OpenSSL 4.0 is in experimental. This package fails to build against it:

| cd /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/obj-x86_64-linux-gnu/lib/common && /usr/bin/x86_64-linux-gnu-gcc -DCST_WITH_PKCS11 -DVERSION=4.0.1 -I/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common -I/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/back_end -I/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/front_end -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -std=c99 -D_POSIX_C_SOURCE=200809L -fPIC -Wdate-time -D_FORTIFY_SOURCE=2 -Werror -MD -MT lib/common/CMakeFiles/common.dir/openssl_helper.c.o -MF CMakeFiles/common.dir/openssl_helper.c.o.d -o CMakeFiles/common.dir/openssl_helper.c.o -c /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c: In function ‘get_certificate_serial_number_length’:
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c:1254:33: error: invalid use of incomplete typedef ‘ASN1_INTEGER’ {aka ‘struct asn1_string_st’}
|  1254 |     serial_bytes = serial_number->data;
|       |                                 ^~
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/lib/common/openssl_helper.c:1255:34: error: invalid use of incomplete typedef ‘ASN1_INTEGER’ {aka ‘struct asn1_string_st’}
|  1255 |     serial_length = serial_number->length;
|       |                                  ^~
| make[4]: *** [lib/common/CMakeFiles/common.dir/build.make:96: lib/common/CMakeFiles/common.dir/openssl_helper.c.o] Error 1
|

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/imx-code-signing-tool_4.0.1+dfsg-1_amd64-2026-04-19T09:03:59Z

Sebastian

We believe that the bug you reported is fixed in the latest version of
imx-code-signing-tool, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138459@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura <andrewsh@debian.org> (supplier of updated imx-code-signing-tool package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 02 Jun 2026 22:26:35 +0200
Source: imx-code-signing-tool
Architecture: source
Version: 4.0.1+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Collabora Team <team+collabora@tracker.debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Closes: 1138459
Changes:
 imx-code-signing-tool (4.0.1+dfsg-2) unstable; urgency=medium
 .
   * Fix FTBFS with OpenSSL 4.0: use ASN1_STRING accessors
     (Closes: #1138459, LP: #2155010).
Checksums-Sha1:
 1e56da7b5ce7c71ecebc32d1728254b20ad03ca0 2632 imx-code-signing-tool_4.0.1+dfsg-2.dsc
 ee016c35a2c30e4b93709dd14f58e05ffa29cfd1 19432 imx-code-signing-tool_4.0.1+dfsg-2.debian.tar.xz
 8e02dcd0a3e952d702384208a328637b0844bca1 587816 imx-code-signing-tool_4.0.1+dfsg-2.git.tar.xz
 b54e15b7dc4f23dfc2e5e92fdd4a16959e927466 17561 imx-code-signing-tool_4.0.1+dfsg-2_source.buildinfo
Checksums-Sha256:
 77415cd781d2b6f3f093956524af773c9270ecb304f5227e52ff9d9148797a78 2632 imx-code-signing-tool_4.0.1+dfsg-2.dsc
 62da9d62bb7c9e89c5a7666892f5332f7e592c3a608c902dcbae27d4904753ec 19432 imx-code-signing-tool_4.0.1+dfsg-2.debian.tar.xz
 df79ee40aad96f94402abdb30c1cc6562aa2fda9643b29e3ecd320150328bfd5 587816 imx-code-signing-tool_4.0.1+dfsg-2.git.tar.xz
 123f3c4ad289cf917ae7d8631eea21b7f8e0c6a5b258be054e46c751b8595b44 17561 imx-code-signing-tool_4.0.1+dfsg-2_source.buildinfo
Files:
 651082a37b163094f67ef4e5bf5c4da3 2632 electronics optional imx-code-signing-tool_4.0.1+dfsg-2.dsc
 86b6a9e3facb2f97e554c0dc36c9afaa 19432 electronics optional imx-code-signing-tool_4.0.1+dfsg-2.debian.tar.xz
 33b3ccb9a83cbb90d632b4578d6eb24c 587816 electronics optional imx-code-signing-tool_4.0.1+dfsg-2.git.tar.xz
 92bd9516f371eb10174f31c11cad9744 17561 electronics optional imx-code-signing-tool_4.0.1+dfsg-2_source.buildinfo
Git-Tag-Info: tag=84887b38ef456bca562e30ab77134c43c9b0fae1 fp=83dcd17f44b22cc83656eda1e8446b4ac8c77261
Git-Tag-Tagger: Andrej Shadura <andrew.shadura@collabora.co.uk>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmofPN8ACgkQYG0ITkaD
wHm/PQ/9FOfYD2ju5i9OANFD19hxW/+knFIU6aoxssOHARp1WzuKRz0HuZ3pMGnQ
DyY/7fWeSsKOLCHV0EN6lWAr6dQAU9yeI7Sol+e9kdZmJ0VW+fG9AsM567GQBVJb
WF5ZOCjBisZ8N+CL+IT5A9CbxCeRYIl3uKngyjlHaaltFd5UNfEpPfe5ofVbGIL6
N/D2wKqlO594NEbBSy72F5gVDgH9wvtWEFAV0UCVtaqWw65BoA7O9mqmdyL8/yrL
iD1JWb6CVn9x9Yo8yKMn0PVouIZwk+Eubbvy//fIF57fHJlbhS7Xm8kQGYUnsAJJ
3lCQGsKMunSPKhSbhQZaqx43zRwBfSFz2ROd+sN9GWSDdjvJxcA7SXzJ2rgGNTU/
au8xwIECMUTvW9CwtntzX6vIWjFOBS35GrqHUI2WQT4BPGBPe+qhI4aG7tBvWYmG
bWZWmZRZI+CdXIBfTzXCDJxB6CIk1YPB5LcWWjrk5St1mDujC/+0EmNbm7hAIAUF
9HSCCoRuRpgAgD/LeB3F6w1kcDNXCmlDp4OGtZyDCtl7AgeMDJcGhonRAXoDyQ/M
A68M3n91/Fka/6Dfp5B2vQerCxUfMe8H/s/73qoYcAtdT0sWi22UPLUDr6mqsv5G
uZKu31z816dJqsHZSbsw3dTrU6ZscYlIdC7nLnrXSg/x0qK7wgU=
=P709
-----END PGP SIGNATURE-----

