Dear maintainer,

During a test rebuild for CMake 4, yubihsm-shell failed to rebuild.

Log Summary:
-------------------------------------------------------------------------------
[...]
[ 12%] Building C object lib/CMakeFiles/yubihsm.dir/error.c.o
cd /build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu/lib && /usr/bin/cc -DDEFAULT_CONNECTOR_URL=\"http://localhost:12345\" -DENABLE_CERT_COMPRESS -DHAVE_EXPLICIT_BZERO -DOPENSSL_API_COMPAT=0x10000000L -DSOVERSION=\"2\" -DVERSION=\"2.7.0\" -Dyubihsm_EXPORTS -I/build/reproducible-path/yubihsm-shell-2.7.0/lib -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -std=gnu11 -fPIC -Wformat -Wformat-nonliteral -Wformat-security -Wshadow -Wmissing-prototypes -Wbad-function-cast -pedantic -pedantic-errors -fpie -fpic -Wall -Wextra -Werror -fstack-protector-all -Wno-implicit-fallthrough -MD -MT lib/CMakeFiles/yubihsm.dir/error.c.o -MF CMakeFiles/yubihsm.dir/error.c.o.d -o CMakeFiles/yubihsm.dir/error.c.o -c /build/reproducible-path/yubihsm-shell-2.7.0/lib/error.c
[ 13%] Building C object lib/CMakeFiles/yubihsm.dir/lib_util.c.o
cd /build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu/lib && /usr/bin/cc -DDEFAULT_CONNECTOR_URL=\"http://localhost:12345\" -DENABLE_CERT_COMPRESS -DHAVE_EXPLICIT_BZERO -DOPENSSL_API_COMPAT=0x10000000L -DSOVERSION=\"2\" -DVERSION=\"2.7.0\" -Dyubihsm_EXPORTS -I/build/reproducible-path/yubihsm-shell-2.7.0/lib -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -std=gnu11 -fPIC -Wformat -Wformat-nonliteral -Wformat-security -Wshadow -Wmissing-prototypes -Wbad-function-cast -pedantic -pedantic-errors -fpie -fpic -Wall -Wextra -Werror -fstack-protector-all -Wno-implicit-fallthrough -MD -MT lib/CMakeFiles/yubihsm.dir/lib_util.c.o -MF CMakeFiles/yubihsm.dir/lib_util.c.o.d -o CMakeFiles/yubihsm.dir/lib_util.c.o -c /build/reproducible-path/yubihsm-shell-2.7.0/lib/lib_util.c
[ 13%] Linking C executable test_util
cd /build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu/lib/tests && /usr/bin/cmake -E cmake_link_script CMakeFiles/test_util.dir/link.txt --verbose=1
[ 13%] Building C object lib/CMakeFiles/yubihsm.dir/yubihsm.c.o
[ 14%] Building C object lib/CMakeFiles/yubihsm.dir/data_compress.c.o
cd /build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu/lib && /usr/bin/cc -DDEFAULT_CONNECTOR_URL=\"http://localhost:12345\" -DENABLE_CERT_COMPRESS -DHAVE_EXPLICIT_BZERO -DOPENSSL_API_COMPAT=0x10000000L -DSOVERSION=\"2\" -DVERSION=\"2.7.0\" -Dyubihsm_EXPORTS -I/build/reproducible-path/yubihsm-shell-2.7.0/lib -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -std=gnu11 -fPIC -Wformat -Wformat-nonliteral -Wformat-security -Wshadow -Wmissing-prototypes -Wbad-function-cast -pedantic -pedantic-errors -fpie -fpic -Wall -Wextra -Werror -fstack-protector-all -Wno-implicit-fallthrough -MD -MT lib/CMakeFiles/yubihsm.dir/yubihsm.c.o -MF CMakeFiles/yubihsm.dir/yubihsm.c.o.d -o CMakeFiles/yubihsm.dir/yubihsm.c.o -c /build/reproducible-path/yubihsm-shell-2.7.0/lib/yubihsm.c
