#1138316 myproxy: FTBFS with openssl 4.0

Package:
myproxy
Source:
myproxy
Description:
Credential Management Service Client
Submitter:
Sebastian Andrzej Siewior
Date:
2026-08-24 12:23:02 UTC
Severity:
normal
Tags:
#1138316#5
Date:
2026-05-30 15:52:18 UTC
From:
To:
OpenSSL 4.0 is in experimental. This package fails to build against it:

| libtool: compile:  gcc -DPACKAGE_NAME=\"myproxy\" -DPACKAGE_TARNAME=\"myproxy\" -DPACKAGE_VERSION=\"6.2.20\" "-DPACKAGE_STRING=\"myproxy 6.2.20\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"myproxy\" -DVERSION=\"6.2.20\" -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_REGEX_H=1 -DHAVE_REGCOMP=1 -DHAVE_SETENV=1 -DHAVE_UNSETENV=1 -DHAVE_GETOPT_H=1 -DHAVE_GETOPT_LONG=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_SOCKLEN_T=1 -DHAVE_DECL_FACILITYNAMES=1 -DHAVE_GLOBUS_GSI_PROXY_HANDLE_SET_EXTENSIONS=1 -DHAVE_OCSP=1 -DHAVE_LIBSASL2=1 -DBUILD_GSSAPI_PLUGIN=1 -DHAVE_GSSAPI_H=1 -DHAVE_SECURITY_PAM_APPL_H=1 -DHAVE_LIBDL=1 -DHAVE_LIBPAM=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_PIDFILE=1 -DHAVE_LDAP_H=1 -DHAVE_LIBLBER=1 -DHAVE_LIBLDAP=1 -DHAVE_VOMS=1 -I. -I/usr/include/globus -I/usr/include -I/usr/include/voms -I/usr/include/glite/security/voms -I/usr/include -I/usr/include/sasl -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/myproxy-6.2.20=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c certauth_extensions.c  -fPIC -DPIC -o .libs/certauth_extensions.o
| certauth_extensions.c: In function 'assign_serial_number':
| certauth_extensions.c:364:30: error: invalid use of incomplete typedef 'ASN1_INTEGER' {aka 'struct asn1_string_st'}
|   364 |   serial = BN_bin2bn( current->data, current->length, serial );
|       |                              ^~
| certauth_extensions.c:364:45: error: invalid use of incomplete typedef 'ASN1_INTEGER' {aka 'struct asn1_string_st'}
|   364 |   serial = BN_bin2bn( current->data, current->length, serial );
|       |                                             ^~
| certauth_extensions.c: In function 'generate_certificate':
| certauth_extensions.c:525:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   525 |   subject = X509_get_subject_name(cert);
|       |           ^
| certauth_extensions.c:543:10: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   543 |       ne = X509_NAME_get_entry(subject, i);
|       |          ^
| certauth_extensions.c:544:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   544 |       str = X509_NAME_ENTRY_get_data(ne);
|       |           ^
| certauth_extensions.c:545:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   545 |       obj = X509_NAME_ENTRY_get_object(ne);
|       |           ^
| certauth_extensions.c:548:15: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
|   548 |           (str->type == V_ASN1_PRINTABLESTRING)) {
|       |               ^~
| certauth_extensions.c:550:14: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
|   550 |           str->type = V_ASN1_IA5STRING;
|       |              ^~
| certauth_extensions.c:553:15: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
|   553 |           (str->type == V_ASN1_PRINTABLESTRING)) {
|       |               ^~
| certauth_extensions.c:555:14: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
|   555 |           str->type = V_ASN1_IA5STRING;
|       |              ^~
| certauth_extensions.c: In function 'handle_certificate':
| certauth_extensions.c:1133:3: warning: 'RSA_get0_key' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1133 |   RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
|       |   ^~~~~~~~~~~~
| In file included from /usr/include/openssl/x509.h:38,
|                  from /usr/include/globus/globus_gsi_system_config.h:28,
|                  from myproxy_common.h:57,
|                  from certauth_extensions.c:6:
| /usr/include/openssl/rsa.h:228:28: note: declared here
|   228 | OSSL_DEPRECATEDIN_3_0 void RSA_get0_key(const RSA *r,
|       |                            ^~~~~~~~~~~~
| certauth_extensions.c:1133:3: warning: 'EVP_PKEY_get0_RSA' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1133 |   RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
|       |   ^~~~~~~~~~~~
| In file included from /usr/include/openssl/x509.h:31:
| /usr/include/openssl/evp.h:1303:22: note: declared here
|  1303 | const struct rsa_st *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey);
|       |                      ^~~~~~~~~~~~~~~~~
| certauth_extensions.c:1142:3: warning: 'RSA_size' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1142 |   keysize = RSA_size(EVP_PKEY_get0_RSA(pkey))*8;
|       |   ^~~~~~~
| /usr/include/openssl/rsa.h:215:27: note: declared here
|   215 | OSSL_DEPRECATEDIN_3_0 int RSA_size(const RSA *rsa);
|       |                           ^~~~~~~~
| certauth_extensions.c:1142:3: warning: 'EVP_PKEY_get0_RSA' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1142 |   keysize = RSA_size(EVP_PKEY_get0_RSA(pkey))*8;
|       |   ^~~~~~~
| /usr/include/openssl/evp.h:1303:22: note: declared here
|  1303 | const struct rsa_st *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey);
|       |                      ^~~~~~~~~~~~~~~~~
| certauth_extensions.c:1161:3: warning: 'ASN1_digest' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  1161 |   ASN1_digest((i2d_of_void*)i2d_PUBKEY, EVP_sha1(), (char*)pkey, md, &md_len);
|       |   ^~~~~~~~~~~
| /usr/include/openssl/x509.h:828:5: note: declared here
|   828 | int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
|       |     ^~~~~~~~~~~
| make[2]: *** [Makefile:1237: certauth_extensions.lo] Error 1
|

