#1138452 fort-validator: FTBFS with openssl 4.0

Package:
fort-validator
Source:
fort-validator
Description:
RPKI validator and RTR server
Submitter:
Sebastian Andrzej Siewior
Date:
2026-08-08 00:41:01 UTC
Severity:
normal
Tags:
#1138452#5
Date:
2026-05-30 16:17:21 UTC
From:
To:
OpenSSL 4.0 is in experimental. This package fails to build against it:
| gcc -DHAVE_CONFIG_H -I.   -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wpedantic -std=c99 -D_DEFAULT_SOURCE=1 -D_XOPEN_SOURCE=700 -D_BSD_SOURCE=1 -O2 -g  -I/usr/include/libxml2 -DBACKTRACE_ENABLED -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/fort-validator-1.6.7=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o fort-extension.o `test -f 'extension.c' || echo './'`extension.c
| extension.c: In function ‘ku2json’:
| extension.c:127:15: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   127 |         if (ku->length < 1 || 2 < ku->length)
|       |               ^~
| extension.c:127:37: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   127 |         if (ku->length < 1 || 2 < ku->length)
|       |                                     ^~
| extension.c:130:24: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   130 |         memcpy(data, ku->data, ku->length);
|       |                        ^~
| extension.c:130:34: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   130 |         memcpy(data, ku->data, ku->length);
|       |                                  ^~
| extension.c: In function ‘p2json’:
| extension.c:463:23: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   463 |         memcpy(bin, ap->data, ap->length);
|       |                       ^~
| extension.c:463:33: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   463 |         memcpy(bin, ap->data, ap->length);
|       |                                 ^~
| extension.c:467:24: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   467 |         length = 8 * ap->length;
|       |                        ^~
| extension.c:468:15: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   468 |         if (ap->flags & ASN1_STRING_FLAG_BITS_LEFT)
|       |               ^~
| extension.c:468:25: error: ‘ASN1_STRING_FLAG_BITS_LEFT’ undeclared (first use in this function)
|   468 |         if (ap->flags & ASN1_STRING_FLAG_BITS_LEFT)
|       |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~
| extension.c:468:25: note: each undeclared identifier is reported only once for each function it appears in
| extension.c:469:29: error: invalid use of incomplete typedef ‘ASN1_BIT_STRING’ {aka ‘const struct asn1_string_st’}
|   469 |                 length -= ap->flags & 7;
|       |                             ^~
| extension.c: In function ‘iaf2json’:
| extension.c:550:15: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   550 |         if (af->length != 2)
|       |               ^~
| extension.c:553:15: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   553 |         if (af->data[0] == 0 && af->data[1] == 1) {
|       |               ^~
| extension.c:553:35: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   553 |         if (af->data[0] == 0 && af->data[1] == 1) {
|       |                                   ^~
| extension.c:556:22: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   556 |         } else if (af->data[0] == 0 && af->data[1] == 2) {
|       |                      ^~
| extension.c:556:42: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   556 |         } else if (af->data[0] == 0 && af->data[1] == 2) {
|       |                                          ^~
| extension.c: In function ‘validate_public_key_hash’:
| extension.c:973:16: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
|   973 |         pubkey = X509_get_X509_PUBKEY(cert);
|       |                ^
| extension.c:982:17: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   982 |         if (hash->length < 0 || SIZE_MAX < hash->length) {
|       |                 ^~
| extension.c:982:48: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   982 |         if (hash->length < 0 || SIZE_MAX < hash->length) {
|       |                                                ^~
| extension.c:984:42: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   984 |                     ext_ski()->name, hash->length, SIZE_MAX);
|       |                                          ^~
| extension.c:991:43: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   991 |         error = hash_validate("sha1", hash->data, hash->length, spk, spk_len);
|       |                                           ^~
| extension.c:991:55: error: invalid use of incomplete typedef ‘ASN1_OCTET_STRING’ {aka ‘struct asn1_string_st’}
|   991 |         error = hash_validate("sha1", hash->data, hash->length, spk, spk_len);
|       |                                                       ^~
| make[3]: *** [Makefile:1671: fort-extension.o] Error 1

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/fort-validator_1.6.7-1_amd64-2026-04-19T08:43:51Z

Sebastian
#1138452#12
Date:
2026-07-17 13:49:09 UTC
From:
To:
Dear Maintainer,

There is a fix available upstream https://github.com/NICMx/FORT-validator/commit/c6523378fa6bd4f4cf2540e28cfb5e3e55ab36cd
#1138452#19
Date:
2026-08-07 16:00:48 UTC
From:
To:
Dear Maintainer,

The next release fixes the build issue. I have picked 2 patches and tested them.

