OpenSSL 4.0 is in experimental. This package fails to build against it:

| libtool: compile:  gcc -DPACKAGE_NAME=\"libest\" -DPACKAGE_TARNAME=\"libest\" -DPACKAGE_VERSION=\"3.2.0p\" "-DPACKAGE_STRING=\"libest 3.2.0p\"" -DPACKAGE_BUGREPORT=\"libest-dev\" -DPACKAGE_URL=\"\" -DPACKAGE=\"libest\" -DVERSION=\"3.2.0p\" -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_LIBDL=1 -DENABLE_BRSKI=1 -DHAVE_LIBPTHREAD=1 -DHAVE_LIBCRYPTO=1 -DHAVE_LIBSSL=1 -DHAVE_LIBCRYPTO=1 -I. -Wdate-time -D_FORTIFY_SOURCE=2 -I/usr/local/ssl/include -I../.. -I/build/reproducible-path/libest-3.2.0+ds/safe_c_stub/include -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/libest-3.2.0+ds=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -I/usr/local/ssl/include -Wall -I/build/reproducible-path/libest-3.2.0+ds/safe_c_stub/include -c est_client.c  -fPIC -DPIC -o .libs/est_client.o
| est_client.c: In function 'populate_x509_request':
| est_client.c:125:10: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   125 |     subj = X509_REQ_get_subject_name(req);
|       |          ^
| est_client.c: In function 'est_client_verifyhost':
| est_client.c:2638:14: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|  2638 |         name = X509_get_subject_name(server_cert);
|       |              ^
| est_client.c:2650:17: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|  2650 |             tmp = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
|       |                 ^
| est_client.c: In function 'est_client_enable_srp':
| est_client.c:4221:5: warning: 'X509_STORE_get0_objects' is deprecated: Since OpenSSL 4.0;Use X509_STORE_get1_objects [-Wdeprecated-declarations]
|  4221 |     store_cert_cnt = sk_X509_OBJECT_num(X509_STORE_get0_objects(store));
|       |     ^~~~~~~~~~~~~~
| In file included from /usr/include/openssl/x509.h:494,
|                  from /usr/include/openssl/ssl.h:34,
|                  from est_client.c:34:
| /usr/include/openssl/x509_vfy.h:527:24: note: declared here
|   527 | STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(const X509_STORE *xs);
|       |                        ^~~~~~~~~~~~~~~~~~~~~~~
| est_client.c:4239:5: warning: 'SSL_CTX_set_srp_username' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  4239 |     if (!SSL_CTX_set_srp_username(ctx->ssl_ctx, uid)) {
|       |     ^~
| /usr/include/openssl/ssl.h:1963:27: note: declared here
|  1963 | OSSL_DEPRECATEDIN_3_0 int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name);
|       |                           ^~~~~~~~~~~~~~~~~~~~~~~~
| est_client.c:4244:5: warning: 'SSL_CTX_set_srp_password' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  4244 |     if (!SSL_CTX_set_srp_password(ctx->ssl_ctx, pwd)) {
|       |     ^~
| /usr/include/openssl/ssl.h:1964:27: note: declared here
|  1964 | OSSL_DEPRECATEDIN_3_0 int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password);
|       |                           ^~~~~~~~~~~~~~~~~~~~~~~~
| est_client.c:4249:5: warning: 'SSL_CTX_set_srp_strength' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
|  4249 |     SSL_CTX_set_srp_strength(ctx->ssl_ctx, strength);
|       |     ^~~~~~~~~~~~~~~~~~~~~~~~
| /usr/include/openssl/ssl.h:1965:27: note: declared here
|  1965 | OSSL_DEPRECATEDIN_3_0 int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength);
|       |                           ^~~~~~~~~~~~~~~~~~~~~~~~
| est_client.c: In function 'verify_voucher':
| est_client.c:5314:67: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
|  5314 |     ctx->brski_retrieved_voucher = pkcs7->d.sign->contents->d.data->data;
|       |                                                                   ^~
| est_client.c:5315:71: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
|  5315 |     ctx->brski_retrieved_voucher_len = pkcs7->d.sign->contents->d.data->length;
|       |                                                                       ^~
| In file included from est_client.c:39:
| est_client.c:5318:49: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
|  5318 |                  pkcs7->d.sign->contents->d.data->data);
|       |                                                 ^~
| est_locl.h:636:39: note: in definition of macro 'EST_LOG_INFO'
|   636 |                 __func__, __LINE__, ##args); \
|       |                                       ^~~~
| make[3]: *** [Makefile:517: est_client.lo] Error 1


Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/libest_3.2.0+ds-1.1_amd64-2026-04-19T13:14:22Z

Sebastian

Thanks for the heads up!

Honestly that does not sound too bad; I will prepare a patch to work
around this. Might as well also remove some of the warnings above while
at it.

I do not think Cisco cares about libest anymore but we can keep it alive.

I ran into this FTBFS as well and have a patch that replaces direct
access on the opaque struts and keeps the old behavior under
HAVE_OLD_OPENSSL. I didn't fix any of the warnings, but hopefully this
will get the package working again.

The patch has also been forwarded upstream:
https://github.com/cisco/libest/pull/136

Attached the patch this time.

Apologies, I sent this patch prematurely. While it fixed a round of
compilation errors, it is insufficient to get all the example programs
building and linking correctly.

I will submit additional patches as soon as I am able.

As promised, here are updated patches, which fully replace the earlier
one. This is more extensive than I was expecting, but I was able to
build the entire package successfully.