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/myproxy_6.2.20-1_amd64-2026-04-19T07:38:34Z

Sebastian

#1138316#12
Date:
2026-06-15 09:49:20 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
myproxy, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138316@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mattias Ellert <mattias.ellert@physics.uu.se> (supplier of updated myproxy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 15 Jun 2026 11:08:04 +0200
Source: myproxy
Architecture: source
Version: 6.2.20-2
Distribution: unstable
Urgency: medium
Maintainer: Mattias Ellert <mattias.ellert@physics.uu.se>
Changed-By: Mattias Ellert <mattias.ellert@physics.uu.se>
Closes: 1138316
Changes:
 myproxy (6.2.20-2) unstable; urgency=medium
 .
   * Compile with OpenSSL 4 (Closes: #1138316)
   * Fix compiler warnings
Checksums-Sha1:
 2394cff0389463647a78681bd140ee096504f1c5 2654 myproxy_6.2.20-2.dsc
 006e7e036e74abdccbc910a42f7bc081f1e74870 39136 myproxy_6.2.20-2.debian.tar.xz
 a75bec34de1666d08f65627ee3c259e840ea1c8e 11061 myproxy_6.2.20-2_amd64.buildinfo
Checksums-Sha256:
 16bd97a209e01292ebd2f4b07375822b7f50335206dc3e5f3f546ed1dae98fc4 2654 myproxy_6.2.20-2.dsc
 e41f92362b3cce2f0c49e6b66b282357a0ff38fe8aac446d6ea589e04d4170f2 39136 myproxy_6.2.20-2.debian.tar.xz
 aa361d6cbd181f9c3abb4ceddaf110b5d7307193a5c9be35a8ecf55bfef35d14 11061 myproxy_6.2.20-2_amd64.buildinfo
Files:
 5a8fad8a573b3fe02bfb6e82511e5944 2654 net optional myproxy_6.2.20-2.dsc
 ac59d747d0b9f326caf88c525d20c69a 39136 net optional myproxy_6.2.20-2.debian.tar.xz
 dbebb90640390d32970aefd67f7ebbd4 11061 net optional myproxy_6.2.20-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE6hgwr99NQxrZ4RRS6K7C/zvhqUsFAmovxhkACgkQ6K7C/zvh
qUvBwBAArUsCSSmY2qyqPgONwkyd99awK7SWM72CK/CyO143X7LRrfqUJWsLTqAA
C6y5Q2nIj4gufI+QMhjQ1m0dpZ7blHCDQTDao+zHQABL+ViY9dNDd7kpoqM1S6ZQ
+u3CZ3Pjn5RsjlwTcK3sLc1NAtWu4vNDkKmmPuwwsRq8AgzQLvE0c94XvDTwMs9r
yilGAR3BLcbYgyYMvIOBnthzmzpE5rIBvIAC/CzAS6ysq92W+Ymi20m6oMmIRkeU
KJ2OO4OEArU1k7ECDOxb0rWYqXCp3P0gIoxmF5OGPnnHSC6ALiaMT/3At29BgiDS
8vDHAKN/rwgmVKUKfVpDCZ5Fbakd7A7/xB7ybymClgM0rBpDM8VczqlTMSAHzxeG
8GHJTNR+3hJfW1IUPvBZlkjxJaQzSm8PCalnbwa7brZd7X/VIWx2QlYvvR0D6+CN
MkbUYt9KFdcALyxpM/9KpYpKiipcn43ARG0TRvDoIlEM8238U8D7qUwAixbpJUk0
Ye4phCWMlssdgSVve6a23HmL1H72KjNpJ1hCuURf4Rwzqq9/qxIeZ6P+8GmLzu8W
448By5swNqsPFGoZRqqAWY8BnNDpY7SCNmJ72rj7NnWbZMLC4vpLC7zsU7d4NLqK
zqaNeGq6LDTeINzB0pINOUAXnIivGvGcErNppMA8TpfS0PC1Zmo=
=HzqD
-----END PGP SIGNATURE-----

