#1140502 sudo: FTBFS with openssl 4.0

Package:
src:sudo
Source:
src:sudo
Submitter:
Sebastian Andrzej Siewior
Date:
2026-08-31 15:31:02 UTC
Severity:
normal
Tags:
#1140502#5
Date:
2026-06-21 16:56:32 UTC
From:
To:
OpenSSL 4.0 is in experimental. This package fails to build against it:
| /bin/bash ../../libtool --tag=disable-static --mode=compile x86_64-linux-gnu-gcc -c -o hostcheck.lo -I../../../include -I../.. -I../../../lib/iolog -Wdate-time -D_FORTIFY_SOURCE=2 -DSUDO_DEVEL -DZLIB_CONST -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/sudo-1.9.17p2=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -pedantic -fvisibility=hidden -Wmissing-prototypes -Wno-unknown-pragmas -Wpointer-arith -Wshadow -Wsign-compare -Wwrite-strings -Wvla -Walloca -Wtrampolines -Wimplicit-fallthrough  -fPIE -fstack-protector-strong -fstack-clash-protection -fcf-protection ../../../lib/iolog/hostcheck.c
| libtool: compile:  x86_64-linux-gnu-gcc -c -I../../../include -I../.. -I../../../lib/iolog -Wdate-time -D_FORTIFY_SOURCE=2 -DSUDO_DEVEL -DZLIB_CONST -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/sudo-1.9.17p2=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -pedantic -fvisibility=hidden -Wmissing-prototypes -Wno-unknown-pragmas -Wpointer-arith -Wshadow -Wsign-compare -Wwrite-strings -Wvla -Walloca -Wtrampolines -Wimplicit-fallthrough -fstack-protector-strong -fstack-clash-protection -fcf-protection ../../../lib/iolog/hostcheck.c  -fPIC -DPIC -o .libs/hostcheck.o
| ../../../lib/iolog/hostcheck.c: In function 'matches_common_name':
| ../../../lib/iolog/hostcheck.c:203:27: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   203 |         common_name_entry = X509_NAME_get_entry(X509_get_subject_name((X509 *) cert), common_name_loc);
|       |                           ^
| ../../../lib/iolog/hostcheck.c:209:26: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
|   209 |         common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry);
|       |                          ^
| ../../../lib/iolog/hostcheck.c: In function 'matches_subject_alternative_name':
| ../../../lib/iolog/hostcheck.c:326:41: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
|   326 |             if(current_name->d.iPAddress->length == 4) {
|       |                                         ^~
| ../../../lib/iolog/hostcheck.c:333:49: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'}
|   333 |             } else if (current_name->d.iPAddress->length == 16) {
|       |                                                 ^~
| make[3]: *** [Makefile:499: hostcheck.lo] Error 1
| make[3]: Leaving directory '/build/reproducible-path/sudo-1.9.17p2/build-simple/lib/iolog'

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/sudo_1.9.17p2-7_amd64-2026-06-21T12:49:54Z

Sebastian
#1140502#16
Date:
2026-08-29 20:20:26 UTC
From:
To:
control: tags -1 patch

Sebastian
#1140502#23
Date:
2026-08-30 19:02:58 UTC
From:
To:
Upstream fix at https://github.com/sudo-project/sudo/commit/f97a34bc7b390f185d544e21b0ef75db1275953e

Greetings
Marc
#1140502#28
Date:
2026-08-30 19:02:58 UTC
From:
To:
Upstream fix at https://github.com/sudo-project/sudo/commit/f97a34bc7b390f185d544e21b0ef75db1275953e

Greetings
Marc
#1140502#33
Date:
2026-08-31 06:22:16 UTC
From:
To:
That missing const will cause a warning but nice that it is moving
forward. Thanks.

Sebastian
#1140502#38
Date:
2026-08-31 12:00:39 UTC
From:
To:
Hi Sebastian,

how important is a short-term fix? Upstream is in the rc phase of a new
release, do you mind if I wait until that is released? I promise that
I'll cherry-pick the upstream fix before we freeze forky if upsteam
doesn't come along with the release.

Greetings
Marc
#1140502#43
Date:
2026-08-31 15:28:22 UTC
From:
To:
Hi Marc,

Yeah, don't worry for now. I tried to make sure each key package has a
patch attached and sudo is such a package. The openssl transition did
not start yet. Once it does, I will raise the severity to RC. So you can
wait until then.

Sebastian