git: c8809a8f559d - main - security/openssl-pkcs11provider: Add new port
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 15 Mar 2026 21:30:47 UTC
The branch main has been updated by brnrd:
URL: https://cgit.FreeBSD.org/ports/commit/?id=c8809a8f559ddb62939927bec51e70463b946276
commit c8809a8f559ddb62939927bec51e70463b946276
Author: Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2026-03-15 21:30:15 +0000
Commit: Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2026-03-15 21:30:15 +0000
security/openssl-pkcs11provider: Add new port
---
security/Makefile | 1 +
security/openssl-pkcs11provider/Makefile | 46 ++++++++++++++++++++++
security/openssl-pkcs11provider/distinfo | 3 ++
.../openssl-pkcs11provider/files/patch-meson.build | 14 +++++++
.../files/patch-meson__options.txt | 11 ++++++
.../files/pkcs11provider.cnf.in | 15 +++++++
security/openssl-pkcs11provider/pkg-descr | 6 +++
security/openssl-pkcs11provider/pkg-message | 11 ++++++
8 files changed, 107 insertions(+)
diff --git a/security/Makefile b/security/Makefile
index 1f8fcdcc5032..93bcaae28d14 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -452,6 +452,7 @@
SUBDIR += openssl
SUBDIR += openssl-agent
SUBDIR += openssl-oqsprovider
+ SUBDIR += openssl-pkcs11provider
SUBDIR += openssl-unsafe
SUBDIR += openssl111
SUBDIR += openssl33
diff --git a/security/openssl-pkcs11provider/Makefile b/security/openssl-pkcs11provider/Makefile
new file mode 100644
index 000000000000..160b38f865aa
--- /dev/null
+++ b/security/openssl-pkcs11provider/Makefile
@@ -0,0 +1,46 @@
+PORTNAME= pkcs11provider
+PORTVERSION= 1.2.0
+DISTVERSIONPREFIX= v
+CATEGORIES= security
+PKGNAMEPREFIX= openssl-
+
+MAINTAINER= brnrd@FreeBSD.org
+COMMENT= OpenSSL 3.x PKCS\#11 provider
+WWW= https://github.com/latchset/pkcs11-provider
+
+LICENSE= APACHE20
+LICENSE_FILE= ${WRKSRC}/LICENSES/Apache-2.0.txt
+
+USES= meson ssl
+USE_LDCONFIG= yes
+
+TEST_ENVIRONMENT= OPENSSL_INSTALL=${LOCALBASE}/bin/openssl
+
+CFLAGS+= -I${OPENSSLINC}
+LDFLAGS+= -L${OPENSSLLIB}
+
+MESON_ARGS= --libdir ${PREFIX} \
+ -Dmodulesdir="${PREFIX}/lib/ossl-modules"
+
+USE_GITHUB= yes
+GH_ACCOUNT= latchset
+GH_PROJECT= pkcs11-provider
+
+SUB_FILES= pkcs11provider.cnf
+
+PLIST_FILES= lib/ossl-modules/pkcs11.so \
+ openssl/pkcs11provider.cnf \
+ share/man/man7/provider-pkcs11.7.gz
+# @comment\ @dir\ /usr/lib/ossl-modules
+
+.include <bsd.port.pre.mk>
+
+.if !defined(OPENSSL_PORT) && ${OSVERSION} < 1400000
+BROKEN= requires OpenSSL 3.0+, preferably 3.2+
+.endif
+
+post-install:
+ ${MKDIR} ${STAGEDIR}${PREFIX}/openssl
+ ${INSTALL_DATA} ${WRKDIR}/pkcs11provider.cnf ${STAGEDIR}${PREFIX}/openssl/
+
+.include <bsd.port.post.mk>
diff --git a/security/openssl-pkcs11provider/distinfo b/security/openssl-pkcs11provider/distinfo
new file mode 100644
index 000000000000..c6c9c7f72ab6
--- /dev/null
+++ b/security/openssl-pkcs11provider/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1773311625
+SHA256 (latchset-pkcs11-provider-v1.2.0_GH0.tar.gz) = e244556f0e54b57513937451b244d1b59a3094dd5e23b718b655e06fbb1f89a3
+SIZE (latchset-pkcs11-provider-v1.2.0_GH0.tar.gz) = 274729
