OpenSSL 4.0 is in experimental. This package fails to build against it:

| cc -DPACKAGE_NAME=\"rpki-client\" -DPACKAGE_TARNAME=\"rpki-client\" -DPACKAGE_VERSION=\"9.8\" -DPACKAGE_STRING=\"rpki-client\ 9.8\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"rpki-client\" -DVERSION=\"9.8\" -DSPT_TYPE=SPT_REUSEARGV -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DSIZEOF_TIME_T=8 -DHAVE_ENDIAN_H=1 -DHAVE_EXPLICIT_BZERO=1 -DHAVE_REALLOCARRAY=1 -DHAVE_SETGROUPS=1 -DHAVE_SETREGID=1 -DHAVE_SETRESGID=1 -DHAVE_SETREUID=1 -DHAVE_SETRESUID=1 -DHAVE_MEMRCHR=1 -DHAVE_STRLCAT=1 -DHAVE_STRLCPY=1 -DHAVE_PIPE2=1 -DHAVE_PPOLL=1 -DHAVE_ARC4RANDOM_UNIFORM=1 -DHAVE_INET_NET_PTON=1 -DHAVE_HOST_NAME_MAX=1 -DHAVE_FTS_H=1 -DHAVE_FTS_OPEN=1 -DHAVE_ERR_H=1 -DHAVE_OPENSSL_CMS_H=1 -DHAVE_OPENSSL_ERR_H=1 -DHAVE_OPENSSL_EVP_H=1 -DHAVE_OPENSSL_SSL_H=1 -DHAVE_OPENSSL_X509_H=1 -DHAVE_OPENSSL_X509V3_H=1 -DHAVE_LIBCRYPTO=1 -DHAVE_X509_UP_REF=1 -DHAVE_ASIDENTIFIERS_FREE=1 -DHAVE_IPADDRESSRANGE_FREE=1 -DHAVE_X509V3_ADDR_IS_CANONICAL=1 -DHAVE_X509V3_ASID_IS_CANONICAL=1 -DHAVE_TLS_H=1 -DHAVE_TLS_DEFAULT_CA_CERT_FILE=1 -DHAVE_TLS_CONFIG_SET_CA_MEM=1 -DHAVE_X509_GET0_UIDS=1 -DHAVE_X509_CRL_GET0_TBS_SIGALG=1 -DHAVE_EXPAT_H=1 -DHAVE_LIBEXPAT=1 -DHAVE_XML_PARSE=1 -DHAVE_XML_SETUSERDATA=1 -DHAVE_ZLIB_H=1 -DHAVE_LIBZ=1 -DHAVE_INFLATE=1 -DHAVE_INFLATEEND=1 -DHAVE_INFLATERESET=1 -DHAVE_LINUX_LANDLOCK_H=1 -DHAVE_LANDLOCK=1 -DRPKI_CLIENT_USER=\"_rpki-client\" -DRPKI_RSYNC_CMD=\"rsync\" -I. -I../../src  -I../../include -I../../src -Wdate-time -D_FORTIFY_SOURCE=2  -DOPENSSL_SUPPRESS_DEPRECATED    -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wshadow -Wpointer-arith -Wsign-compare -Werror-implicit-function-declaration -Wno-pointer-sign  -DRPKI_PATH_TAL_DIR=\"/etc/tals\" -DRPKI_PATH_BASE_DIR=\"/var/lib/rpki-client/cache\" -DRPKI_PATH_OUT_DIR=\"/var/lib/rpki-client\" -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/rpki-client-9.8=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_GNU_SOURCE     -c -o rpki_client-ccr.o `test -f 'ccr.c' || echo '../../src/'`ccr.c
| ../../src/ccr.c: In function ‘append_cached_vrp’:
| ../../src/ccr.c:402:22: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘struct asn1_string_st’}
|   402 |         ripa->address->flags |= ASN1_STRING_FLAG_BITS_LEFT | unused_bits;
|       |                      ^~
| ../../src/ccr.c:402:33: error: ‘ASN1_STRING_FLAG_BITS_LEFT’ undeclared (first use in this function)
|   402 |         ripa->address->flags |= ASN1_STRING_FLAG_BITS_LEFT | unused_bits;
|       |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
| ../../src/ccr.c:402:33: note: each undeclared identifier is reported only once for each function it appears in
| make[2]: *** [Makefile:629: rpki_client-ccr.o] Error 1
| make[2]: Leaving directory '/build/reproducible-path/rpki-client-9.8/build/src'
| make[1]: *** [Makefile:469: all-recursive] Error 1

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/rpki-client_9.8-1_amd64-2026-04-19T09:25:16Z

