Fails to build with OpenSSL 4.0

We got a bug report in Debian about building with OpenSSL 4.0 (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1137559 for the original report):

OpenSSL 4.0 is in Debian experimental. Bacula fails to build against it: | Compiling crypto.c | true /usr/bin/g++ -c -Wdate-time -D_FORTIFY_SOURCE=2 -x c++ | -fno-strict-aliasing -fno-exceptions -fno-rtti -I. -I.. -g -O2 | -Werror=implicit-function-declaration | -ffile-prefix-map=/build/reproducible-path/bacula-15.0.3=. -fstack-protector-strong | -fstack-clash-protection -Wformat -Werror=format-security | -fcf-protection -x c++ -fno-strict-aliasing -fno-exceptions | -fno-rtti -E crypto.c | true | /build/reproducible-path/bacula-15.0.3/libtool --tag=CXX | --mode=compile /usr/bin/g++ -c -Wdate-time -D_FORTIFY_SOURCE=2 -x | c++ -fno-strict-aliasing -fno-exceptions -fno-rtti -I. -I.. -g -O2 | -Werror=implicit-function-declaration | -ffile-prefix-map=/build/reproducible-path/bacula-15.0.3=. -fstack-protector-strong | -fstack-clash-protection -Wformat -Werror=format-security | -fcf-protection -x c++ -fno-strict-aliasing -fno-exceptions | -fno-rtti crypto.c | libtool: compile: /usr/bin/g++ -c -Wdate-time -D_FORTIFY_SOURCE=2 -x | c++ -fno-strict-aliasing -fno-exceptions -fno-rtti -I. -I.. -g -O2 | -Werror=implicit-function-declaration | -ffile-prefix-map=/build/reproducible-path/bacula-15.0.3=. -fstack-protector-strong | -fstack-clash-protection -Wformat -Werror=format-security | -fcf-protection -x c++ -fno-strict-aliasing -fno-exceptions | -fno-rtti crypto.c -fPIC -DPIC -o .libs/crypto.o | cc1plus: warning: '-Werror=' argument '-Werror=implicit-function-declaration' is not valid for C++ | crypto.c: In function 'ASN1_OCTET_STRING* openssl_cert_keyid(X509*)': | crypto.c:327:22: error: invalid conversion from 'const X509_EXTENSION*' {aka 'const X509_extension_st*'} to 'X509_EXTENSION*' {aka 'X509_extension_st*'} [-fpermissive] | 327 | ext = X509_get_ext(cert, i); | | ~~~~~~~~~~~~^~~~~~~~~ | | | | | const X509_EXTENSION* {aka const X509_extension_st*} | crypto.c: In function 'int crypto_sign_add_signer(SIGNATURE*, DIGEST*, X509_KEYPAIR*)': | crypto.c:991:71: warning: 'const EVP_MD* EVP_MD_CTX_md(const EVP_MD_CTX*)' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] | 991 | si->signatureAlgorithm = OBJ_nid2obj(EVP_MD_pkey_type(EVP_MD_CTX_md(digest->ctx))); | | ~~~~~~~~~~~~~^~~~~~~~~~~~~ | In file included from /usr/include/openssl/x509.h:31, | from /usr/include/openssl/ssl.h:34, | from ../bacula.h:147, | from crypto.c:37: | /usr/include/openssl/evp.h:476:15: note: declared here | 476 | const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx); | | ^~~~~~~~~~~~~ | crypto.c: In function 'CRYPTO_SESSION* crypto_session_new(crypto_cipher_t, alist*)': | crypto.c:1214:39: warning: 'int EVP_PKEY_encrypt_old(unsigned char*, const unsigned char*, int, EVP_PKEY*)' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] | 1214 | if ((ekey_len = EVP_PKEY_encrypt(ekey, cs->session_key, cs->session_key_len, keypair->pubkey)) <= 0) { | | ^ | /usr/include/openssl/evp.h:1259:27: note: declared here | 1259 | OSSL_DEPRECATEDIN_3_0 int EVP_PKEY_encrypt_old(unsigned char *enc_key, | | ^~~~~~~~~~~~~~~~~~~~ | crypto.c: In function 'crypto_error_t crypto_session_decode(const u_int8_t*, u_int32_t, alist*, CRYPTO_SESSION**)': | crypto.c:1333:51: warning: 'int EVP_PKEY_decrypt_old(unsigned char*, const unsigned char*, int, EVP_PKEY*)' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] | 1333 | cs->session_key_len = EVP_PKEY_decrypt(cs->session_key, ASN1_STRING_get0_data(ri->encryptedKey), | | ^ | /usr/include/openssl/evp.h:1255:27: note: declared here | 1255 | OSSL_DEPRECATEDIN_3_0 int EVP_PKEY_decrypt_old(unsigned char *dec_key, | | ^~~~~~~~~~~~~~~~~~~~ | make[3]: *** [Makefile:210: crypto.lo] Error 1 | make[3]: Leaving directory '/build/reproducible-path/bacula-15.0.3/src/lib' | | | ====== Error in /build/reproducible-path/bacula-15.0.3/src/lib ====== | | | make[2]: *** [Makefile:164: all] Error 1

Full buildlog https://breakpoint.cc/openssl-rebuild/logs-4/attempted/bacula_15.0.3-5_amd64-2026-04-19T09:55:30Z