diff --git a/security/openssl-pkcs11provider/files/patch-meson.build b/security/openssl-pkcs11provider/files/patch-meson.build
new file mode 100644
index 000000000000..3f5d0dee46b7
--- /dev/null
+++ b/security/openssl-pkcs11provider/files/patch-meson.build
@@ -0,0 +1,14 @@
+--- meson.build.orig 2026-03-13 08:55:32 UTC
++++ meson.build
+@@ -49,7 +49,10 @@ endif
+ if not libcrypto.found()
+ libcrypto = dependency('libcrypto3', version: '>= 3.0.7', required: true)
+ endif
+-provider_path = libcrypto.get_variable(pkgconfig: 'modulesdir')
++provider_path = get_option('modulesdir')
++if provider_path == ''
++ provider_path = libcrypto.get_variable(pkgconfig: 'modulesdir')
++endif
+ libssl = dependency('libssl', version: '>= 3.0.7', required: false)
+ if not libssl.found()
+ libssl = dependency('libssl3', version: '>= 3.0.7', required: true, method: 'pkg-config')
diff --git a/security/openssl-pkcs11provider/files/patch-meson__options.txt b/security/openssl-pkcs11provider/files/patch-meson__options.txt
new file mode 100644
index 000000000000..43ec5bda2c61
--- /dev/null
+++ b/security/openssl-pkcs11provider/files/patch-meson__options.txt
@@ -0,0 +1,11 @@
+--- meson_options.txt.orig 2026-03-13 08:56:01 UTC
++++ meson_options.txt
+@@ -17,3 +17,8 @@ option('build_info',
+ type : 'string',
+ value : '',
+ description : 'Optional string with build information, like a build id')
++
++option('modulesdir',
++ type : 'string',
++ value : '',
++ description : 'Overrride for modulesdir variable for libcrypto')
diff --git a/security/openssl-pkcs11provider/files/pkcs11provider.cnf.in b/security/openssl-pkcs11provider/files/pkcs11provider.cnf.in
new file mode 100644
index 000000000000..7971b4087f30
--- /dev/null
+++ b/security/openssl-pkcs11provider/files/pkcs11provider.cnf.in
@@ -0,0 +1,15 @@
+# Replace the existing [provider_sect] and [default_provider] sections
+# with this config
+
+[provider_sect]
+default = default_sect
+pkcs11 = pkcs11_sect
+
+[default_sect]
+activate = 1
+
+[pkcs11_sect]
+module = %%PREFIX%%/lib/ossl-modules/pkcs11.so
+# pkcs11-module-token-pin = %%PREFIX%%/etc/ssl/pinfile.txt
+# pkcs11-module-path = %%PREFIX%%/lib/vendor_pkcs11.so
+activate = 1
diff --git a/security/openssl-pkcs11provider/pkg-descr b/security/openssl-pkcs11provider/pkg-descr
new file mode 100644
index 000000000000..84d9aa164883
--- /dev/null
+++ b/security/openssl-pkcs11provider/pkg-descr
@@ -0,0 +1,6 @@
+Open Quantum Safe provider for OpenSSL
+
+
+This port enables quantum-safe cryptography (QSC) in a standard OpenSSL
+(3.x) distribution by way of implementing a single shared library, the
+OpenSSL OQS provider.
diff --git a/security/openssl-pkcs11provider/pkg-message b/security/openssl-pkcs11provider/pkg-message
new file mode 100644
index 000000000000..5a6bffa31392
--- /dev/null
+++ b/security/openssl-pkcs11provider/pkg-message
@@ -0,0 +1,11 @@
+[
+{ type:install
+ message: <<EOM
+To enable oqs-provider in OpenSSL, merge contents of the configuration file
+${PREFIX}/openssl/oqsprovider.cnf with ${PREFIX}/openssl/openssl.cnf.
+
+Expect issues if you're using OpenSSL < 3.2
+See https://github.com/open-quantum-safe/oqs-provider/blob/main/README.md#building-and-testing
+EOM
+}
+]