[Pkg-openssl-devel] Bug#1139232: python-cryptography: FTBFS with openssl 4.0

Sun Jun 7 13:49:44 BST 2026

Package: python-cryptography 
Version: 46.0.7-1
Severity: normal
Tags: sid
control: affects -1 src:openssl
User: pkg-openssl-devel at lists.alioth.debian.org
Usertags: openssl-4.0

OpenSSL 4.0 is in experimental. This package fails to build against it:

|        Fresh cryptography-x509 v0.1.0 (/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-x509)
|        Fresh cryptography-crypto v0.1.0 (/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-crypto)
|    Compiling cryptography-cffi v0.1.0 (/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-cffi)
|      Running `CARGO=/usr/bin/cargo CARGO_CFG_FEATURE='' CARGO_CFG_PANIC=unwind CARGO_CFG_TARGET_ABI='' CARGO_CFG_TARGET_ARCH=x86_64 CARGO_CFG_TARGET_ENDIAN=little CARGO_CFG_TARGET_ENV=gnu CARGO_CFG_TARGET_FAMILY=unix CARGO_CFG_TARGET_FEATURE=fxsr,sse,sse2 CARGO_CFG_TARGET_HAS_ATOMIC=16,32,64,8,ptr CARGO_CFG_TARGET_OS=linux CARGO_CFG_TARGET_POINTER_WIDTH=64 CARGO_CFG_TARGET_VENDOR=unknown CARGO_CFG_UNIX='' CARGO_ENCODED_RUSTFLAGS='-Cdebuginfo=2-Cstrip=none--cap-lintswarn-Clinker=x86_64-linux-gnu-gcc-Clink-arg=-Wl,-z,relro-Clink-arg=-Wl,-z,now--remap-path-prefix/build/reproducible-path/python-cryptography-46.0.7=/usr/share/cargo/registry/python-cryptography-46.0.7--remap-path-prefix/build/reproducible-path/python-cryptography-46.0.7/debian/cargo_registry=/usr/share/cargo/registry' CARGO_MANIFEST_DIR=/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-cffi CARGO_MANIFEST_PATH=/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-cffi/Cargo.toml CARGO_PKG_AUTHORS='The cryptography developers <cryptography-dev at python.org>' CARGO_PKG_DESCRIPTION='' CARGO_PKG_HOMEPAGE='' CARGO_PKG_LICENSE='Apache-2.0 OR BSD-3-Clause' CARGO_PKG_LICENSE_FILE='' CARGO_PKG_NAME=cryptography-cffi CARGO_PKG_README='' CARGO_PKG_REPOSITORY='' CARGO_PKG_RUST_VERSION=1.74.0 CARGO_PKG_VERSION=0.1.0 CARGO_PKG_VERSION_MAJOR=0 CARGO_PKG_VERSION_MINOR=1 CARGO_PKG_VERSION_PATCH=0 CARGO_PKG_VERSION_PRE='' DEBUG=true DEP_OPENSSL_CONF=OPENSSL_NO_IDEA,OPENSSL_NO_ENGINE DEP_OPENSSL_INCLUDE=/usr/include DEP_OPENSSL_VERSION_NUMBER=40000000 HOST=x86_64-unknown-linux-gnu LD_LIBRARY_PATH='/build/reproducible-path/python-cryptography-46.0.7/target/release:/build/reproducible-path/python-cryptography-46.0.7/target/release/deps:/usr/lib/rustlib/x86_64-unknown-linux-gnu/lib:/usr/lib/libeatmydata' NUM_JOBS=1 OPT_LEVEL=3 OUT_DIR=/build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out PROFILE=release RUSTC=rustc RUSTDOC=rustdoc TARGET=x86_64-unknown-linux-gnu /build/reproducible-path/python-cryptography-46.0.7/target/release/build/cryptography-cffi-4cda6cb903dc2156/build-script-build`
| [cryptography-cffi 0.1.0] 
| [cryptography-cffi 0.1.0] 
| [cryptography-cffi 0.1.0] error occurred in cc-rs: command did not execute successfully (status code exit status: 1): LC_ALL="C" "cc" "-O3" "-ffunction-sections" "-fdata-sections" "-fPIC" "-g" "-gdwarf-4" "-fno-omit-frame-pointer" "-m64" "-I" "/usr/include" "-I" "/usr/include/python3.13" "-Wconversion" "-Wno-error=sign-conversion" "-Wno-unused-parameter" "-fmacro-prefix-map=/build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out=." "-DPy_LIMITED_API=0x030800f0" "-g" "-O2" "-Werror=implicit-function-declaration" "-ffile-prefix-map=/build/reproducible-path/python-cryptography-46.0.7=." "-fstack-protector-strong" "-fstack-clash-protection" "-Wformat" "-Werror=format-security" "-fcf-protection" "-o" "/build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/ed6c03a04e718d06-_openssl.o" "-c" "/build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c"
| [cryptography-cffi 0.1.0] 
| [cryptography-cffi 0.1.0] 
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c: In function '_cffi_d_X509_EXTENSION_get_data':
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:16206:10: warning: return discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