cd /build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu/lib && /usr/bin/cc -DDEFAULT_CONNECTOR_URL=\"http://localhost:12345\" -DENABLE_CERT_COMPRESS -DHAVE_EXPLICIT_BZERO -DOPENSSL_API_COMPAT=0x10000000L -DSOVERSION=\"2\" -DVERSION=\"2.7.0\" -Dyubihsm_EXPORTS -I/build/reproducible-path/yubihsm-shell-2.7.0/lib -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -std=gnu11 -fPIC -Wformat -Wformat-nonliteral -Wformat-security -Wshadow -Wmissing-prototypes -Wbad-function-cast -pedantic -pedantic-errors -fpie -fpic -Wall -Wextra -Werror -fstack-protector-all -Wno-implicit-fallthrough -MD -MT lib/CMakeFiles/yubihsm.dir/data_compress.c.o -MF CMakeFiles/yubihsm.dir/data_compress.c.o.d -o CMakeFiles/yubihsm.dir/data_compress.c.o -c /build/reproducible-path/yubihsm-shell-2.7.0/lib/data_compress.c
/usr/bin/cc -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -Wl,-z,relro -fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now -Wl,--dependency-file=CMakeFiles/test_util.dir/link.d CMakeFiles/test_util.dir/test_util.c.o CMakeFiles/test_util.dir/__/lib_util.c.o -o test_util  -ldl
make[4]: Leaving directory '/build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu'
[ 14%] Built target test_util
[ 14%] Linking C shared library libyubihsm.so
cd /build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu/lib && /usr/bin/cmake -E cmake_link_script CMakeFiles/yubihsm.dir/link.txt --verbose=1
/usr/bin/ld: /usr/lib/gcc/aarch64-linux-gnu/14/../../../aarch64-linux-gnu/Scrt1.o: in function `_start':
(.text+0x1c): undefined reference to `main'
/usr/bin/ld: (.text+0x20): undefined reference to `main'
collect2: error: ld returned 1 exit status
/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -Wl,--dependency-file=CMakeFiles/yubihsm.dir/link.d -shared -Wl,-z,relro -fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now -Wl,-soname,libyubihsm.so.2 -o libyubihsm.so.2.7.0 CMakeFiles/yubihsm.dir/__/aes_cmac/aes.c.o CMakeFiles/yubihsm.dir/__/aes_cmac/aes_cmac.c.o CMakeFiles/yubihsm.dir/__/common/hash.c.o CMakeFiles/yubihsm.dir/__/common/pkcs5.c.o CMakeFiles/yubihsm.dir/__/common/rand.c.o CMakeFiles/yubihsm.dir/__/common/ecdh.c.o CMakeFiles/yubihsm.dir/error.c.o CMakeFiles/yubihsm.dir/lib_util.c.o CMakeFiles/yubihsm.dir/yubihsm.c.o CMakeFiles/yubihsm.dir/data_compress.c.o  -L/usr/lib/aarch64-linux-gnu -lcrypto -ldl /usr/lib/aarch64-linux-gnu/libz.so
make[4]: *** [lib/CMakeFiles/yubihsm.dir/build.make:249: lib/libyubihsm.so.2.7.0] Error 1
make[4]: Leaving directory '/build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu'
make[3]: *** [CMakeFiles/Makefile2:484: lib/CMakeFiles/yubihsm.dir/all] Error 2
make[3]: Leaving directory '/build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu'
make[2]: *** [Makefile:149: all] Error 2
make[2]: Leaving directory '/build/reproducible-path/yubihsm-shell-2.7.0/obj-aarch64-linux-gnu'
dh_auto_build: error: cd obj-aarch64-linux-gnu && make -j4 "INSTALL=install --strip-program=true" VERBOSE=1 returned exit code 2
make[1]: *** [debian/rules:24: override_dh_auto_build] Error 25
make[1]: Leaving directory '/build/reproducible-path/yubihsm-shell-2.7.0'
make: *** [debian/rules:13: binary] Error 2
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
--------------------------------------------------------------------------------
Build finished at 2025-08-31T01:00:33Z
-------------------------------------------------------------------------------

