OpenSSL 4.0 is in experimental. This package fails to build against it:
| libtool: compile: gcc -DPACKAGE_NAME=\"myproxy\" -DPACKAGE_TARNAME=\"myproxy\" -DPACKAGE_VERSION=\"6.2.20\" "-DPACKAGE_STRING=\"myproxy 6.2.20\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"myproxy\" -DVERSION=\"6.2.20\" -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_REGEX_H=1 -DHAVE_REGCOMP=1 -DHAVE_SETENV=1 -DHAVE_UNSETENV=1 -DHAVE_GETOPT_H=1 -DHAVE_GETOPT_LONG=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_SOCKLEN_T=1 -DHAVE_DECL_FACILITYNAMES=1 -DHAVE_GLOBUS_GSI_PROXY_HANDLE_SET_EXTENSIONS=1 -DHAVE_OCSP=1 -DHAVE_LIBSASL2=1 -DBUILD_GSSAPI_PLUGIN=1 -DHAVE_GSSAPI_H=1 -DHAVE_SECURITY_PAM_APPL_H=1 -DHAVE_LIBDL=1 -DHAVE_LIBPAM=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_PIDFILE=1 -DHAVE_LDAP_H=1 -DHAVE_LIBLBER=1 -DHAVE_LIBLDAP=1 -DHAVE_VOMS=1 -I. -I/usr/include/globus -I/usr/include -I/usr/include/voms -I/usr/include/glite/security/voms -I/usr/include -I/usr/include/sasl -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/myproxy-6.2.20=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c certauth_extensions.c -fPIC -DPIC -o .libs/certauth_extensions.o
| certauth_extensions.c: In function 'assign_serial_number':
| certauth_extensions.c:364:30: error: invalid use of incomplete typedef 'ASN1_INTEGER' {aka 'struct asn1_string_st'}
| 364 | serial = BN_bin2bn( current->data, current->length, serial );
| | ^~
| certauth_extensions.c:364:45: error: invalid use of incomplete typedef 'ASN1_INTEGER' {aka 'struct asn1_string_st'}
| 364 | serial = BN_bin2bn( current->data, current->length, serial );
| | ^~
| certauth_extensions.c: In function 'generate_certificate':
| certauth_extensions.c:525:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
| 525 | subject = X509_get_subject_name(cert);
| | ^
| certauth_extensions.c:543:10: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
| 543 | ne = X509_NAME_get_entry(subject, i);
| | ^
| certauth_extensions.c:544:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
| 544 | str = X509_NAME_ENTRY_get_data(ne);
| | ^
| certauth_extensions.c:545:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
| 545 | obj = X509_NAME_ENTRY_get_object(ne);
| | ^
| certauth_extensions.c:548:15: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
| 548 | (str->type == V_ASN1_PRINTABLESTRING)) {
| | ^~
| certauth_extensions.c:550:14: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
| 550 | str->type = V_ASN1_IA5STRING;
| | ^~
| certauth_extensions.c:553:15: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
| 553 | (str->type == V_ASN1_PRINTABLESTRING)) {
| | ^~
| certauth_extensions.c:555:14: error: invalid use of incomplete typedef 'ASN1_STRING' {aka 'struct asn1_string_st'}
| 555 | str->type = V_ASN1_IA5STRING;
| | ^~
| certauth_extensions.c: In function 'handle_certificate':
| certauth_extensions.c:1133:3: warning: 'RSA_get0_key' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
| 1133 | RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
| | ^~~~~~~~~~~~
| In file included from /usr/include/openssl/x509.h:38,
| from /usr/include/globus/globus_gsi_system_config.h:28,
| from myproxy_common.h:57,
| from certauth_extensions.c:6:
| /usr/include/openssl/rsa.h:228:28: note: declared here
| 228 | OSSL_DEPRECATEDIN_3_0 void RSA_get0_key(const RSA *r,
| | ^~~~~~~~~~~~
| certauth_extensions.c:1133:3: warning: 'EVP_PKEY_get0_RSA' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
| 1133 | RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
| | ^~~~~~~~~~~~
| In file included from /usr/include/openssl/x509.h:31:
| /usr/include/openssl/evp.h:1303:22: note: declared here
| 1303 | const struct rsa_st *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey);
| | ^~~~~~~~~~~~~~~~~
| certauth_extensions.c:1142:3: warning: 'RSA_size' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
| 1142 | keysize = RSA_size(EVP_PKEY_get0_RSA(pkey))*8;
| | ^~~~~~~
| /usr/include/openssl/rsa.h:215:27: note: declared here
| 215 | OSSL_DEPRECATEDIN_3_0 int RSA_size(const RSA *rsa);
| | ^~~~~~~~
| certauth_extensions.c:1142:3: warning: 'EVP_PKEY_get0_RSA' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
| 1142 | keysize = RSA_size(EVP_PKEY_get0_RSA(pkey))*8;
| | ^~~~~~~
| /usr/include/openssl/evp.h:1303:22: note: declared here
| 1303 | const struct rsa_st *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey);
| | ^~~~~~~~~~~~~~~~~
| certauth_extensions.c:1161:3: warning: 'ASN1_digest' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
| 1161 | ASN1_digest((i2d_of_void*)i2d_PUBKEY, EVP_sha1(), (char*)pkey, md, &md_len);
| | ^~~~~~~~~~~
| /usr/include/openssl/x509.h:828:5: note: declared here
| 828 | int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
| | ^~~~~~~~~~~
| make[2]: *** [Makefile:1237: certauth_extensions.lo] Error 1
|
Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/myproxy_6.2.20-1_amd64-2026-04-19T07:38:34Z
Sebastian
We believe that the bug you reported is fixed in the latest version of myproxy, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1138316@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Mattias Ellert <mattias.ellert@physics.uu.se> (supplier of updated myproxy package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Mon, 15 Jun 2026 11:08:04 +0200 Source: myproxy Architecture: source Version: 6.2.20-2 Distribution: unstable Urgency: medium Maintainer: Mattias Ellert <mattias.ellert@physics.uu.se> Changed-By: Mattias Ellert <mattias.ellert@physics.uu.se> Closes: 1138316 Changes: myproxy (6.2.20-2) unstable; urgency=medium . * Compile with OpenSSL 4 (Closes: #1138316) * Fix compiler warnings Checksums-Sha1: 2394cff0389463647a78681bd140ee096504f1c5 2654 myproxy_6.2.20-2.dsc 006e7e036e74abdccbc910a42f7bc081f1e74870 39136 myproxy_6.2.20-2.debian.tar.xz a75bec34de1666d08f65627ee3c259e840ea1c8e 11061 myproxy_6.2.20-2_amd64.buildinfo Checksums-Sha256: 16bd97a209e01292ebd2f4b07375822b7f50335206dc3e5f3f546ed1dae98fc4 2654 myproxy_6.2.20-2.dsc e41f92362b3cce2f0c49e6b66b282357a0ff38fe8aac446d6ea589e04d4170f2 39136 myproxy_6.2.20-2.debian.tar.xz aa361d6cbd181f9c3abb4ceddaf110b5d7307193a5c9be35a8ecf55bfef35d14 11061 myproxy_6.2.20-2_amd64.buildinfo Files: 5a8fad8a573b3fe02bfb6e82511e5944 2654 net optional myproxy_6.2.20-2.dsc ac59d747d0b9f326caf88c525d20c69a 39136 net optional myproxy_6.2.20-2.debian.tar.xz dbebb90640390d32970aefd67f7ebbd4 11061 net optional myproxy_6.2.20-2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE6hgwr99NQxrZ4RRS6K7C/zvhqUsFAmovxhkACgkQ6K7C/zvh qUvBwBAArUsCSSmY2qyqPgONwkyd99awK7SWM72CK/CyO143X7LRrfqUJWsLTqAA C6y5Q2nIj4gufI+QMhjQ1m0dpZ7blHCDQTDao+zHQABL+ViY9dNDd7kpoqM1S6ZQ +u3CZ3Pjn5RsjlwTcK3sLc1NAtWu4vNDkKmmPuwwsRq8AgzQLvE0c94XvDTwMs9r yilGAR3BLcbYgyYMvIOBnthzmzpE5rIBvIAC/CzAS6ysq92W+Ymi20m6oMmIRkeU KJ2OO4OEArU1k7ECDOxb0rWYqXCp3P0gIoxmF5OGPnnHSC6ALiaMT/3At29BgiDS 8vDHAKN/rwgmVKUKfVpDCZ5Fbakd7A7/xB7ybymClgM0rBpDM8VczqlTMSAHzxeG 8GHJTNR+3hJfW1IUPvBZlkjxJaQzSm8PCalnbwa7brZd7X/VIWx2QlYvvR0D6+CN MkbUYt9KFdcALyxpM/9KpYpKiipcn43ARG0TRvDoIlEM8238U8D7qUwAixbpJUk0 Ye4phCWMlssdgSVve6a23HmL1H72KjNpJ1hCuURf4Rwzqq9/qxIeZ6P+8GmLzu8W 448By5swNqsPFGoZRqqAWY8BnNDpY7SCNmJ72rj7NnWbZMLC4vpLC7zsU7d4NLqK zqaNeGq6LDTeINzB0pINOUAXnIivGvGcErNppMA8TpfS0PC1Zmo= =HzqD -----END PGP SIGNATURE-----