| warning: cryptography-cffi at 0.1.0: 16206 |   return X509_EXTENSION_get_data(x0);
| warning: cryptography-cffi at 0.1.0:       |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c: In function '_cffi_f_X509_EXTENSION_get_data':
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:16229:12: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
| warning: cryptography-cffi at 0.1.0: 16229 |   { result = X509_EXTENSION_get_data(x0); }
| warning: cryptography-cffi at 0.1.0:       |            ^
…
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c: In function '_cffi_checkfld__ASN1_OCTET_STRING':
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:21524:12: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 21524 |   (void)((p->length) | 0);  /* check that 'ASN1_OCTET_STRING.length' is an integer */
| warning: cryptography-cffi at 0.1.0:       |            ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:21525:12: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 21525 |   (void)((p->type) | 0);  /* check that 'ASN1_OCTET_STRING.type' is an integer */
| warning: cryptography-cffi at 0.1.0:       |            ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:21526:30: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 21526 |   { unsigned char * *tmp = &p->data; (void)tmp; }
| warning: cryptography-cffi at 0.1.0:       |                              ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:21527:12: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 21527 |   (void)((p->flags) | 0);  /* check that 'ASN1_OCTET_STRING.flags' is an integer */
| warning: cryptography-cffi at 0.1.0:       |            ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c: At top level:
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:21529:67: error: field 'y' has incomplete type
| warning: cryptography-cffi at 0.1.0: 21529 | struct _cffi_align__ASN1_OCTET_STRING { char x; ASN1_OCTET_STRING y; };
| warning: cryptography-cffi at 0.1.0:       |                                                                   ^
| warning: cryptography-cffi at 0.1.0: In file included from /usr/include/sched.h:29,
| warning: cryptography-cffi at 0.1.0:                  from /usr/include/pthread.h:22,
| warning: cryptography-cffi at 0.1.0:                  from /usr/include/openssl/crypto.h:574,
| warning: cryptography-cffi at 0.1.0:                  from /usr/include/openssl/bio.h:32,
| warning: cryptography-cffi at 0.1.0:                  from /usr/include/openssl/asn1.h:32,
| warning: cryptography-cffi at 0.1.0:                  from /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:628:
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22169:15: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22169 |   { "length", offsetof(ASN1_OCTET_STRING, length),
| warning: cryptography-cffi at 0.1.0:       |               ^~~~~~~~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22170:46: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22170 |               sizeof(((ASN1_OCTET_STRING *)0)->length),
| warning: cryptography-cffi at 0.1.0:       |                                              ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22172:13: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22172 |   { "type", offsetof(ASN1_OCTET_STRING, type),
| warning: cryptography-cffi at 0.1.0:       |             ^~~~~~~~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22173:44: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22173 |             sizeof(((ASN1_OCTET_STRING *)0)->type),
| warning: cryptography-cffi at 0.1.0:       |                                            ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22175:13: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22175 |   { "data", offsetof(ASN1_OCTET_STRING, data),
| warning: cryptography-cffi at 0.1.0:       |             ^~~~~~~~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22176:44: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22176 |             sizeof(((ASN1_OCTET_STRING *)0)->data),
