OpenSSL 4.0 is in experimental. This package fails to build against it:
| gcc -o imap-send.o -c -MF ./.depend/imap-send.o.d -MQ imap-send.o -MMD -MP   -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/cgit-1.2.3+git20250818.80.3346409+git2.51.0/git=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -Wdate-time -D_FORTIFY_SOURCE=2  -I. -DGIT_HOST_CPU="\"x86_64\"" -DHAVE_ALLOCA_H -DNO_CURL -DSUPPORTS_SIMPLE_IPC -DSHA1_DC -DSHA1DC_NO_STANDARD_INCLUDES -DSHA1DC_INIT_SAFE_HASH_DEFAULT=0 -DSHA1DC_CUSTOM_INCLUDE_SHA1_C="\"git-compat-util.h\"" -DSHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C="\"git-compat-util.h\"" -DSHA256_BLK  -DHAVE_PATHS_H -DHAVE_DEV_TTY -DHAVE_CLOCK_GETTIME -DHAVE_CLOCK_MONOTONIC -DHAVE_SYNC_FILE_RANGE -DHAVE_SYSINFO -DHAVE_GETDELIM -DHAVE_GETRANDOM -DFREAD_READS_DIRECTORIES -DNO_STRLCPY -DSHELL_PATH='"/bin/sh"'  imap-send.c
| imap-send.c: In function ‘verify_hostname’:
| imap-send.c:249:70: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|   249 |                             strlen((const char *)subj_alt_name->d.ia5->data) == (size_t)subj_alt_name->d.ia5->length &&
|       |                                                                      ^~
| imap-send.c:249:109: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|   249 |                             strlen((const char *)subj_alt_name->d.ia5->data) == (size_t)subj_alt_name->d.ia5->length &&
|       |                                                                                                             ^~
| imap-send.c:250:87: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
|   250 |                             host_matches(hostname, (const char *)(subj_alt_name->d.ia5->data)))
|       |                                                                                       ^~
| imap-send.c:259:20: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
|   259 |         if (!(subj = X509_get_subject_name(cert)))
|       |                    ^
| imap-send.c:261:9: warning: ‘X509_NAME_get_text_by_NID’ is deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
|   261 |         if ((len = X509_NAME_get_text_by_NID(subj, NID_commonName, cname, sizeof(cname))) < 0)
|       |         ^~
| In file included from /usr/include/openssl/ssl.h:34,
|                  from git-compat-util.h:226,
|                  from imap-send.c:27:
| /usr/include/openssl/x509.h:1041:27: note: declared here
|  1041 | OSSL_DEPRECATEDIN_4_0 int X509_NAME_get_text_by_NID(const X509_NAME *name,
|       |                           ^~~~~~~~~~~~~~~~~~~~~~~~~
| make[4]: *** [Makefile:2815: imap-send.o] Error 1
| make[3]: *** [Makefile:76: cgit] Error 2
| make[2]: *** [Makefile:82: test] Error 2

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/cgit_1.2.3+git20250818.80.3346409+git2.51.0-1_amd64-2026-04-19T13:25:44Z

Sebastian

Dear cgit maintainers,

I have cherry-picked a patch from upstream[1] which allows cgit to build
with both OpenSSL 3.x[2] and OpenSSL 4.0[3].

The FTBFS was caused by the vendored Git's imap-send.c using functions
removed in OpenSSL 4.0. The upstream patch rewrites those functions to use
a public API which has been available since OpenSSL 1.1.

I have attached the patch to this message. Please let me know if you need
anything else.

Best wishes,
Max

[1]:
https://github.com/git/git/commit/74137b733e59faaf3f3c6428af34c3798ce92757
[2]:
https://launchpad.net/~maxgmr/+archive/ubuntu/plusone/+sourcepub/18493847/+listing-archive-extra
[3]:
https://launchpad.net/~maxgmr/+archive/ubuntu/openssl4-transition/+sourcepub/18493848/+listing-archive-extra

control: tags -1 patch
control: forwarded -1 https://github.com/git/git/commit/74137b733e59faaf3f3c6428af34c3798ce92757

The fallout is the git part of cgit.