The above is just how the build ends and not necessarily the most relevant part.
If required, the full build log is available here (for the next 30 days):
https://debusine.debian.net/artifact/2414154/

The most likely cause of build failures is the removed backwards compatibility for
CMake versions earlier than 3.5. You can find additional information in my
debian-devel announcement:

https://lists.debian.org/debian-devel/2025/04/msg00310.html

About the archive rebuild: The build was made on debusine.debian.net,
using sbuild.

You can find the build task here:
https://debusine.debian.net/work-request/155248/

If this is really a bug in one of the build-depends, please use
reassign and affects, so that this is still visible in the BTS web
page for this package.

Thanks,
Timo

[...]

The important bit of the build log diff seems to be:

-/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -Wl,--dependency-file=CMakeFiles/yubihsm.dir/link.d -Wl,-z,relro -fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now -shared -Wl,-soname,libyubihsm.so.2 -o libyubihsm.so.2.7.0 CMakeFiles/yubihsm.dir/__/aes_cmac/aes.c.o CMakeFiles/yubihsm.dir/__/aes_cmac/aes_cmac.c.o CMakeFiles/yubihsm.dir/__/common/hash.c.o CMakeFiles/yubihsm.dir/__/common/pkcs5.c.o CMakeFiles/yubihsm.dir/__/common/rand.c.o CMakeFiles/yubihsm.dir/__/common/ecdh.c.o CMakeFiles/yubihsm.dir/error.c.o CMakeFiles/yubihsm.dir/lib_util.c.o CMakeFiles/yubihsm.dir/yubihsm.c.o CMakeFiles/yubihsm.dir/data_compress.c.o  -L/usr/lib/x86_64-linux-gnu -lcrypto -ldl /usr/lib/x86_64-linux-gnu/libz.so
+/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers -Wl,--dependency-file=CMakeFiles/yubihsm.dir/link.d -shared -Wl,-z,relro -fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now -Wl,-soname,libyubihsm.so.2 -o libyubihsm.so.2.7.0 CMakeFiles/yubihsm.dir/__/aes_cmac/aes.c.o CMakeFiles/yubihsm.dir/__/aes_cmac/aes_cmac.c.o CMakeFiles/yubihsm.dir/__/common/hash.c.o CMakeFiles/yubihsm.dir/__/common/pkcs5.c.o CMakeFiles/yubihsm.dir/__/common/rand.c.o CMakeFiles/yubihsm.dir/__/common/ecdh.c.o CMakeFiles/yubihsm.dir/error.c.o CMakeFiles/yubihsm.dir/lib_util.c.o CMakeFiles/yubihsm.dir/yubihsm.c.o CMakeFiles/yubihsm.dir/data_compress.c.o  -L/usr/lib/x86_64-linux-gnu -lcrypto -ldl /usr/lib/x86_64-linux-gnu/libz.so

... i.e. the "-shared" option has been moved before "-Wl,-z,relro
-fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now".  
This appears to be enough to break the shared library link, but I can't
figure out where it was changed.  -DCMAKE_POLICY_VERSION_MINIMUM=3.31
seems to make no difference.  Do you have any pointers?

Thanks,

I have downgraded the bug to non-RC severity temporarily and reverted
CMake in unstable to version 3.31.6. I plan to re-upgrade in about a
month's time. I realize that despite my April announcement, the upload
to unstable came rather surprising, and I don't want to cause
unnecessary pain.

Also, the build log URL has an unfortunate mistake. The correct URL
should include the workspace, i.e.,

https://debusine.debian.net/debian/developers/artifact/XXXX

CMake 4 will also be available in experimental again, so it can be
used to verify that the bug is fixed.

Cheers
Timo