| warning: cryptography-cffi at 0.1.0:       |                                            ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22178:14: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22178 |   { "flags", offsetof(ASN1_OCTET_STRING, flags),
| warning: cryptography-cffi at 0.1.0:       |              ^~~~~~~~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22179:45: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22179 |              sizeof(((ASN1_OCTET_STRING *)0)->flags),
| warning: cryptography-cffi at 0.1.0:       |                                             ^~
| warning: cryptography-cffi at 0.1.0: /build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out/_openssl.c:22280:12: error: invalid application of 'sizeof' to incomplete type 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
| warning: cryptography-cffi at 0.1.0: 22280 |     sizeof(ASN1_OCTET_STRING), offsetof(struct _cffi_align__ASN1_OCTET_STRING, y), 8, 4 },
| warning: cryptography-cffi at 0.1.0:       |            ^~~~~~~~~~~~~~~~~
| error: failed to run custom build command for `cryptography-cffi v0.1.0 (/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-cffi)`
| 
| Caused by:
|   process didn't exit successfully: `CARGO=/usr/bin/cargo CARGO_CFG_FEATURE='' CARGO_CFG_PANIC=unwind CARGO_CFG_TARGET_ABI='' CARGO_CFG_TARGET_ARCH=x86_64 CARGO_CFG_TARGET_ENDIAN=little CARGO_CFG_TARGET_ENV=gnu CARGO_CFG_TARGET_FAMILY=unix CARGO_CFG_TARGET_FEATURE=fxsr,sse,sse2 CARGO_CFG_TARGET_HAS_ATOMIC=16,32,64,8,ptr CARGO_CFG_TARGET_OS=linux CARGO_CFG_TARGET_POINTER_WIDTH=64 CARGO_CFG_TARGET_VENDOR=unknown CARGO_CFG_UNIX='' CARGO_ENCODED_RUSTFLAGS='-Cdebuginfo=2-Cstrip=none--cap-lintswarn-Clinker=x86_64-linux-gnu-gcc-Clink-arg=-Wl,-z,relro-Clink-arg=-Wl,-z,now--remap-path-prefix/build/reproducible-path/python-cryptography-46.0.7=/usr/share/cargo/registry/python-cryptography-46.0.7--remap-path-prefix/build/reproducible-path/python-cryptography-46.0.7/debian/cargo_registry=/usr/share/cargo/registry' CARGO_MANIFEST_DIR=/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-cffi CARGO_MANIFEST_PATH=/build/reproducible-path/python-cryptography-46.0.7/src/rust/cryptography-cffi/Cargo.toml CARGO_PKG_AUTHORS='The cryptography developers <cryptography-dev at python.org>' CARGO_PKG_DESCRIPTION='' CARGO_PKG_HOMEPAGE='' CARGO_PKG_LICENSE='Apache-2.0 OR BSD-3-Clause' CARGO_PKG_LICENSE_FILE='' CARGO_PKG_NAME=cryptography-cffi CARGO_PKG_README='' CARGO_PKG_REPOSITORY='' CARGO_PKG_RUST_VERSION=1.74.0 CARGO_PKG_VERSION=0.1.0 CARGO_PKG_VERSION_MAJOR=0 CARGO_PKG_VERSION_MINOR=1 CARGO_PKG_VERSION_PATCH=0 CARGO_PKG_VERSION_PRE='' DEBUG=true DEP_OPENSSL_CONF=OPENSSL_NO_IDEA,OPENSSL_NO_ENGINE DEP_OPENSSL_INCLUDE=/usr/include DEP_OPENSSL_VERSION_NUMBER=40000000 HOST=x86_64-unknown-linux-gnu LD_LIBRARY_PATH='/build/reproducible-path/python-cryptography-46.0.7/target/release:/build/reproducible-path/python-cryptography-46.0.7/target/release/deps:/usr/lib/rustlib/x86_64-unknown-linux-gnu/lib:/usr/lib/libeatmydata' NUM_JOBS=1 OPT_LEVEL=3 OUT_DIR=/build/reproducible-path/python-cryptography-46.0.7/target/x86_64-unknown-linux-gnu/release/build/cryptography-cffi-bc0a63de9b0cac17/out PROFILE=release RUSTC=rustc RUSTDOC=rustdoc TARGET=x86_64-unknown-linux-gnu /build/reproducible-path/python-cryptography-46.0.7/target/release/build/cryptography-cffi-4cda6cb903dc2156/build-script-build` (exit status: 1)
| 

The issue at
	https://github.com/pyca/cryptography/issues/14656

has been closed with "Needs rust-openssl support first". The version in
Debian has openssl-4 support already and packages compile against it
with openssl 4.0. I am not sure if there is something missing in
python-cryptography or of it is resolved as of latest 48 release or in
the git repository. It still fails to compile as of today.

Full buildlog
 https://breakpoint.cc/openssl-rebuild/logs-4/attempted/python-cryptography_46.0.7-1_amd64-2026-05-30T19:22:46Z 

Sebastian