[Pkg-openssl-devel] Bug#1138474: isc-kea: FTBFS with openssl 4.0

[Sebastian Andrzej Siewior]

Package: isc-kea
Version: 3.0.3-1
Severity: normal
Tags: sid
control: affects -1 src:openssl
User: pkg-openssl-devel at lists.alioth.debian.org
Usertags: openssl-4.0

OpenSSL 4.0 is in experimental. This package fails to build against it:

| [196/697] c++ -Isrc/lib/tcp/libkea-tcp.so.33.0.0.p -Isrc/lib/tcp -I../src/lib/tcp -I. -I.. -Isrc -I../src -Isrc/bin -I../src/bin -Isrc/lib -I../src/lib -I/usr/include -fdiagnostics-color=always -D_GLIBCXX_ASSERTIONS=1 -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -DBOOST_ALL_NO_LIB -pthread -g -O2 -ffile-prefix-map=/build/reproducible-path/isc-kea-3.0.3=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -MD -MQ src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o -MF src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o.d -o src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o -c ../src/lib/tcp/tcp_connection.cc
| FAILED: [code=1] src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o 
| c++ -Isrc/lib/tcp/libkea-tcp.so.33.0.0.p -Isrc/lib/tcp -I../src/lib/tcp -I. -I.. -Isrc -I../src -Isrc/bin -I../src/bin -Isrc/lib -I../src/lib -I/usr/include -fdiagnostics-color=always -D_GLIBCXX_ASSERTIONS=1 -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -DBOOST_ALL_NO_LIB -pthread -g -O2 -ffile-prefix-map=/build/reproducible-path/isc-kea-3.0.3=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -MD -MQ src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o -MF src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o.d -o src/lib/tcp/libkea-tcp.so.33.0.0.p/tcp_connection.cc.o -c ../src/lib/tcp/tcp_connection.cc
| In file included from ../src/lib/asiolink/crypto_tls.h:19,
|                  from ../src/lib/asiolink/tls_socket.h:14,
|                  from ../src/lib/asiolink/tls_acceptor.h:20,
|                  from ../src/lib/tcp/tcp_connection_acceptor.h:11,
|                  from ../src/lib/tcp/tcp_connection.h:13,
|                  from ../src/lib/tcp/tcp_connection.cc:10:
| ../src/lib/asiolink/openssl_tls.h: In instantiation of ‘std::string isc::asiolink::TlsStream<Callback>::getSubject() [with Callback = isc::tcp::TcpConnection::SocketCallback; std::string = std::__cxx11::basic_string<char>]’:
| ../src/lib/asiolink/openssl_tls.h:173:25:   required from here
|   173 |     virtual std::string getSubject() {
|       |                         ^~~~~~~~~~
| ../src/lib/asiolink/openssl_tls.h:178:52: error: invalid conversion from ‘const X509_NAME*’ {aka ‘const X509_name_st*’} to ‘X509_NAME*’ {aka ‘X509_name_st*’} [-fpermissive]
|   178 |         ::X509_NAME *name = ::X509_get_subject_name(cert);
|       |                             ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~
|       |                                                    |
|       |                                                    const X509_NAME* {aka const X509_name_st*}
| ../src/lib/asiolink/openssl_tls.h:180:54: error: invalid conversion from ‘const X509_NAME_ENTRY*’ {aka ‘const X509_name_entry_st*’} to ‘X509_NAME_ENTRY*’ {aka ‘X509_name_entry_st*’} [-fpermissive]
|   180 |         ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
|       |                                 ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
|       |                                                      |
|       |                                                      const X509_NAME_ENTRY* {aka const X509_name_entry_st*}
| ../src/lib/asiolink/openssl_tls.h: In instantiation of ‘std::string isc::asiolink::TlsStream<Callback>::getIssuer() [with Callback = isc::tcp::TcpConnection::SocketCallback; std::string = std::__cxx11::basic_string<char>]’:
| ../src/lib/asiolink/openssl_tls.h:207:25:   required from here
|   207 |     virtual std::string getIssuer() {
|       |                         ^~~~~~~~~
| ../src/lib/asiolink/openssl_tls.h:212:51: error: invalid conversion from ‘const X509_NAME*’ {aka ‘const X509_name_st*’} to ‘X509_NAME*’ {aka ‘X509_name_st*’} [-fpermissive]
|   212 |         ::X509_NAME *name = ::X509_get_issuer_name(cert);
|       |                             ~~~~~~~~~~~~~~~~~~~~~~^~~~~~
|       |                                                   |
|       |                                                   const X509_NAME* {aka const X509_name_st*}
| ../src/lib/asiolink/openssl_tls.h:214:54: error: invalid conversion from ‘const X509_NAME_ENTRY*’ {aka ‘const X509_name_entry_st*’} to ‘X509_NAME_ENTRY*’ {aka ‘X509_name_entry_st*’} [-fpermissive]
|   214 |         ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
|       |                                 ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
|       |                                                      |
|       |                                                      const X509_NAME_ENTRY* {aka const X509_name_entry_st*}
| ninja: build stopped: subcommand failed.
| dh_auto_build: error: cd build && LC_ALL=C.UTF-8 ninja -j1 -v returned exit code 1

Full buildlog
 https://breakpoint.cc/openssl-rebuild/logs-4/attempted/isc-kea_3.0.3-1_amd64-2026-04-19T13:57:33Z

Sebastian