OpenSSL 4.0 is in experimental. This package fails to build against it:

| [ 55%] Building C object ykcs11/CMakeFiles/ykcs11.dir/openssl_utils.c.o
| cd /build/reproducible-path/yubico-piv-tool-2.7.2/obj-x86_64-linux-gnu/ykcs11 && /usr/bin/cc -DCRYPTOKI_EXPORTS -DHAVE_EXPLICIT_BZERO -DOPENSSL_API_COMPAT=0x10000000L -I/build/reproducible-path/yubico-piv-tool-2.7.2/lib -I/build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/yubico-piv-tool-2.7.2=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -pthread -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Werror -Wno-missing-braces -Wformat -Wformat-security -Wshadow -Wpointer-arith -Wmissing-prototypes -Wbad-function-cast -fstack-protector-all -Wno-pointer-sign -Wno-unused-result -I/usr/include -fvisibility=hidden -std=gnu11 -fPIC -DSTATIC  -MD -MT ykcs11/CMakeFiles/ykcs11.dir/openssl_utils.c.o -MF CMakeFiles/ykcs11.dir/openssl_utils.c.o.d -o CMakeFiles/ykcs11.dir/openssl_utils.c.o -c /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c
| /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c: In function ‘do_sign_empty_cert’:
| /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c:178:30: error: passing argument 1 of ‘X509_NAME_add_entry_by_txt’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|   178 |   X509_NAME_add_entry_by_txt(X509_get_issuer_name(*cert), "CN", MBSTRING_ASC, (const unsigned char*)cn, -1, -1, 0);
|       |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~
| In file included from /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_types.h:35,
|                  from /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.h:34,
|                  from /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c:31:
| /usr/include/openssl/x509.h:1072:43: note: expected ‘X509_NAME *’ {aka ‘struct X509_name_st *’} but argument is of type ‘const X509_NAME *’ {aka ‘const struct X509_name_st *’}
|  1072 | int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
|       |                                ~~~~~~~~~~~^~~~
| /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c:179:30: error: passing argument 1 of ‘X509_NAME_add_entry_by_txt’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|   179 |   X509_NAME_add_entry_by_txt(X509_get_subject_name(*cert), "CN", MBSTRING_ASC, (const unsigned char*)cn, -1, -1, 0);
|       |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
| /usr/include/openssl/x509.h:1072:43: note: expected ‘X509_NAME *’ {aka ‘struct X509_name_st *’} but argument is of type ‘const X509_NAME *’ {aka ‘const struct X509_name_st *’}
|  1072 | int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
|       |                                ~~~~~~~~~~~^~~~
| /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c: In function ‘do_parse_attestation’:
| /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c:358:25: error: initialization discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|   358 |   X509_EXTENSION *ext = X509_get_ext(cert, pos);
|       |                         ^~~~~~~~~~~~
| /build/reproducible-path/yubico-piv-tool-2.7.2/ykcs11/openssl_utils.c:362:28: error: initialization discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|   362 |   ASN1_OCTET_STRING *oct = X509_EXTENSION_get_data(ext);
|       |                            ^~~~~~~~~~~~~~~~~~~~~~~
| cc1: all warnings being treated as errors
| make[3]: *** [ykcs11/CMakeFiles/ykcs11.dir/build.make:138: ykcs11/CMakeFiles/ykcs11.dir/openssl_utils.c.o] Error 1

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/yubico-piv-tool_2.7.2-1_amd64-2026-04-19T12:19:05Z

Sebastian

Dear yubico-piv-tool maintainers,

Upstream [1] developed a patch that allows yubico-piv-tool to build with
both OpenSSL 3.x and OpenSSL 4.0. I verified that both builds succeed [2].

The FTBFS was caused by several OpenSSL functions now returning const
pointers. The patch updates the relevant call sites to match this change,
adding const qualifiers or casting pointer types accordingly.

I have attached the patch to this message. Please let me know if you need
anything else.

Best wishes,
Ruan

[1]: https://github.com/Yubico/yubico-piv-tool/pull/583
[2]:
https://launchpad.net/~ruancomelli/+archive/ubuntu/fix-lp2154946/+sourcepub/18609375/+listing-archive-extra