#1133625 sbsigntool: ftbfs with GCC-16

Package:
src:sbsigntool
Source:
src:sbsigntool
Submitter:
Emanuele Rocca
Date:
2026-06-24 11:51:02 UTC
Severity:
normal
Tags:
#1133625#5
Date:
2026-04-13 13:10:46 UTC
From:
To:
Hi,

sbsigntool fails to build in a test rebuild on at least amd64 and arm64 with
gcc-16/g++-16, but builds properly with gcc-15/g++-15. The severity of this
report will be raised before the forky release.

The full build log can be found at:
https://people.debian.org/~ema/gcc-16-rebuilds/output-1/sbsigntool_arm64.build.xz

The last lines of the build log are at the end of this report.

To build with GCC 16, either set CC=gcc-16 CXX=g++-16 explicitly,
or install the gcc, g++, gfortran, ... packages from experimental.

  apt-get -t=experimental install g++

Common build failures include unused (but set) variables, array subscripts
partly outside array bounds, and new/dropped symbols in Debian symbols files.
For other C/C++ related build failures see the porting guide at
http://gcc.gnu.org/gcc-16/porting_to.html

Please only close this issue after double-checking that the package can be
built correctly with GCC 16.

Please do not reassign this bug to another package. If a fix in another package
is required, then file a bug for the other package (or clone), and mark this
bug as blocked by the bug in the other package.

[...]


/usr/include/openssl/sha.h:74:27: note: declared here
   74 | OSSL_DEPRECATEDIN_3_0 int SHA256_Update(SHA256_CTX *c,
      |                           ^~~~~~~~~~~~~
image.c:541:9: warning: ‘SHA256_Final’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
  541 |         rc = SHA256_Final(digest, &ctx);
      |         ^~
/usr/include/openssl/sha.h:76:27: note: declared here
   76 | OSSL_DEPRECATEDIN_3_0 int SHA256_Final(unsigned char *md, SHA256_CTX *c);
      |                           ^~~~~~~~~~~~
image.c:518:20: error: variable ‘n’ set but not used [-Werror=unused-but-set-variable=]
  518 |         int rc, i, n;
      |                    ^
fileio.c: In function ‘fileio_read_engine_key’:
fileio.c:69:9: warning: ‘ENGINE_load_builtin_engines’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
   69 |         ENGINE_load_builtin_engines();
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from fileio.c:42:
/usr/include/openssl/engine.h:358:28: note: declared here
  358 | OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void);
      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~
fileio.c:70:9: warning: ‘ENGINE_by_id’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
   70 |         e = ENGINE_by_id(engine);
      |         ^
/usr/include/openssl/engine.h:336:31: note: declared here
  336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
      |                               ^~~~~~~~~~~~
fileio.c:86:9: warning: ‘ENGINE_init’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
   86 |         if (!ENGINE_init(e)) {
      |         ^~
/usr/include/openssl/engine.h:622:27: note: declared here
  622 | OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e);
      |                           ^~~~~~~~~~~
fileio.c:92:9: warning: ‘ENGINE_load_private_key’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
   92 |         pkey = ENGINE_load_private_key(e, filename, ui, NULL);
      |         ^~~~
/usr/include/openssl/engine.h:640:11: note: declared here
  640 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
      |           ^~~~~~~~~~~~~~~~~~~~~~~
fileio.c:93:9: warning: ‘ENGINE_finish’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
   93 |         ENGINE_finish(e);
      |         ^~~~~~~~~~~~~
/usr/include/openssl/engine.h:630:27: note: declared here
  630 | OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e);
      |                           ^~~~~~~~~~~~~
fileio.c:96:9: warning: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
   96 |         ENGINE_free(e);
      |         ^~~~~~~~~~~
/usr/include/openssl/engine.h:493:27: note: declared here
  493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
      |                           ^~~~~~~~~~~
cc1: all warnings being treated as errors
make[3]: *** [Makefile:837: sbverify-image.o] Error 1
make[3]: *** Waiting for unfinished jobs....
cc1: all warnings being treated as errors
make[3]: *** [Makefile:781: sbvarsign-image.o] Error 1
cc1: all warnings being treated as errors
make[3]: *** [Makefile:613: sbkeysync-image.o] Error 1
cc1: all warnings being treated as errors
make[3]: *** [Makefile:725: sbsign-image.o] Error 1
cc1: all warnings being treated as errors
make[3]: *** [Makefile:557: sbattach-image.o] Error 1
cc1: all warnings being treated as errors
make[3]: *** [Makefile:669: sbsiglist-image.o] Error 1
make[3]: Leaving directory '/build/reproducible-path/sbsigntool-0.9.4/src'
make[2]: *** [Makefile:384: all-recursive] Error 1
make[2]: Leaving directory '/build/reproducible-path/sbsigntool-0.9.4'
make[1]: *** [Makefile:325: all] Error 2
make[1]: Leaving directory '/build/reproducible-path/sbsigntool-0.9.4'
dh_auto_build: error: make -j128 returned exit code 2
make: *** [debian/rules:13: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess failed with exit status 2

#1133625#10
Date:
2026-04-22 00:53:10 UTC
From:
To:
tags 1133625 + patch
user debian-release@lists.debian.org
usertags 1133625 + bsp-2026-04-br-campinas
thanks

Hi,

Here's a proposed debdiff which fixes the failure.  Eventually it'd be
great to forward it upstream.