Kernel: Linux 6.8.0-124-generic (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
#1138452#24
Date:
2026-08-08 00:39:17 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
fort-validator, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138452@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marco d'Itri <md@linux.it> (supplier of updated fort-validator package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 08 Aug 2026 01:56:43 +0200
Source: fort-validator
Architecture: source
Version: 1.7.0.experimental-1
Distribution: unstable
Urgency: medium
Maintainer: Marco d'Itri <md@linux.it>
Changed-By: Marco d'Itri <md@linux.it>
Closes: 1138452
Changes:
 fort-validator (1.7.0.experimental-1) unstable; urgency=medium
 .
   * New upstream release.
   * Support openssl 4.0. (Closes: #1138452)
Checksums-Sha1:
 6e4f97ec2a5dafe50b628b620e3358e08578761a 2422 fort-validator_1.7.0.experimental-1.dsc
 e3d3489a47b8c8196dac84117e19c2e79908f673 314064 fort-validator_1.7.0.experimental.orig.tar.xz
 da024099333bcfc0f386a664065e7b80816d072b 5060 fort-validator_1.7.0.experimental-1.debian.tar.xz
 d8cefa84d1a43e6ea4e8cf854eabd96ae4043d11 832572 fort-validator_1.7.0.experimental-1.git.tar.xz
 a98ee1e8487fbce6e127534688f0c84177881596 17632 fort-validator_1.7.0.experimental-1_source.buildinfo
Checksums-Sha256:
 4d80be3c946ed83c09075eae970e46fd24dbc942ac4090a4a9e707a90eca252f 2422 fort-validator_1.7.0.experimental-1.dsc
 0bb50d7fbd1b0d0f3a1260b4bf340781e1998950288379b27c8717c82db0a8ae 314064 fort-validator_1.7.0.experimental.orig.tar.xz
 d2a919f0fc303e62356e1a5c5cdd7234417b179532245622f2d14f6dc58798b9 5060 fort-validator_1.7.0.experimental-1.debian.tar.xz
 712d365da05a0879e88cbdf026e66eb4cc40f8a803115c09fec0670372cbae93 832572 fort-validator_1.7.0.experimental-1.git.tar.xz
 af02fc56d5854f93fcb22f0a4356689b5e21935194613aa1b159d58c8e8f4a2c 17632 fort-validator_1.7.0.experimental-1_source.buildinfo
Files:
 ae688206e23d5ea13a9139db5ab3f7bb 2422 net optional fort-validator_1.7.0.experimental-1.dsc
 b044cb44cae27ba9fc11112350ce5b90 314064 net optional fort-validator_1.7.0.experimental.orig.tar.xz
 f904c8e47090fe2b6962d632b96ae569 5060 net optional fort-validator_1.7.0.experimental-1.debian.tar.xz
 3128e2e9fcd536a97ffcd866198620ab 832572 net None fort-validator_1.7.0.experimental-1.git.tar.xz
 168331f7449e786ff3911b07ba2f4924 17632 net optional fort-validator_1.7.0.experimental-1_source.buildinfo
Git-Tag-Info: tag=f8e698f32771893c8ab98723b6b4e44b86fd2ea3 fp=272945cd836d38dfb7427e86cb3ec33ae1ded781
Git-Tag-Tagger: Marco d'Itri <md@linux.it>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmp2dWoACgkQYG0ITkaD
wHm0PQ/9F9M7KcG5w5DG7ym9xNKjHIro1QcontvnkQp1NPgWxyuf4vadfINrYYFg
WtyTbi53hETLKYUgNXAOL9eqX05v7nASxZ6AemUhlEbohWNiU36wzKkzOkwAqmuP
65WnQcCqPaQ42zRjPHjua7nNoZ6liPJsCw+gLd2YjfDa/bHwEN6hX/wju8ZhCQtL
UkUWNu5n2VEefEXI6nGKkmNw1IiG65CHsli+8epk6qZfmXN0+2Gvwz26VnvlkJY0
X4liU9TBiwpLIMLtGnoPSLeG24BRhJmilo5RdfindcyBl8Kb7q7OJEbEV+5SS73l
LQyaqDUYgxBcbVw1JE3NwCpsv3+j7Cfzgv41pAO76v6zVXCWUlO6iz+YqOF8PBZY
ig/NDED4WBZvNlKQKDuPMNHQBaNpg8sCKZZe51JOUpWP2H2pJcG6oGbUcg5IV2J7
ujhX5Kh8NF/W5A03EmaSoBcpgb3mvFvL8xbT11XpgeH508lelf5OMrKYoa3/WRpB
E0raTxyKdrhPDjGBsdBbUPM63/nsY5UYOJ2GBuDuHJO4XCQWlsK6NTCnwPyroeQw
huyZDQEJ0Qstme0V6EKu1fAB0hXoT4lmH33H927Dpw/ubD+hT74NxgzQnp+2JjUA
iI0H6fEgcGHBhiLR5fpSkW8qBArO1YbzEjE58sK3CK6datzbshI=
=8pfS
-----END PGP SIGNATURE-----