Bug#1138336: svxlink: FTBFS with openssl 4.0

Ravi Kant Sharma <[email protected]> Thu, 25 Jun 2026 12:07:48 +0200
Newsgroups gmane.linux.debian.devel.ham
Message-ID <178238206837.3157708.3105539424883755506.reportbug__14899.6165765979$1782382173$gmane$org@dragon0> 
Package: svxlink
Followup-For: Bug #1138336
X-Debbugs-Cc: [email protected]
Control: tags -1 patch ftbfs

Dear Maintainer,

The previous patch is incorrect, I have attached the updated patch.

-- System Information:
Debian Release: trixie/sid
  APT prefers noble-updates
  APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, 'noble'), (100, 'noble-backports')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.8.0-117-generic (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
fix-for-openssl4-compat.patch (text/plain, 4.7 KB) 
Description: Fix OpenSSL 4.0 compatibility in async SSL code
 Create mutable X509_NAME via X509_NAME_new(), populate it, and set it
 on the certificate/CSR via X509_set_*_name()/X509_REQ_set_subject_name()
 (which copy internally) instead of mutating the const pointer returned
 by X509_get_*_name()/X509_REQ_get_subject_name(). Use const for
 read-only X509_NAME_ENTRY/ASN1_STRING return values.
Forwarded: https://github.com/sm0svx/svxlink/pull/775
Bug-Ubuntu: https://bugs.launchpad.net/bugs/2154883
Bug-Debian: https://bugs.debian.org/1138336
Last-Update: 2026-06-24

Index: svxlink/src/async/core/AsyncSslCertSigningReq.h
===================================================================
--- svxlink.orig/src/async/core/AsyncSslCertSigningReq.h	2026-06-25 11:01:57.216607528 +0200
+++ svxlink/src/async/core/AsyncSslCertSigningReq.h	2026-06-25 11:02:40.473688173 +0200
@@ -292,17 +292,17 @@
     bool addSubjectName(const std::string& field, const std::string& value)
     {
       assert(m_req != nullptr);
-      X509_NAME* name = X509_REQ_get_subject_name(m_req);
+      X509_NAME* name = X509_NAME_new();
       if (name == nullptr)
       {
-        name = X509_NAME_new();
+        return false;
       }
-      assert(name != nullptr);
       bool success = (X509_NAME_add_entry_by_txt(name, field.c_str(),
             MBSTRING_UTF8,
             reinterpret_cast<const unsigned char*>(value.c_str()),
             value.size(), -1, 0) == 1);
       success = success && (X509_REQ_set_subject_name(m_req, name) == 1);
+      X509_NAME_free(name);
       return success;
     }
 
@@ -404,8 +404,8 @@
       //int lastpos = X509_NAME_get_index_by_NID(subj, NID_commonName, -1);
       if (lastpos >= 0)
       {
-        X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, lastpos);
-        ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
+        const X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, lastpos);
+        const ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
         cn = reinterpret_cast<const char*>(ASN1_STRING_get0_data(d));
       }
       return cn;
Index: svxlink/src/async/core/AsyncSslX509.h
===================================================================
--- svxlink.orig/src/async/core/AsyncSslX509.h	2026-06-25 11:01:57.216607528 +0200
+++ svxlink/src/async/core/AsyncSslX509.h	2026-06-25 11:03:30.050785788 +0200
@@ -354,8 +354,8 @@
 #endif
       if (lastpos >= 0)
       {
-        X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, lastpos);
-        ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
+        const X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, lastpos);
+        const ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
         cn = reinterpret_cast<const char*>(ASN1_STRING_get0_data(d));
       }
       return cn;
@@ -712,11 +712,7 @@
     {
       // FIXME: Error handling
       assert(m_cert != nullptr);
-      X509_NAME* name = X509_get_issuer_name(m_cert);
-      if (name == nullptr)
-      {
-        name = X509_NAME_new();
-      }
+      X509_NAME* name = X509_NAME_new();
       assert(name != nullptr);
       int ret = X509_NAME_add_entry_by_txt(name, field.c_str(), MBSTRING_UTF8,
           reinterpret_cast<const unsigned char*>(value.c_str()),
@@ -724,6 +720,7 @@
       assert(ret == 1);
       ret = X509_set_issuer_name(m_cert, name);
       assert(ret == 1);
+      X509_NAME_free(name);
     }
 
     /**
@@ -735,11 +732,7 @@
     {
       // FIXME: Error handling
       assert(m_cert != nullptr);
-      X509_NAME* name = X509_get_subject_name(m_cert);
-      if (name == nullptr)
-      {
-        name = X509_NAME_new();
-      }
+      X509_NAME* name = X509_NAME_new();
       assert(name != nullptr);
       int ret = X509_NAME_add_entry_by_txt(name, field.c_str(), MBSTRING_UTF8,
           reinterpret_cast<const unsigned char*>(value.c_str()),
@@ -747,6 +740,7 @@
       assert(ret == 1);
       ret = X509_set_subject_name(m_cert, name);
       assert(ret == 1);
+      X509_NAME_free(name);
     }
 
     /**
Index: svxlink/src/async/demo/AsyncSslTcpServer_demo.cpp
===================================================================
--- svxlink.orig/src/async/demo/AsyncSslTcpServer_demo.cpp	2026-06-25 11:01:57.216607528 +0200
+++ svxlink/src/async/demo/AsyncSslTcpServer_demo.cpp	2026-06-25 11:01:57.211607519 +0200
@@ -86,8 +86,8 @@
               {
                   break;
               }
-              X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, lastpos);
-              ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
+              const X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, lastpos);
+              const ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
               const unsigned char* str = (ASN1_STRING_get0_data(d));
               std::cout << "### CN=" << str << std::endl;
           }