It appears it compiles now but the testsuite says no: | FAIL: myproxy-test-wrapper | ========================== | | Possible precedence problem between ! and pattern match (m//) at /build/reproducible-path/myproxy-6.2.20/myproxy-test line 1229. | Possible precedence problem between ! and pattern match (m//) at /build/reproducible-path/myproxy-6.2.20/myproxy-test line 1251. | anonymous retrievers allowed | MyProxy v6.2 Dec 2025 PAM SASL KRB5 LDAP VOMS OCSP | Attempting to connect to 127.0.0.1:43339 | Successfully connected to localhost:43339 | | User Cert File: /tmp/x509up_u1000 | User Key File: /tmp/x509up_u1000 | | Trusted CA Cert Dir: /tmp/68Wk0_HRpy/privcerts.687877/grid-security | | Output File: /tmp/myproxy-proxy.1000.687940 | Your identity: /CN=MyProxy Test User | Creating proxy ...........+..+..........+..+++++++++++++++++++++++++++++++++++++++*....+.+...+.....+...+...+..........+..+.........+.+............+......+.....+.......+...+.....+.+...+...+.. ......+.......+..+...+.......+++++++++++++++++++++++++++++++++++++++*.....+............+...+......+.....+....+...+...............+...+.....+.+......+.......................+....+...+.....+.. .......+......+....+......+........+.+...+......+..............+...+...+.+...+..+...+.......+......+.....+.......+...+..+.+..+....+.........+......+......+..............+.+..+.......+....... .......+......+...+..........+...+...+.........+..+....+..+............+.......+...........+.............+.....+.+...........+.......+...............+...+.....+.........+...+.......+.....+.. ....+............+.+.........+.................+....+......+......+..+...+....+.....................++++++ | ..+++++++++++++++++++++++++++++++++++++++*..+.+......+++++++++++++++++++++++++++++++++++++++*..+...+.....++++++ | Done | Proxy Verify OK | Your proxy is valid until: Sun Aug 16 21:24:44 2026 | Expecting non-standard server DN "/CN=MyProxy Test User" | using trusted certificates directory /tmp/68Wk0_HRpy/privcerts.687877/grid-security | Using Proxy file (/tmp/myproxy-proxy.1000.687940) | server name: /CN=MyProxy Test User | checking that server name is acceptable... | server name matches "/CN=MyProxy Test User" | authenticated server name is acceptable | globus_gsi_cred_set_key() failed | globus_credential: Error with credential: Couldn't get length of DER encoding for private key | OpenSSL Error: ../crypto/asn1/i2d_evp.c:127: in library: asn1 encoding routines, function (null): unsupported public key type | Error delegating credentials: globus_gsi_cred_set_key() failed | globus_credential: Error with credential: Couldn't get length of DER encoding for private key | OpenSSL Error: ../crypto/asn1/i2d_evp.c:127: in library: asn1 encoding routines, function (null): unsupported public key type | | MyProxy Test 1 (store credential with default name): FAILED | Skipping remaining tests. | MyProxy Tests Complete: 0 tests passed, 1 tests failed | FAIL myproxy-test-wrapper (exit status: 1) Might there be something missing? Sebastian
tor 2026-08-20 klockan 22:32 +0200 skrev Sebastian Andrzej Siewior: I can reproduce your result if I build myproxy against openssl 4 and using the package's other dependencies from testing. However, many of the dependencies in turn depend on openssl themselves, so this results binaries that use both openssl 4 (from the compilation) and openssl 3 (from dependencies) at the same time. This causes breakage. If I first rebuild the depenencies with openssl 4 and then build mypraxy using these packages the package builds fine, including the tests. So there is no bug here, just a package build order issue. Mattias Ellert