OpenSSL 4.0 is in experimental. This package fails to build against it:
| Compiling crypto.c
| true /usr/bin/g++   -c  -Wdate-time -D_FORTIFY_SOURCE=2 -x c++ -fno-strict-aliasing -fno-exceptions -fno-rtti  -I. -I..  -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/bacula-15.0.3=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -x c++ -fno-strict-aliasing -fno-exceptions -fno-rtti  -E crypto.c | true
| /build/reproducible-path/bacula-15.0.3/libtool --tag=CXX --mode=compile /usr/bin/g++   -c  -Wdate-time -D_FORTIFY_SOURCE=2 -x c++ -fno-strict-aliasing -fno-exceptions -fno-rtti  -I. -I..  -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/bacula-15.0.3=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -x c++ -fno-strict-aliasing -fno-exceptions -fno-rtti  crypto.c
| libtool: compile:  /usr/bin/g++ -c -Wdate-time -D_FORTIFY_SOURCE=2 -x c++ -fno-strict-aliasing -fno-exceptions -fno-rtti -I. -I.. -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/bacula-15.0.3=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -x c++ -fno-strict-aliasing -fno-exceptions -fno-rtti crypto.c  -fPIC -DPIC -o .libs/crypto.o
| cc1plus: warning: '-Werror=' argument '-Werror=implicit-function-declaration' is not valid for C++
| crypto.c: In function 'ASN1_OCTET_STRING* openssl_cert_keyid(X509*)':
| crypto.c:327:22: error: invalid conversion from 'const X509_EXTENSION*' {aka 'const X509_extension_st*'} to 'X509_EXTENSION*' {aka 'X509_extension_st*'} [-fpermissive]
|   327 |    ext = X509_get_ext(cert, i);
|       |          ~~~~~~~~~~~~^~~~~~~~~
|       |                      |
|       |                      const X509_EXTENSION* {aka const X509_extension_st*}
| crypto.c: In function 'int crypto_sign_add_signer(SIGNATURE*, DIGEST*, X509_KEYPAIR*)':
| crypto.c:991:71: warning: 'const EVP_MD* EVP_MD_CTX_md(const EVP_MD_CTX*)' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|   991 |    si->signatureAlgorithm = OBJ_nid2obj(EVP_MD_pkey_type(EVP_MD_CTX_md(digest->ctx)));
|       |                                                          ~~~~~~~~~~~~~^~~~~~~~~~~~~
| In file included from /usr/include/openssl/x509.h:31,
|                  from /usr/include/openssl/ssl.h:34,
|                  from ../bacula.h:147,
|                  from crypto.c:37:
| /usr/include/openssl/evp.h:476:15: note: declared here
|   476 | const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
|       |               ^~~~~~~~~~~~~
| crypto.c: In function 'CRYPTO_SESSION* crypto_session_new(crypto_cipher_t, alist*)':
| crypto.c:1214:39: warning: 'int EVP_PKEY_encrypt_old(unsigned char*, const unsigned char*, int, EVP_PKEY*)' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1214 |       if ((ekey_len = EVP_PKEY_encrypt(ekey, cs->session_key, cs->session_key_len, keypair->pubkey)) <= 0) {
|       |                                       ^
| /usr/include/openssl/evp.h:1259:27: note: declared here
|  1259 | OSSL_DEPRECATEDIN_3_0 int EVP_PKEY_encrypt_old(unsigned char *enc_key,
|       |                           ^~~~~~~~~~~~~~~~~~~~
| crypto.c: In function 'crypto_error_t crypto_session_decode(const u_int8_t*, u_int32_t, alist*, CRYPTO_SESSION**)':
| crypto.c:1333:51: warning: 'int EVP_PKEY_decrypt_old(unsigned char*, const unsigned char*, int, EVP_PKEY*)' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1333 |             cs->session_key_len = EVP_PKEY_decrypt(cs->session_key, ASN1_STRING_get0_data(ri->encryptedKey),
|       |                                                   ^
| /usr/include/openssl/evp.h:1255:27: note: declared here
|  1255 | OSSL_DEPRECATEDIN_3_0 int EVP_PKEY_decrypt_old(unsigned char *dec_key,
|       |                           ^~~~~~~~~~~~~~~~~~~~
| make[3]: *** [Makefile:210: crypto.lo] Error 1
| make[3]: Leaving directory '/build/reproducible-path/bacula-15.0.3/src/lib'
|
|
|   ====== Error in /build/reproducible-path/bacula-15.0.3/src/lib ======
|
|
| make[2]: *** [Makefile:164: all] Error 1

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/bacula_15.0.3-5_amd64-2026-04-19T09:55:30Z

Sebastian

Hi Sebastian,

I've forwarded your report upstream. But if you can help with a patch
that will keep the code portable, it would be appreciated by everyone :-)

Regards

Carsten

Hi,

Thank you.
I'm trying to fill the remaining first. From looking at it, adding the
const modifier might do the trick. The "deprecated" parts are just
warning and should have been there since the 3.0 release.

Sebastian