0.4.19:
- added native KEYMGMT, SIGNATURE and ASYM_CIPHER operations to the
PKCS#11 provider, enabling OpenSSL 4.x support and improving RSA
interoperability
- added support for ML-DSA, SLH-DSA and FALCON key generation, signing
and verification; PQC key generation examples and provider tests
- added PKCS#11 provider support for ECDH, X25519 and X448 key exchange,
including X25519/X448 key generation
- improved Ed25519/Ed448 public-key resolution with certificate fallback
- fixed use-after-free crashes after enumerating additional PKCS#11 keys
- fixed a potential out-of-bounds write while parsing PKCS#11 URI
attributes
- fixed PKCS#11 session, attribute and key-reference leaks
0.4.20:
- added PKCS#11 3.2 interface discovery and updated the bundled header
to version 3.2
- added PKCS#11 provider support for ML-KEM-512/768/1024 key generation,
encapsulation and decapsulation
- added PKCS11_evp_pkey_decapsulate() API
- added provider signature AlgorithmIdentifier support, including
RSA-PSS parameters and correct default salt length handling
- fixed RSA-PSS salt length parsing and spurious OpenSSL errors
- fixed session-pool races and deadlocks during concurrent key
generation and cryptographic operations
- fixed key-cache and OpenSSL 1.x RSA object use-after-free bugs
- fixed provider EC parameter lifetime handling and resource leaks
during EC, RSA, EdDSA and XDH operations and context cleanup
- fixed installation of p11_ver.h, required by p11_err.h
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Changes since 0.4.16:
0.4.18 (2026-02-16):
* Support for RSA-PSS and RSA-OAEP using keys retrieved using the
PKCS11_get_private_key() libp11 API and the PKCS#11 provider.
* Improved test coverage.
0.4.17 (2026-02-01):
* Ed25519 and Ed448 support (PKCS#11 v3.2).
* Fixed OPENSSL_NO_EC builds.
* Reverted RSA public exponent change from PR #474.
* Fixed crash on module initialization failures.
* Ignoring trailing newlines in pin-source files.
* Initial build fixes for the upcoming OpenSSL 4.x.
Drop the now obsolete 001-fix-install.patch which has been merged
upstream.
Link: https://github.com/OpenSC/libp11/blob/libp11-0.4.18/NEWS
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The crude loop I wrote to come up with this changeset:
find -L package/feeds/packages/ -name patches | \
sed 's/patches$/refresh/' | sort | xargs make
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL
licenses. But a lot of packages did use a different, non-SPDX style with a
"+" at the end instead of "-or-later".
Signed-off-by: Sven Eckelmann <sven@narfation.org>
libp11 uses OpenSSL's ENGINE quite extensively with seemingly no simple
way to disable it. Add it as a dependency.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reorganized Makefile a little bit for consistency with other packages.
Added PKG_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Fix the following compilation error
In file included from openconnect-internal.h:95:0,
from ssl.c:41:
/home/yousong/git-repo/lede-project/lede/staging_dir/target-mips_24kc_musl/usr/include/libp11.h: At top level:
/home/yousong/git-repo/lede-project/lede/staging_dir/target-mips_24kc_musl/usr/include/libp11.h:27:21: fatal error: p11_err.h: No such file or directory
compilation terminated.
make[5]: *** [libopenconnect_la-ssl.lo] Error 1
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Daniel Golle
Ilya Lipnitskiy
Sven Eckelmann
Rosen Penev
Yousong Zhou