#1138459 imx-code-signing-tool: FTBFS with openssl 4.0

Package:
imx-code-signing-tool
Source:
imx-code-signing-tool
Description:
code signing tool for i.MX platform
Submitter:
Sebastian Andrzej Siewior
Date:
2026-10-21 17:09:02 UTC
Severity:
normal
Tags:
#1138459#5
Date:
2026-05-30 16:18:27 UTC
From:
To:
OpenSSL 4.0 is in experimental. This package fails to build against it:

| cd /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/obj-x86_64-linux-gnu/lib/common && /usr/bin/x86_64-linux-gnu-gcc -DCST_WITH_PKCS11 -DVERSION=4.0.1 -I/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common -I/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/back_end -I/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/front_end -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -std=c99 -D_POSIX_C_SOURCE=200809L -fPIC -Wdate-time -D_FORTIFY_SOURCE=2 -Werror -MD -MT lib/common/CMakeFiles/common.dir/openssl_helper.c.o -MF CMakeFiles/common.dir/openssl_helper.c.o.d -o CMakeFiles/common.dir/openssl_helper.c.o -c /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c: In function ‘get_certificate_serial_number_length’:
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c:1254:33: error: invalid use of incomplete typedef ‘ASN1_INTEGER’ {aka ‘struct asn1_string_st’}
|  1254 |     serial_bytes = serial_number->data;
|       |                                 ^~
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c:1255:34: error: invalid use of incomplete typedef ‘ASN1_INTEGER’ {aka ‘struct asn1_string_st’}
|  1255 |     serial_length = serial_number->length;
|       |                                  ^~
| make[4]: *** [lib/common/CMakeFiles/common.dir/build.make:96: lib/common/CMakeFiles/common.dir/openssl_helper.c.o] Error 1
|

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/imx-code-signing-tool_4.0.1+dfsg-1_amd64-2026-04-19T09:03:59Z

Sebastian
#1138459#12
Date:
2026-06-02 20:49:16 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
imx-code-signing-tool, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138459@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura <andrewsh@debian.org> (supplier of updated imx-code-signing-tool package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 02 Jun 2026 22:26:35 +0200
Source: imx-code-signing-tool
Architecture: source
Version: 4.0.1+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Collabora Team <team+collabora@tracker.debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Closes: 1138459
Changes:
 imx-code-signing-tool (4.0.1+dfsg-2) unstable; urgency=medium
 .
   * Fix FTBFS with OpenSSL 4.0: use ASN1_STRING accessors
     (Closes: #1138459, LP: #2155010).
Checksums-Sha1:
 1e56da7b5ce7c71ecebc32d1728254b20ad03ca0 2632 imx-code-signing-tool_4.0.1+dfsg-2.dsc
 ee016c35a2c30e4b93709dd14f58e05ffa29cfd1 19432 imx-code-signing-tool_4.0.1+dfsg-2.debian.tar.xz
 8e02dcd0a3e952d702384208a328637b0844bca1 587816 imx-code-signing-tool_4.0.1+dfsg-2.git.tar.xz
 b54e15b7dc4f23dfc2e5e92fdd4a16959e927466 17561 imx-code-signing-tool_4.0.1+dfsg-2_source.buildinfo
Checksums-Sha256:
 77415cd781d2b6f3f093956524af773c9270ecb304f5227e52ff9d9148797a78 2632 imx-code-signing-tool_4.0.1+dfsg-2.dsc
 62da9d62bb7c9e89c5a7666892f5332f7e592c3a608c902dcbae27d4904753ec 19432 imx-code-signing-tool_4.0.1+dfsg-2.debian.tar.xz
 df79ee40aad96f94402abdb30c1cc6562aa2fda9643b29e3ecd320150328bfd5 587816 imx-code-signing-tool_4.0.1+dfsg-2.git.tar.xz
 123f3c4ad289cf917ae7d8631eea21b7f8e0c6a5b258be054e46c751b8595b44 17561 imx-code-signing-tool_4.0.1+dfsg-2_source.buildinfo
Files:
 651082a37b163094f67ef4e5bf5c4da3 2632 electronics optional imx-code-signing-tool_4.0.1+dfsg-2.dsc
 86b6a9e3facb2f97e554c0dc36c9afaa 19432 electronics optional imx-code-signing-tool_4.0.1+dfsg-2.debian.tar.xz
 33b3ccb9a83cbb90d632b4578d6eb24c 587816 electronics optional imx-code-signing-tool_4.0.1+dfsg-2.git.tar.xz
 92bd9516f371eb10174f31c11cad9744 17561 electronics optional imx-code-signing-tool_4.0.1+dfsg-2_source.buildinfo
Git-Tag-Info: tag=84887b38ef456bca562e30ab77134c43c9b0fae1 fp=83dcd17f44b22cc83656eda1e8446b4ac8c77261
Git-Tag-Tagger: Andrej Shadura <andrew.shadura@collabora.co.uk>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmofPN8ACgkQYG0ITkaD
wHm/PQ/9FOfYD2ju5i9OANFD19hxW/+knFIU6aoxssOHARp1WzuKRz0HuZ3pMGnQ
DyY/7fWeSsKOLCHV0EN6lWAr6dQAU9yeI7Sol+e9kdZmJ0VW+fG9AsM567GQBVJb
WF5ZOCjBisZ8N+CL+IT5A9CbxCeRYIl3uKngyjlHaaltFd5UNfEpPfe5ofVbGIL6
N/D2wKqlO594NEbBSy72F5gVDgH9wvtWEFAV0UCVtaqWw65BoA7O9mqmdyL8/yrL
iD1JWb6CVn9x9Yo8yKMn0PVouIZwk+Eubbvy//fIF57fHJlbhS7Xm8kQGYUnsAJJ
3lCQGsKMunSPKhSbhQZaqx43zRwBfSFz2ROd+sN9GWSDdjvJxcA7SXzJ2rgGNTU/
au8xwIECMUTvW9CwtntzX6vIWjFOBS35GrqHUI2WQT4BPGBPe+qhI4aG7tBvWYmG
bWZWmZRZI+CdXIBfTzXCDJxB6CIk1YPB5LcWWjrk5St1mDujC/+0EmNbm7hAIAUF
9HSCCoRuRpgAgD/LeB3F6w1kcDNXCmlDp4OGtZyDCtl7AgeMDJcGhonRAXoDyQ/M
A68M3n91/Fka/6Dfp5B2vQerCxUfMe8H/s/73qoYcAtdT0sWi22UPLUDr6mqsv5G
uZKu31z816dJqsHZSbsw3dTrU6ZscYlIdC7nLnrXSg/x0qK7wgU=
=P709
-----END PGP SIGNATURE-----
#1138459#21
Date:
2026-08-19 19:50:22 UTC
From:
To:
control: notfixed -1 4.0.1+dfsg-2

