From 539d6e26eb23d9469f0fa0ff8dc1366e86b14865 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Tue, 3 Nov 2026 07:14:23 -0800 Subject: [PATCH] imx-cst: Fix build with OpenSSL 4.1 OpenSSL 4.1 deprecates ASN1_STRING_length(), which the OpenSSL 4 ASN1 opaque fix uses, and the build uses -Werror: openssl_helper.c:1255:21: error: 'ASN1_STRING_length' is deprecated: Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror,-Wdeprecated-declarations] Use ASN1_STRING_get_length() when building against OpenSSL 4.1 or newer. AI-Generated: Uses Claude Code Signed-off-by: Khem Raj --- ...se-ASN1_STRING_get_length-with-OpenS.patch | 38 +++++++++++++++++++ .../recipes-support/imx-cst/imx-cst_4.0.1.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch diff --git a/meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch b/meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch new file mode 100644 index 0000000000..a293d0eef7 --- /dev/null +++ b/meta-oe/recipes-support/imx-cst/imx-cst/0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch @@ -0,0 +1,38 @@ +From d4362c9c99f2d80a6c4f25528934e040e333fd85 Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Tue, 3 Nov 2026 07:13:41 -0800 +Subject: [PATCH] openssl_helper: Use ASN1_STRING_get_length() with OpenSSL 4.1 + +OpenSSL 4.1 deprecates ASN1_STRING_length() in favour of +ASN1_STRING_get_length(), which returns size_t. With -Werror the build +fails with: + + openssl_helper.c:1255:21: error: 'ASN1_STRING_length' is deprecated: + Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror,-Wdeprecated-declarations] + +Use the new accessor when building against OpenSSL 4.1 or newer and keep +ASN1_STRING_length() for older versions. A serial number is at most 20 +octets, so the cast to int is safe. + +Upstream-Status: Pending +Signed-off-by: Khem Raj +--- + src/lib/common/openssl_helper.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/lib/common/openssl_helper.c b/src/lib/common/openssl_helper.c +index 7a6980e..e8961de 100644 +--- a/src/lib/common/openssl_helper.c ++++ b/src/lib/common/openssl_helper.c +@@ -1252,7 +1252,11 @@ int get_certificate_serial_number_length(X509 *cert) + + /* Get the raw data of the serial number */ + serial_bytes = ASN1_STRING_get0_data(serial_number); ++#if OPENSSL_VERSION_NUMBER >= 0x40100000L ++ serial_length = (int)ASN1_STRING_get_length(serial_number); ++#else + serial_length = ASN1_STRING_length(serial_number); ++#endif + + /* Check if the serial number is negative (MSB of first byte is set) */ + if (serial_bytes[0] & 0x80) diff --git a/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb b/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb index 3a0f717440..7683ebad52 100644 --- a/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb +++ b/meta-oe/recipes-support/imx-cst/imx-cst_4.0.1.bb @@ -30,6 +30,7 @@ SRC_URI = "\ file://0015-fix-openssl-4-engine-api-removal.patch \ file://0016-fix-openssl-4-const-subject-name.patch \ file://0017-cst-port-pkcs11-signing-from-engine-to-provider.patch \ + file://0018-openssl_helper-Use-ASN1_STRING_get_length-with-OpenS.patch \ " SRC_URI[sha256sum] = "fd92a1a9faa10fb81bbf752c7ee1e257f17e1ec4c2964f8a47adf8a3eaa7df41"