Thanks,

#1133625#17
Date:
2026-06-24 11:48:49 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
sbsigntool, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1133625@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mate Kukri <mate.kukri@canonical.com> (supplier of updated sbsigntool package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 24 Jun 2026 12:29:50 +0100
Source: sbsigntool
Architecture: source
Version: 0.9.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian EFI Team <debian-efi@lists.debian.org>
Changed-By: Mate Kukri <mate.kukri@canonical.com>
Closes: 939392 1133625
Changes:
 sbsigntool (0.9.5-1) unstable; urgency=medium
 .
   * d/watch: Fix git version detection
   * New upstream version 0.9.5
   * d/patches: Update for new upstream version
   * Fix FTBFS with GCC 16 (Closes: #1133625)
   * d/patches: Upstream patches from Ubuntu (Closes: #939392)
   * d/control: Rename build-dep pkg-config => pkgconf
   * d/control: Add Mate Kukri to Uploaders
   * d/copyright: Fix ccan path typos
   * d/copyright: Replace old FSF postal address with URL
Checksums-Sha1:
 69c36eca2644cfc7317a700ff64dca19e919a188 2189 sbsigntool_0.9.5-1.dsc
 c2ac3f382124002498d233349b56451ac7d423b3 137468 sbsigntool_0.9.5.orig.tar.gz
 a0373629ba45de8be5115ffb671112109d9b5dbd 15756 sbsigntool_0.9.5-1.debian.tar.xz
 beea831bf0df5e20c493dc301f22aa5d1c7ae4b6 6520 sbsigntool_0.9.5-1_source.buildinfo
Checksums-Sha256:
 e42a3da15340dd145114904fa6a69b0ef5e04ee7a396e54d00dd6179564c2636 2189 sbsigntool_0.9.5-1.dsc
 fa93920ef80a406115c1de6f7764ffa4c34e3d1bd7890b9145c36de899a258f5 137468 sbsigntool_0.9.5.orig.tar.gz
 e2b615a9b981a99523c528904466ebac70148a2fd47c0e0ffcb887ced502bebb 15756 sbsigntool_0.9.5-1.debian.tar.xz
 7171d0c0473795063d3ba46e1ff139464e9f569c572404d97f1b14c433588307 6520 sbsigntool_0.9.5-1_source.buildinfo
Files:
 8d345b7fcaed062db666339469d8bbc0 2189 utils optional sbsigntool_0.9.5-1.dsc
 c5fa2db2c725693cb041c9669098ea7a 137468 utils optional sbsigntool_0.9.5.orig.tar.gz
 19a907dc5ffdcd40e3cc9fb9a2001967 15756 utils optional sbsigntool_0.9.5-1.debian.tar.xz
 273f5d0eba79a20b6120e87025eb7994 6520 utils optional sbsigntool_0.9.5-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJNBAEBCgA3FiEElmwl2ANNHob/r9FalkCpSGVxka4FAmo7wIEZHG1hdGUua3Vr
cmlAY2Fub25pY2FsLmNvbQAKCRCWQKlIZXGRrhxqD/sFDMEcvIvUun/8gVQxexh3
+MxaYemn80m8ipNvToRJu0cjDU/pqyESkBjbf1Qa0eu/F8/KxjIN8F0b/Ss7xbuA
FWUORwgNnn64nu0RxmodwxSfuauOjbYrgfVRPmBY/Mo9pytUevfP5/QJ9Mvp8UZG
t72ypOVY+szvZH5SoPqPBrfTdfAr0jHcwwBY8LpvlSg19cxk0iGn7PDuTwVSN9AV
roIfBJ1deDj5g1NHlWwQGvi2OVgIuD92E/6eYESCZy1BWWFFAEwc/Ov2k9Y3AzX9
47vOyHzB8MVNbKKuCzq7GutuYJZC8ANAENvGtfEH75Ed9QstgxeME7DlXA358B2n
dFUqUEV3AMSEMPou4My2hEXkOIeVC0eZbcNnsFG8946FMHKqIcajF2GQN7AKlIpl
HBUuUsU0L5yLvzHsuq0Vvulm+VAZ5Fgs9q607tdky+0gh+ABTjPjCpMtVJLwuiuq
q1X92WNx87n5eJPcOg7GZ244v+UESws6cKn7fS1MLelFYRcjkk45slq2kk6Ii9Mt
JiKxrBukT6FwEHDEgtY7dnxEBsAjEMA1DVCiVnDDcpkXt1hcaNLKF0/zjhvOX8Jr
qWsOF9RlC146/qPCw3crF1hCl5lKNnRN+0mnlekWXYhVG8iW/Oy3RkHNUwIYfTqw
oXXr6vI+5YoydXW/Hz+Iag==
=W/iH
-----END PGP SIGNATURE-----