[Pkg-openssl-devel] Bug#1138455: globus-gsi-callback: FTBFS with openssl 4.0

[Sebastian Andrzej Siewior]

Package: globus-gsi-callback
Version: 6.2-3
Severity: normal
Tags: sid
control: affects -1 src:openssl
User: pkg-openssl-devel at lists.alioth.debian.org
Usertags: openssl-4.0

OpenSSL 4.0 is in experimental. This package fails to build against it:

| libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -I.. -I../library/oldgaa -I/usr/include/globus -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/globus-gsi-callback-6.2=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c globus_gsi_callback.c  -fPIC -DPIC -o .libs/globus_gsi_callback.o
| globus_gsi_callback.c: In function 'globus_gsi_callback_X509_verify_cert':
| globus_gsi_callback.c:391:69: error: passing argument 2 of 'X509_STORE_set_check_issued' from incompatible pointer type [-Wincompatible-pointer-types]
|   391 |     X509_STORE_set_check_issued(X509_STORE_CTX_get0_store(context), globus_gsi_callback_check_issued);
|       |                                                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|       |                                                                     |
|       |                                                                     int (*)(X509_STORE_CTX *, X509 *, X509 *) {aka int (*)(struct x509_store_ctx_st *, struct x509_st *, struct x509_st *)}
| In file included from /usr/include/openssl/x509.h:494,
|                  from /usr/include/globus/globus_gsi_cert_utils.h:99,
|                  from globus_gsi_callback.h:28,
|                  from globus_i_gsi_callback.h:27,
|                  from globus_gsi_callback.c:27:
| /usr/include/openssl/x509_vfy.h:556:36: note: expected 'X509_STORE_CTX_check_issued_fn' {aka 'int (*)(struct x509_store_ctx_st *, const struct x509_st *, const struct x509_st *)'} but argument is of type 'int (*)(X509_STORE_CTX *, X509 *, X509 *)' {aka 'int (*)(struct x509_store_ctx_st *, struct x509_st *, struct x509_st *)'}
|   556 |     X509_STORE_CTX_check_issued_fn check_issued);
|       |     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
| globus_gsi_callback.h:152:5: note: 'globus_gsi_callback_check_issued' declared here
|   152 | int globus_gsi_callback_check_issued(
|       |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| /usr/include/openssl/x509_vfy.h:259:15: note: 'X509_STORE_CTX_check_issued_fn' declared here
|   259 | typedef int (*X509_STORE_CTX_check_issued_fn)(X509_STORE_CTX *ctx,
|       |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| globus_gsi_callback.c: In function 'globus_i_gsi_callback_check_revoked':
| globus_gsi_callback.c:1120:13: warning: 'X509_cmp_current_time' is deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
|  1120 |             i = X509_cmp_current_time(last_update);
|       |             ^
| /usr/include/openssl/x509.h:694:27: note: declared here
|   694 | OSSL_DEPRECATEDIN_4_0 int X509_cmp_current_time(const ASN1_TIME *s);
|       |                           ^~~~~~~~~~~~~~~~~~~~~
| globus_gsi_callback.c:1141:13: warning: 'X509_cmp_current_time' is deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
|  1141 |             i = (has_next_time) ? X509_cmp_current_time(next_update) : 1;
|       |             ^
| /usr/include/openssl/x509.h:694:27: note: declared here
|   694 | OSSL_DEPRECATEDIN_4_0 int X509_cmp_current_time(const ASN1_TIME *s);
|       |                           ^~~~~~~~~~~~~~~~~~~~~
| globus_gsi_callback.c:1173:21: warning: 'X509_STORE_get0_objects' is deprecated: Since OpenSSL 4.0;Use X509_STORE_get1_objects [-Wdeprecated-declarations]
|  1173 |                     objects = X509_STORE_get0_objects(X509_STORE_CTX_get0_store(x509_context));
|       |                     ^~~~~~~
| /usr/include/openssl/x509_vfy.h:527:24: note: declared here
|   527 | STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(const X509_STORE *xs);
|       |                        ^~~~~~~~~~~~~~~~~~~~~~~
| globus_gsi_callback.c: In function 'globus_i_gsi_callback_check_gaa_auth':
| globus_gsi_callback.c:1416:13: warning: passing argument 1 of 'globus_gsi_sysconfig_get_signing_policy_filename_unix' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|  1416 |             X509_get_issuer_name(X509_STORE_CTX_get_current_cert(x509_context)),
|       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| In file included from globus_gsi_callback.c:28:
| /usr/include/globus/globus_gsi_system_config.h:530:41: note: expected 'X509_NAME *' {aka 'struct X509_name_st *'} but argument is of type 'const X509_NAME *' {aka 'const struct X509_name_st *'}
|   530 |     X509_NAME *                         ca_name,
|       |     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~
| globus_gsi_callback.c: In function 'globus_i_gsi_callback_check_critical_extensions':
| globus_gsi_callback.c:1617:19: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|  1617 |         extension = X509_get_ext(X509_STORE_CTX_get_current_cert(x509_context), critical_position);
|       |                   ^
| globus_gsi_callback.c:1629:26: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|  1629 |         extension_object = X509_EXTENSION_get_object(extension);
|       |                          ^
| make[4]: *** [Makefile:528: globus_gsi_callback.lo] Error 1

Full buildlog
 	https://breakpoint.cc/openssl-rebuild/logs-4/attempted/globus-gsi-callback_6.2-3_amd64-2026-04-19T12:12:19Z

Sebastian