Thanks for the effort, but a few things are still missing:

| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c: In function ‘generate_certificate’:
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c:440:10: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qua lifiers]
|   440 |     name = X509_get_subject_name(x509);
|       |          ^
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c: In function ‘generate_certificate’:
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c:440:10: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qua lifiers]
|   440 |     name = X509_get_subject_name(x509);
|       |          ^
| [ 74%] Linking C executable ../../bin/srktool
| cd /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/obj-x86_64-linux-gnu/tools/srktool && /usr/bin/cmake -E cmake_link_script CMakeFiles/srktool.dir/link.txt --verbose=1
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `engine_ctx_destroy':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:38:(.text+0x39): undefined reference to `ENGINE_free'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `engine_ctx_init':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:62:(.text+0x8e): undefined reference to `ENGINE_load_builtin_engines'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:64:(.text+0x9a): undefined reference to `ENGINE_by_id'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:70:(.text+0xa5): undefined reference to `ENGINE_init'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:71:(.text+0xc8): undefined reference to `ENGINE_free'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `engine_ctx_finish':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:81:(.text+0xf1): undefined reference to `ENGINE_finish'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `ENGINE_load_certificate':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:95:(.text+0x14b): undefined reference to `ENGINE_ctrl_cmd'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `ENGINE_load_key':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:105:(.text+0x199): undefined reference to `ENGINE_load_private_key'
| collect2: error: ld returned 1 exit status

The whole ENGINE code needs to be avoided for openssl 4.0.

Sebastian
#1138459#30
Date:
2026-10-09 14:12:15 UTC
From:
To:
Also, this uses libengine-pkcs11-openssl in autopkgtest. Please
rewriting or dropping the affected test.
#1138459#35
Date:
2026-10-10 20:17:40 UTC
From:
To:
Please find attached a patch that is upstreamable plus the necessary
Debian package changes to include it and make the package build with the
pkcs11-provider package.

I do not know how to contact NXP to forward it, so please do so if you
have the means.

The thing should work with the current sid and experimental openssl
versions. Please note that I have hit #1135799 for the SoftHSM2 tests
and have uploaded a NMU to DELAYED/5.
#1138459#42
Date:
2026-10-15 10:20:13 UTC
From:
To:
Thanks, much appreciated.

I plan to create a merge request at salsa, including your patches as-is
and minor changes of mine on top, which we could discuss then. Ok for you?

Very nice. This bugged me many times, seems we can delete a bunch of
workarounds soon.