control: notfixed -1 4.0.1+dfsg-2

Thanks for the effort, but a few things are still missing:

| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c: In function ‘generate_certificate’:
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c:440:10: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qua lifiers]
|   440 |     name = X509_get_subject_name(x509);
|       |          ^
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c: In function ‘generate_certificate’:
| /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/src/tools/pki_tree/pki_helper.c:440:10: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qua lifiers]
|   440 |     name = X509_get_subject_name(x509);
|       |          ^
| [ 74%] Linking C executable ../../bin/srktool
| cd /build/reproducible-path/imx-code-signing-tool-4.0.1+dfsg/obj-x86_64-linux-gnu/tools/srktool && /usr/bin/cmake -E cmake_link_script CMakeFiles/srktool.dir/link.txt --verbose=1
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `engine_ctx_destroy':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:38:(.text+0x39): undefined reference to `ENGINE_free'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `engine_ctx_init':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:62:(.text+0x8e): undefined reference to `ENGINE_load_builtin_engines'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:64:(.text+0x9a): undefined reference to `ENGINE_by_id'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:70:(.text+0xa5): undefined reference to `ENGINE_init'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:71:(.text+0xc8): undefined reference to `ENGINE_free'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `engine_ctx_finish':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:81:(.text+0xf1): undefined reference to `ENGINE_finish'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `ENGINE_load_certificate':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:95:(.text+0x14b): undefined reference to `ENGINE_ctrl_cmd'
| /usr/bin/x86_64-linux-gnu-ld.bfd: ../../lib/static/libcst_back_end.a(engine.c.o): in function `ENGINE_load_key':
| ./obj-x86_64-linux-gnu/lib/back_end/./src/lib/back_end/engine.c:105:(.text+0x199): undefined reference to `ENGINE_load_private_key'
| collect2: error: ld returned 1 exit status

The whole ENGINE code needs to be avoided for openssl 4.0.

Sebastian