Source: duckdb
Version: 1.5.5-3
Severity: normal
Tags: patch ftbfs
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: origin-ubuntu tenacious ubuntu-patch
Hi,
duckdb fails to build against OpenSSL 4 (4.0.3-1 in experimental, and
in Ubuntu tenacious):
extension_external/quack/src/quack_ssl_key_generator.cpp:141:59: error:
invalid conversion from 'const X509_NAME*' {aka 'const X509_name_st*'} to
'X509_name_st*' [-fpermissive]
141 | X509_name_st *name =
X509_get_subject_name(cert.get());
https://launchpad.net/ubuntu/+source/duckdb/2.0.0+dfsg2-1/+build/33927871
OpenSSL 4 makes X509_get_subject_name() return a const X509_NAME, so
quack can no longer add the CN entry to the certificate's name in place.
The attached patch builds the name with X509_NAME_new() and sets it as
both subject and issuer. That works with OpenSSL 3 as well. With it,
duckdb builds in Ubuntu on amd64, arm64 and ppc64el.
It doesn't fail in unstable yet, which still has OpenSSL 3.6, so
severity normal for now. It becomes an FTBFS once OpenSSL 4 is uploaded
to unstable.
The code is the same in upstream duckdb-quack main.
Thanks,
Sebastien Bacher
-- System Information:
Debian Release: forky/sid
APT prefers resolute-updates
APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500,
'resolute'), (100, 'resolute-backports')
Architecture: amd64 (x86_64)
Kernel: Linux 7.0.0-43-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Description: quack: fix the build with OpenSSL 4
OpenSSL 4 makes X509_get_subject_name() return a const X509_NAME, so
the subject name can no longer be modified in place. Build the name with
X509_NAME_new() and set it as both subject and issuer. This also works
with OpenSSL 3.
Author: Sebastien Bacher <[email protected]>
Forwarded: https://github.com/duckdb/duckdb-quack/pull/355
Last-Update: 2026-11-08
---
Index:
duckdb-2.0.0+dfsg2/extension_external/quack/src/quack_ssl_key_generator.cpp
===================================================================
---
duckdb-2.0.0+dfsg2.orig/extension_external/quack/src/quack_ssl_key_generator.cpp
+++ duckdb-2.0.0+dfsg2/extension_external/quack/src/quack_ssl_key_generator.cpp
@@ -138,16 +138,22 @@ void SslKeyGenerator::GenerateSslKeys(co
ASN1_INTEGER_set(X509_get_serialNumber(cert.get()), 1);
X509_gmtime_adj(X509_get_notBefore(cert.get()), 0);
X509_gmtime_adj(X509_get_notAfter(cert.get()), cert_days_valid
* 24 * 3600);
- X509_name_st *name = X509_get_subject_name(cert.get());
+ // OpenSSL 4 returns a const X509_NAME from
X509_get_subject_name(),
+ // so build the name separately and set it as subject and issuer
+ std::unique_ptr<X509_NAME, void (*)(X509_NAME *)> name
{X509_NAME_new(), X509_NAME_free};
+ if (!name) {
+ throw std::runtime_error("Error creating certificate
name");
+ }
const unsigned char common_name[] = "localhost";
// TODO do we need this other stuff?
- // X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country,
-1, -1, 0);
- // X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company,
-1, -1, 0);
- X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC,
common_name, -1, -1, 0);
+ // X509_NAME_add_entry_by_txt(name.get(), "C", MBSTRING_ASC,
country, -1, -1, 0);
+ // X509_NAME_add_entry_by_txt(name.get(), "O", MBSTRING_ASC,
company, -1, -1, 0);
+ X509_NAME_add_entry_by_txt(name.get(), "CN", MBSTRING_ASC,
common_name, -1, -1, 0);
- if (X509_set_issuer_name(cert.get(), name) != 1 ||
X509_set_pubkey(cert.get(), rsa.get()) != 1 ||
+ if (X509_set_subject_name(cert.get(), name.get()) != 1 ||
+ X509_set_issuer_name(cert.get(), name.get()) != 1 ||
X509_set_pubkey(cert.get(), rsa.get()) != 1 ||
X509_sign(cert.get(), rsa.get(), EVP_sha256()) == 0) {
throw std::runtime_error("Error creating certificate");
}