Tobias
#1138459#47
Date:
2026-10-15 11:27:32 UTC
From:
To:
Yes, okay.
#1138459#52
Date:
2026-10-21 17:07:15 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
imx-code-signing-tool, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138459@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura <andrewsh@debian.org> (supplier of updated imx-code-signing-tool package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 21 Oct 2026 18:43:24 +0200
Source: imx-code-signing-tool
Architecture: source
Version: 4.0.1+dfsg-3
Distribution: unstable
Urgency: medium
Maintainer: Collabora Team <team+collabora@tracker.debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Closes: 1138459
Changes:
 imx-code-signing-tool (4.0.1+dfsg-3) unstable; urgency=medium
 .
   [ Bastian Germann ]
   * Migrate the PKCS#11 backend from the OpenSSL ENGINE API to the
     provider API and use pkcs11-provider. (Closes: #1138459)
 .
   [ Tobias Deiminger ]
   * Minor fixes for the new provider API code with related tests.
Checksums-Sha1:
 6dfccddf3b23079ca0f7842b63833c26637f5180 2632 imx-code-signing-tool_4.0.1+dfsg-3.dsc
 081be34a1fc673cb9beebfa522b86d94450e1fa7 24512 imx-code-signing-tool_4.0.1+dfsg-3.debian.tar.xz
 af9d8dc956848d2eaf585e30c1f6d0359f432f30 616924 imx-code-signing-tool_4.0.1+dfsg-3.git.tar.xz
 db910e44f72ede35ef22061b6e0da5336a95cd51 17800 imx-code-signing-tool_4.0.1+dfsg-3_source.buildinfo
Checksums-Sha256:
 a720c7d87b682a412beff4e7dd1a2b4066f70dca58934137cb98a2bf6ad8a3d2 2632 imx-code-signing-tool_4.0.1+dfsg-3.dsc
 9ea9b452541a938f84a81f6b1116fcbd65a18d13638b0b9d33975378b5f02e27 24512 imx-code-signing-tool_4.0.1+dfsg-3.debian.tar.xz
 2a87807f1de484b96e82ca4fb566d3b5f4efc5e0b3967e5ea2e9ffae86f91467 616924 imx-code-signing-tool_4.0.1+dfsg-3.git.tar.xz
 f97d8de6cbcc8b30b6cb0a8f09217e8b0fbe318310001ab0ae81a2121096d1ac 17800 imx-code-signing-tool_4.0.1+dfsg-3_source.buildinfo
Files:
 7906605b3e012e87a5cf4d5d3cb76622 2632 electronics optional imx-code-signing-tool_4.0.1+dfsg-3.dsc
 48f5f66a59615124268ebe6b7c562bb4 24512 electronics optional imx-code-signing-tool_4.0.1+dfsg-3.debian.tar.xz
 e6b54efdb7c333b62a4101409d62e55c 616924 electronics optional imx-code-signing-tool_4.0.1+dfsg-3.git.tar.xz
 a63e91170d392d2e33fa774cbcb4c65a 17800 electronics optional imx-code-signing-tool_4.0.1+dfsg-3_source.buildinfo
Git-Tag-Info: tag=cf2aa8eed0ec3c8f754c7bdfa33580595e6a73dc fp=83dcd17f44b22cc83656eda1e8446b4ac8c77261
Git-Tag-Tagger: Andrej Shadura <andrew.shadura@collabora.co.uk>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrY7CsACgkQYG0ITkaD
wHnrERAAg1ltLmaN7t13MFjXKqJIsqFQtNQGALMUwvxycqDNF3f+HvEFVXmUrh25
pM+JzWOucFtn57e9x8YlqH6kas62tIuzWn2Z+cIF4uI0hemQe+B/eYp7n1cMsBrw
e5j6yRd59dM9XwhsI8wxA4Y1EzaP49QsAk5fWnffvsWwBA5miIcxZcnKWpzjE2Ta
aKjJ7hHB8ktTxKRyftBhzSDPLa0PgF+UHu6wN3UjxQq+LPHmXF2+ztQLEt+jgwp8
mFCxCxXMzIKtzRq/vGdr50fF70jVEm6654lbgcSfa87kF0E9HMW+vYLmR5kyZPHx
J4g+8SryIfJjBdYzXIOhUF6+5vujJm+MvzXTOWm5s9h76Fz0Ll5c+86zIzvGtb0Q
aFrGDi2YALgvvW6U0fgWR5yWk2Jj7wGuHsU8UjqrlMRQivaPekisMGdONIhd8ITi
vSn0MwVMUBTf7UO9kjTUvMHniZGtdGpcPgF8o5CnJdgGAv4jyKwwBUJuHMKQWsFI
4fYCKwz3dL47lahUz6FRnVz5CewUbch4pVk61YW/or/flz8QCcQ16h48UXHqjKyF
RBqoGw4wb0UG+3ITxUthjRPYnbk75O63d13svOZ6DHSgG9sZAzuacpIwpgBpMaK0
oWjeTpds0qjdk0FFr0iP1IR/Z8M3xyabzmdrjplOqYXJ55ZFcFc=
=XP9u
-----END PGP SIGNATURE-----