#!/bin/sh

# This runs a quick check to see if the pkcs11prov provider from libp11 is
# available and can be loaded, and if its capabilities can be listed

set -e

ssl_cnf=$(mktemp)
DEB_BUILD_MULTIARCH="$(dpkg-architecture -q DEB_BUILD_MULTIARCH)"

cleanup() {
    if [ -n "${ssl_cnf}" -a -f "${ssl_cnf}" ]; then
        rm -f "${ssl_cnf}"
    fi
}

trap cleanup EXIT

cat > ${ssl_cnf} <<EOF
HOME = .
openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect

[default_sect]
activate = 1

[pkcs11_sect]
identity = pkcs11prov
module = /usr/lib/${DEB_BUILD_MULTIARCH}/ossl-modules/pkcs11prov.so
pkcs11_module = /usr/lib/${DEB_BUILD_MULTIARCH}/pkcs11/opensc-pkcs11.so
activate = 1
EOF

OPENSSL_CONF="${ssl_cnf}" \
    openssl list -providers -verbose -provider pkcs11prov