Sebastian

We believe that the bug you reported is fixed in the latest version of
cgit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1137601@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Peter Colberg <peter@colberg.org> (supplier of updated cgit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 04 Oct 2026 14:24:12 -0400
Source: cgit
Architecture: source
Version: 1.3.1+git2.54.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian cgit Maintainers <team+cgit@tracker.debian.org>
Changed-By: Peter Colberg <peter@colberg.org>
Closes: 1117011 1137601 1145103
Changes:
 cgit (1.3.1+git2.54.0-1) unstable; urgency=medium
 .
   * New upstream version (Closes: #1137601, #1145103)
   * Remove Priority field from debian/control
   * Bump Standards-Version to 4.7.4
   * Update debian/copyright for Perl to refer to GPL-1 instead of GPL
   * Drop redundant linker flag -Wl,--as-needed.
   * Upgrade debhelper compat level to 14
   * Fix rst2html template file not found.
     Thanks to Tilman Koschnick (Closes: #1117011)
   * Convert debian/watch to version 5
Checksums-Sha1:
 52465452527b3a82ebb25d8e7a331f63cedd4dce 2388 cgit_1.3.1+git2.54.0-1.dsc
 29a739063b869e12874d660d540e4503e6af3b53 8126372 cgit_1.3.1+git2.54.0.orig-git.tar.xz
 de33fc83d01dcc35f0e565d7b3a1b96a6d0ce7ab 92432 cgit_1.3.1+git2.54.0.orig.tar.xz
 013d5d7c95a96de6ab59b42aa89aa16afaa84912 20228 cgit_1.3.1+git2.54.0-1.debian.tar.xz
 194bbf7e7579800f200dd3f61912669fa664ca72 6058 cgit_1.3.1+git2.54.0-1_source.buildinfo
Checksums-Sha256:
 8c2cba09bd057cbc8bf3b638b7117da10a62014485132a1c0179c8a3ee0bbf11 2388 cgit_1.3.1+git2.54.0-1.dsc
 f689162364c10de79ef89aa8dbf48731eb057e34edbbd20aca510ce0154681a3 8126372 cgit_1.3.1+git2.54.0.orig-git.tar.xz
 c40fd71e120783d5e57d822208f3e17333cde2cd4baf3e7c8c75630b68afe12a 92432 cgit_1.3.1+git2.54.0.orig.tar.xz
 edb2cfdb7549f53203d4d7603dbf1f4f3cca835fad31d26919852a0496d4d4b5 20228 cgit_1.3.1+git2.54.0-1.debian.tar.xz
 56edcfac8316de345ccd6dedecb496de3d9ca6af94c723ea63df2a3313733981 6058 cgit_1.3.1+git2.54.0-1_source.buildinfo
Files:
 28d8eaab34dfd5c3577563fd51af164b 2388 net optional cgit_1.3.1+git2.54.0-1.dsc
 eb1137f556bd67cb4cea974275e51297 8126372 net optional cgit_1.3.1+git2.54.0.orig-git.tar.xz
 a72a9c1531b3b054f94f92c71d77ba6f 92432 net optional cgit_1.3.1+git2.54.0.orig.tar.xz
 dfc447b8841506449dd834bbce2941ae 20228 net optional cgit_1.3.1+git2.54.0-1.debian.tar.xz
 445f681b4dbebbe17a829d315efa698a 6058 net optional cgit_1.3.1+git2.54.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmDv50PAqYBQM7FKfdn4SqMkqMcsFAmrCnCYACgkQdn4SqMkq
McvBAg/8CazDaVzdF3/xp/T32s8dXEF7ryTCSDffvugl/urDpSicy5kelac18Ap0
hKUO4Eg2LiUVfeFWp8h/qHXSSiqT4daiXPI4GkTI7UZmcDr9YYUlqf9zThtxmGy1
OFJHCRuIuHv+l2nLBPgRQAsCPJfNVC6bzIsZAi4SAfDtJ/taBD84CgRb/U/8mgBo
xq5NnC+ppI6ncSbhjUjqe0ZYUP+xP/RG6L99DcEu4fK66lGwRId3HpWOnTVpw+E3
ZPNgvKTjZ4nZFYl1/dKFng3/oUCHBm7sjnGiKiDsHUd0rGo4mxge3XAQuJLXb/TK
x9T5ELWTKSW7EPTjh6LEFPZw5kCTU4yof5PnvRokjfWGsmrIVgLpnCdyziLy3tWw
7EkpVvSYUqBrbNdQpqt3iUvOnugRSL7rhZW1XmvzDxbxe7+9Pjtu+RGsCsUa/ze3
7i9sZcGHglhpKoybsbwDqpOK5zno30d3D0364qxPm7q78L4L7V5Fd9cdaRIMi88Q
Lr4Ri7jXtj/ZdIecGU61kj+bwwu5Y6jIb8npU6tdqAvsjYR7/Mx8vn8Fsha5ujlH
sDAlkfCUxI8NRyBqtMN8GIZFQVEnIuZvG0dMygTtnlG1zJNannKjYZZ93T3xmlSw
zfpHddKa5PWa2X1jz0K4z56shZgLCFugtXm9LdnV/pGm+3N3m68=
=xG5X
-----END PGP SIGNATURE-----