From c789722fec1932cddea81265c3040f51917b424f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 31 Mar 2025 15:19:52 +0200
Subject: [PATCH] Choose OpenSSL provider or engine automatically

Do not rely on manual configuration, choose engine usage for older
releases, but switch to provider on recent enough versions.
---
 Sanity/utils/pkcs11-tools/runtest.sh | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/Sanity/utils/pkcs11-tools/runtest.sh b/Sanity/utils/pkcs11-tools/runtest.sh
index 3502a6c..a1bea4a 100755
--- a/Sanity/utils/pkcs11-tools/runtest.sh
+++ b/Sanity/utils/pkcs11-tools/runtest.sh
@@ -32,7 +32,8 @@
 BACKUP_RESOLV=""
 SOURCE_RESOLV="/etc/resolv.conf"
 : ${ENGINE:=pkcs11}
-: ${USE_ENGINE:=y}
+# auto to choose based on release, y to force engine usage
+: ${USE_ENGINE:=auto}
 
 make_openssl_conf() {
 	cat << EOF
@@ -54,7 +55,7 @@ activate = 1
 [pkcs11_sect]
 module = ${PROVIDER_MODULE}
 pkcs11-module-path = ${SOFTHSM2_MODULE}
-pkcs11-module-token-pin = ${PIN_SOURCE}
+pkcs11-module-token-pin = file:${PIN_SOURCE}
 activate = 1
 EOF
 }
@@ -125,8 +126,16 @@ rlJournalStart
 
     rlPhaseStartTest "Test DNSSEC operations on token"
         DNSSEC_ENGINE=""
+        if [ "$USE_ENGINE" = auto ]; then
+            if rlIsRHEL '<10' || rlIsFedora '<32' || rlIsCentOS '<10'; then
+                USE_ENGINE='y'
+            fi
+        fi
         if [ "$USE_ENGINE" = y ]; then
-            DNSSEC_ENGINE="-E $ENGINE"
+                rlLog "Using OpenSSL engine, legacy mode"
+                DNSSEC_ENGINE="-E $ENGINE"
+            else
+                rlLog "Not using engine, using OpenSSL provider"
         fi
 	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
 	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"