#1138316#25
Date:
2026-08-20 20:32:50 UTC
From:
To:
It appears it compiles now but the testsuite says no:

| FAIL: myproxy-test-wrapper
| ==========================
|
| Possible precedence problem between ! and pattern match (m//) at /build/reproducible-path/myproxy-6.2.20/myproxy-test line 1229.
| Possible precedence problem between ! and pattern match (m//) at /build/reproducible-path/myproxy-6.2.20/myproxy-test line 1251.
| anonymous retrievers allowed
| MyProxy v6.2 Dec 2025 PAM SASL KRB5 LDAP VOMS OCSP
| Attempting to connect to 127.0.0.1:43339
| Successfully connected to localhost:43339
|
| User Cert File: /tmp/x509up_u1000
| User Key File: /tmp/x509up_u1000
|
| Trusted CA Cert Dir: /tmp/68Wk0_HRpy/privcerts.687877/grid-security
|
| Output File: /tmp/myproxy-proxy.1000.687940
| Your identity: /CN=MyProxy Test User
| Creating proxy ...........+..+..........+..+++++++++++++++++++++++++++++++++++++++*....+.+...+.....+...+...+..........+..+.........+.+............+......+.....+.......+...+.....+.+...+...+.. ......+.......+..+...+.......+++++++++++++++++++++++++++++++++++++++*.....+............+...+......+.....+....+...+...............+...+.....+.+......+.......................+....+...+.....+.. .......+......+....+......+........+.+...+......+..............+...+...+.+...+..+...+.......+......+.....+.......+...+..+.+..+....+.........+......+......+..............+.+..+.......+....... .......+......+...+..........+...+...+.........+..+....+..+............+.......+...........+.............+.....+.+...........+.......+...............+...+.....+.........+...+.......+.....+.. ....+............+.+.........+.................+....+......+......+..+...+....+.....................++++++
| ..+++++++++++++++++++++++++++++++++++++++*..+.+......+++++++++++++++++++++++++++++++++++++++*..+...+.....++++++
|  Done
| Proxy Verify OK
| Your proxy is valid until: Sun Aug 16 21:24:44 2026
| Expecting non-standard server DN "/CN=MyProxy Test User"
| using trusted certificates directory /tmp/68Wk0_HRpy/privcerts.687877/grid-security
| Using Proxy file (/tmp/myproxy-proxy.1000.687940)
| server name: /CN=MyProxy Test User
| checking that server name is acceptable...
| server name matches "/CN=MyProxy Test User"
| authenticated server name is acceptable
| globus_gsi_cred_set_key() failed
| globus_credential: Error with credential: Couldn't get length of DER encoding for private key
| OpenSSL Error: ../crypto/asn1/i2d_evp.c:127: in library: asn1 encoding routines, function (null): unsupported public key type
| Error delegating credentials: globus_gsi_cred_set_key() failed
| globus_credential: Error with credential: Couldn't get length of DER encoding for private key
| OpenSSL Error: ../crypto/asn1/i2d_evp.c:127: in library: asn1 encoding routines, function (null): unsupported public key type
|
| MyProxy Test 1 (store credential with default name): FAILED
| Skipping remaining tests.
| MyProxy Tests Complete: 0 tests passed, 1 tests failed
| FAIL myproxy-test-wrapper (exit status: 1)

Might there be something missing?

Sebastian

#1138316#30
Date:
2026-08-24 12:21:10 UTC
From:
To:
tor 2026-08-20 klockan 22:32 +0200 skrev Sebastian Andrzej Siewior:

I can reproduce your result if I build myproxy against openssl 4 and
using the package's other dependencies from testing. However, many of
the dependencies in turn depend on openssl themselves, so this results
binaries that use both openssl 4 (from the compilation) and openssl 3
(from dependencies) at the same time. This causes breakage. If I first
rebuild the depenencies with openssl 4 and then build mypraxy using
these packages the package builds fine, including the tests.

So there is no bug here, just a package build order issue.

Mattias Ellert