diff mbox series

[meta-oe,3/3] imx-cst: Fix build with OpenSSL 4.1

Message ID 20261104060534.1875273-3-khem.raj@oss.qualcomm.com
State New
Headers show
Series [meta-python,1/3] python3-cbor2: Upgrade 6.2.0.post1 -> 6.2.0.post2 | expand

Commit Message

Khem Raj Nov. 4, 2026, 6:05 a.m. UTC 
OpenSSL 4.1 deprecates ASN1_STRING_length(), which the OpenSSL 4 ASN1
opaque fix uses, and the build uses -Werror:

  openssl_helper.c:1255:21: error: 'ASN1_STRING_length' is deprecated:
  Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror,-Wdeprecated-declarations]

Use ASN1_STRING_get_length() when building against OpenSSL 4.1 or newer.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
---
 ...se-ASN1_STRING_get_length-with-OpenS.patch | 38 +++++++++++++++++++
 .../recipes-support/imx-cst/imx-cst_4.0.1.bb  |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch b/meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch
new file mode 100644
index 0000000000..a293d0eef7
--- /dev/null
+++ b/meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch
@@ -0,0 +1,38 @@ 
+From d4362c9c99f2d80a6c4f25528934e040e333fd85 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Tue, 3 Nov 2026 07:13:41 -0800
+Subject: [PATCH] openssl_helper: Use ASN1_STRING_get_length() with OpenSSL 4.1
+
+OpenSSL 4.1 deprecates ASN1_STRING_length() in favour of
+ASN1_STRING_get_length(), which returns size_t. With -Werror the build
+fails with:
+
+  openssl_helper.c:1255:21: error: 'ASN1_STRING_length' is deprecated:
+  Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror,-Wdeprecated-declarations]
+
+Use the new accessor when building against OpenSSL 4.1 or newer and keep
+ASN1_STRING_length() for older versions. A serial number is at most 20
+octets, so the cast to int is safe.
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ src/lib/common/openssl_helper.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/lib/common/openssl_helper.c b/src/lib/common/openssl_helper.c
+index 7a6980e..e8961de 100644
+--- a/src/lib/common/openssl_helper.c
++++ b/src/lib/common/openssl_helper.c
+@@ -1252,7 +1252,11 @@ int get_certificate_serial_number_length(X509 *cert)
+
+     /* Get the raw data of the serial number */
+     serial_bytes = ASN1_STRING_get0_data(serial_number);
++#if OPENSSL_VERSION_NUMBER >= 0x40100000L
++    serial_length = (int)ASN1_STRING_get_length(serial_number);
++#else
+     serial_length = ASN1_STRING_length(serial_number);
++#endif
+
+     /* Check if the serial number is negative (MSB of first byte is set) */
+     if (serial_bytes[0] & 0x80)
diff --git a/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb b/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb
index 3a0f717440..7683ebad52 100644
--- a/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb
+++ b/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb
@@ -30,6 +30,7 @@  SRC_URI = "\
     file://0015-fix-openssl-4-engine-api-removal.patch \
     file://0016-fix-openssl-4-const-subject-name.patch \
     file://0017-cst-port-pkcs11-signing-from-engine-to-provider.patch \
+    file://0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch \
 "
 SRC_URI[sha256sum] = "fd92a1a9faa10fb81bbf752c7ee1e257f17e1ec4c2964f8a47adf8a3eaa7df41"