pkcs11-provider: update to fix tls test [4.0] - #31546

@beldmit @simo5 can you please say if you're OK with this being urgent CI fix?

Agree with urgent

https://github.com/openssl/openssl/actions/runs/27634776257/job/81718916892?pr=31546

Looks like you need to drop the two patches in test/recipes/95-test_external_pkcs11_provider_data/patches

It makes sense since you updated to a version of pkcs11_provider which already carries those changes.

@nhorman this is for 4.0 and lower branches where tls test is not disabled and works. It is disabled only in mater which is I guess because of changes introduced in #31018 that are for master only.

Why should I drop any patches here?

@nhorman this is for 4.0 and lower branches where tls test is not disabled and works. It is disabled only in mater which is I guess because of changes introduced in #31018 that are for master only.

Why should I drop any patches here?

Because you have updated the pkcs11 submodule to a level for which patches that do exist on the target branches no longer apply.

But there has never been patches on openssl-4.0 branch so it's unrelated to this PR.

Are you talking about #31522 which is for master. It seems to me that patches normally apply there and master is passing.

no, I'm talking about this PR, which is targeted to 4.0:

nhorman@hmsbeagle:~/git/worktrees/work1$ git branch | grep \*
* openssl-4.0
nhorman@hmsbeagle:~/git/worktrees/work1$ cd test/recipes/95-test_external_pkcs11_provider_data/patches/

nhorman@hmsbeagle:~/git/worktrees/work1/test/recipes/95-test_external_pkcs11_provider_data/patches$ ls

0001-Fix-direct-ASN1_STRING-access-in-encoder.c.patch  0002-Fix-direct-ASN1-STRING-access-in-objects.c.patch

nhorman@hmsbeagle:~/git/worktrees/work1/test/recipes/95-test_external_pkcs11_provider_data/patches$ 

If you look at the CI logs from this PR:
https://github.com/openssl/openssl/actions/runs/27634776257/job/81718916892?pr=31546

You'll see those patches silently fail to apply:

# /__w/openssl/openssl/test-runs/test_external_pkcs11_provider/../../test/recipes/95-test_external_pkcs11_provider_data
error: patch failed: src/encoder.c:646
error: src/encoder.c: patch does not apply
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
# Applying: Fix direct ASN1_STRING access in encoder.c
# Patch failed at 0001 Fix direct ASN1_STRING access in encoder.c

its not hurting anything right now, as they just silently fail and the code builds, but since you updated the pkcs11 submodule to a commit level that now contains those patches, you should drop the patches from the list here.

ah ok I got it now. I thought that you are talking about that TLS patch and missed those. Just deleted them.

So the second commit is just for 4.0 (that's why the failures) but the first one should apply to 3.5 and 3.6 where are no patches. I removed 3.0 and 3.4 as it doesn't have pkcs11_provider external test.

Pushed to 4.0 and 3.6.

@bukka There is a conflict cherry-picking to 3.5. We need something different there.

@mattcaswell the pkcs11-provider tests were actually completely disabled there because of some old PQC sigalgs issue. I re-enabled them and used the same CI like in other branches which seems to pass now: #31556 . That one is not urgent because CI wasn't broken there.