[Pkg-openssl-devel] Bug#1138466: krb5: FTBFS with openssl 4.0

[Sebastian Andrzej Siewior]

Package: krb5
Version: 1.22.1-2
Severity: normal
Tags: sid
control: affects -1 src:openssl
User: pkg-openssl-devel at lists.alioth.debian.org
Usertags: openssl-4.0

OpenSSL 4.0 is in experimental. This package fails to build against it:

| gcc -fPIC -DSHARED -DHAVE_CONFIG_H  -I../../../include -I../../../../src/include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/krb5-1.22.1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -Wcast-align -Wshadow -Wmissing-prototypes -Wno-format-zero-length -Woverflow -Wstrict-overflow -Wmissing-format-attribute -Wmissing-prototypes -Wreturn-type -Wmissing-braces -Wparentheses -Wswitch -Wunused-function -Wunused-label -Wunused-variable -Wunused-value -Wunknown-pragmas -Wsign-compare -Werror=uninitialized -Wno-maybe-uninitialized -Werror=pointer-arith -Werror=int-conversion -Werror=incompatible-pointer-types -Werror=discarded-qualifiers -Werror=implicit-int -Werror=strict-prototypes -Werror=declaration-after-statement -Werror-implicit-function-declaration -pthread  -c ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -o pkinit_crypto_openssl.so.o && mv -f pkinit_crypto_openssl.so.o pkinit_crypto_openssl.so
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c: In function ‘cms_signeddata_verify’:
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2005:34: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|  2005 |         if (!octets || ((*octets)->type != V_ASN1_OCTET_STRING)) {
|       |                                  ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2061:44: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|  2061 |             out = BIO_new_mem_buf((*octets)->data, (*octets)->length);
|       |                                            ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2061:61: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|  2061 |             out = BIO_new_mem_buf((*octets)->data, (*octets)->length);
|       |                                                             ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c: In function ‘crypto_retrieve_X509_sans’:
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2347:15: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|  2347 |     if (!(ext = X509_get_ext(cert, l)) || !(ialt = X509V3_EXT_d2i(ext))) {
|       |               ^
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2382:66: error: invalid use of incomplete typedef ‘ASN1_STRING’ {aka ‘struct asn1_string_st’}
|  2382 |             name.length = gen->d.otherName->value->value.sequence->length;
|       |                                                                  ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2383:72: error: invalid use of incomplete typedef ‘ASN1_STRING’ {aka ‘struct asn1_string_st’}
|  2383 |             name.data = (char *)gen->d.otherName->value->value.sequence->data;
|       |                                                                        ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2417:42: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|  2417 |                 if (memchr(gen->d.dNSName->data, '\0', gen->d.dNSName->length))
|       |                                          ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2417:70: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|  2417 |                 if (memchr(gen->d.dNSName->data, '\0', gen->d.dNSName->length))
|       |                                                                      ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2420:40: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|  2420 |                          gen->d.dNSName->data);
|       |                                        ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2422:50: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|  2422 |                     strdup((char *)gen->d.dNSName->data);
|       |                                                  ^~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c: In function ‘get_matching_data’:
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4864:24: error: passing argument 1 of ‘rfc2253_name’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|  4864 |     ret = rfc2253_name(X509_get_subject_name(cert), &md->subject_dn);
|       |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4769:25: note: expected ‘X509_NAME *’ {aka ‘struct X509_name_st *’} but argument is of type ‘const X509_NAME *’ {aka ‘const struct X509_name_st *’}
|  4769 | rfc2253_name(X509_NAME *name, char **str_out)
|       |              ~~~~~~~~~~~^~~~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4867:24: error: passing argument 1 of ‘rfc2253_name’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|  4867 |     ret = rfc2253_name(X509_get_issuer_name(cert), &md->issuer_dn);
|       |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4769:25: note: expected ‘X509_NAME *’ {aka ‘struct X509_name_st *’} but argument is of type ‘const X509_NAME *’ {aka ‘const struct X509_name_st *’}
|  4769 | rfc2253_name(X509_NAME *name, char **str_out)
|       |              ~~~~~~~~~~~^~~~
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c: In function ‘create_identifiers_from_stack’:
| ../../../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:5255:12: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|  5255 |         xn = X509_get_subject_name(x);
|       |            ^
| cc1: some warnings being treated as errors

Full buildlog
 	https://breakpoint.cc/openssl-rebuild/logs-4/attempted/krb5_1.22.1-2_amd64-2026-04-19T11:07:32Z

Sebastian