Sebastian

We believe that the bug you reported is fixed in the latest version of
rpki-client, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138379@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marco d'Itri <md@linux.it> (supplier of updated rpki-client package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 25 Aug 2026 00:20:47 +0200
Source: rpki-client
Architecture: source
Version: 9.9-1
Distribution: unstable
Urgency: medium
Maintainer: Marco d'Itri <md@linux.it>
Changed-By: Marco d'Itri <md@linux.it>
Closes: 1138379
Changes:
 rpki-client (9.9-1) unstable; urgency=medium
 .
   * New upstream release.
     + Add support for OpenSSL 4.0. (Closes: #1138379)
Checksums-Sha1:
 0116c7ea7583114ceb08999f1da582bd4ab08e7d 2234 rpki-client_9.9-1.dsc
 0c1350accbae1b6958a9cfeed707e49c061801b0 405768 rpki-client_9.9.orig.tar.xz
 1bc411bfa776b932502061479672902e6e0d4e8f 7448 rpki-client_9.9-1.debian.tar.xz
 462d14c521ceee0de7c23bf69bca289f41dd5f92 1153740 rpki-client_9.9-1.git.tar.xz
 a71de79095283e786cf9fa7663bfb2ce97d3e529 17668 rpki-client_9.9-1_source.buildinfo
Checksums-Sha256:
 119d26a253e2731e63461f581df81e7b73848bce0d1d553e05841109ad7514b9 2234 rpki-client_9.9-1.dsc
 b57780534d89c7ede26f10b64287c8f6118b24c8ddfb2d275849f965e31871ff 405768 rpki-client_9.9.orig.tar.xz
 a2dfbe2177356ecd0b407d9f57d2b9950453745b03c4449f9249149c82b319bb 7448 rpki-client_9.9-1.debian.tar.xz
 882e4f9eefc07f7087d61a3b5357ed4dc4247ea308b751b9232337dd786070ce 1153740 rpki-client_9.9-1.git.tar.xz
 4fff9d21e4f1737821bb5928bcda8413bbd9678ddfd1dafeb70a1869aa4ecce2 17668 rpki-client_9.9-1_source.buildinfo
Files:
 3a96af26cdd8fda74ccee1d7e36e87c4 2234 net optional rpki-client_9.9-1.dsc
 7a83d8dc77cf0eed6f352fc31e7ad302 405768 net optional rpki-client_9.9.orig.tar.xz
 cb6e755f6a4ca3f9d5fb01864fd7f160 7448 net optional rpki-client_9.9-1.debian.tar.xz
 2088af2989babd3c295979fcfb905780 1153740 net None rpki-client_9.9-1.git.tar.xz
 9314dae176347daec8d362971556fbd1 17668 net optional rpki-client_9.9-1_source.buildinfo
Git-Tag-Info: tag=d43e6fc97aa437423e3dbef159d5e0f46180c6c0 fp=272945cd836d38dfb7427e86cb3ec33ae1ded781
Git-Tag-Tagger: Marco d'Itri <md@linux.it>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqMxNoACgkQYG0ITkaD
wHn9tQ/+P/hT6hHQ34AvHmEmSdmlJeGkTbCqjdTbms5gtY/vEK7cfxcmmt2x9oEy
s/EZPn50Tc3dlBPxHfDv6Dw6d2l7IfkU7uEBuBig4zLchdCMNaFM/UyYjsu1z9by
Eb5KNceeLzYt77yGaQhZ3T2XljhkWwI1rkqP+37T2J40XPuMB4ERtVTVMGHs1rZP
mC7DGiBhJDnHCyJiNdkSqW0u6nCsVnawbbeHflLJxEvoxy8b64emQbCScrsawVQ7
QHdinEVltsuWeBNwOBY9xVnXLSFuK58xaZ8ObvLmjINNIF/+R2K1bCynK3JR8MDG
Lwwb0tyRwHyiX7hivx/RtdgtgIn8/NaV5kA5F0/f2OdDmJofbq1HYf80LI8NQbe5
btug5I/+kY+8CBTpKC6vHFCMnBv4sfjFIuQwopFxLt8yz1Ac9hjvTvn68qAZguWc
Wlh0z/iH0ztt26Vg+HcKBOiqTIq1ww9fgvZCISO7a+I6DIQ3UpJ03qvSR3hLqV1x
JQCUTNtDCT4ThBlw0cJisFDR3CtmxlEBYzEEwY+29IfyKfjhkj1HnwR4/kfGeN34
AC8Nl+5EhtY7Faaj2kAr7VxDY9cgXQ//Ig4bUQ5zfnjB9iU7f7K4BIBQUSZh0r4V
EJv4wpjDJDny6Ypx8HK7nSFZOkYTSarTRzefxLGInvLTjGIz4Vo=
=1pi6
-----END PGP SIGNATURE-----