxtlv-generator.py b/scripts/bareboxtlv-generator/bareboxtlv-generator.py
index 2eba0aeb23..5b51fb53d8 100755
--- a/scripts/bareboxtlv-generator/bareboxtlv-generator.py
+++ b/scripts/bareboxtlv-generator/bareboxtlv-generator.py
@@ -65,7 +65,14 @@ class PrivateKey:
             sys.exit(127)
 
         self.inkey = path
-        self.public_key = serialization.load_pem_public_key(openssl(["pkey", "-pubout", "-in", self.inkey]));
+        self.is_pkcs11 = path.startswith("pkcs11:")
+        if self.is_pkcs11:
+            pkey_args = ["-engine", "pkcs11", "-inform", "engine"]
+            self.pkeyutl_args = ["-engine", "pkcs11", "-keyform", "engine"]
+        else:
+            pkey_args = []
+            self.pkeyutl_args = []
+        self.public_key = serialization.load_pem_public_key(openssl(["pkey"] + pkey_args + ["-pubout", "-in", self.inkey]));
 
     def sign(self, message: bytes) -> bytes:
         """
@@ -75,8 +82,8 @@ class PrivateKey:
         from cryptography.hazmat.primitives.asymmetric import rsa, ec
         from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
 
-        # Access private keys only via the openssl cli so that any configured provider, such as pkcs11, can be used.
-        sig = openssl(["pkeyutl", "-sign", "-rawin", "-digest", "sha256", "-inkey", self.inkey], stdin = message)
+        # Access private keys only via the openssl cli so that any configured engine/provider, such as pkcs11, can be used.
+        sig = openssl(["pkeyutl"] + self.pkeyutl_args + ["-sign", "-rawin", "-digest", "sha256", "-inkey", self.inkey], stdin = message)
 
         if isinstance(self.public_key, rsa.RSAPublicKey):
             return sig
-- 
2.47.3