[rpms/getdns] f45: Fix OpenSSL 4.0 compatibility

[rpms/getdns] f45: Fix OpenSSL 4.0 compatibility

[Filipe Rosset]

            A new commit has been pushed.

            Repo   : rpms/getdns
            Branch : f45
            Commit : fc7192ab811c29a2330603fcc175fe1d3822d1f6
            Author : Filipe Rosset <rosset.filipe@gmail.com>
            Date   : 2026-08-14T00:54:10-03:00
            Stats  : +68/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/getdns/c/fc7192ab811c29a2330603fcc175fe1d3822d1f6?branch=f45

            Log:
            Fix OpenSSL 4.0 compatibility

Resolves: rhbz#2503910

---
diff --git a/0001-fix-for-openssl4-compat.patch b/0001-fix-for-openssl4-compat.patch
new file mode 100644
index 0000000..8d6cae9
--- /dev/null
+++ b/0001-fix-for-openssl4-compat.patch
@@ -0,0 +1,66 @@
+Description: Fix OpenSSL 4.0 compatibility
+ Replace direct ASN1_BIT_STRING member access with ASN1_STRING_get0_data()
+ and ASN1_STRING_length() accessors. Use const for X509 accessor return
+ values.
+Author: Ravi Kant Sharma <ravi.kant.sharma@canonical.com>
+Forwarded: https://github.com/getdnsapi/getdns/pull/551
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2154951
+Bug-Debian: https://bugs.debian.org/1138405
+Last-Update: 2026-07-06
+
+Index: getdns/src/ssl_dane/danessl.c
+===================================================================
+--- getdns.orig/src/ssl_dane/danessl.c	2026-07-06 13:06:08.180052843 +0200
++++ getdns/src/ssl_dane/danessl.c	2026-07-06 13:06:22.591129526 +0200
+@@ -388,7 +388,7 @@
+     return 0;
+ }
+ 
+-static int set_issuer_name(X509 *cert, AUTHORITY_KEYID *akid, X509_NAME *subj)
++static int set_issuer_name(X509 *cert, AUTHORITY_KEYID *akid, const X509_NAME *subj)
+ {
+     X509_NAME *name = akid_issuer_name(akid);
+ 
+@@ -443,7 +443,7 @@
+     int ret = 1;
+     X509 *cert = 0;
+     AUTHORITY_KEYID *akid;
+-    X509_NAME *name = X509_get_issuer_name(subject);
++    const X509_NAME *name = X509_get_issuer_name(subject);
+     EVP_PKEY *newkey = key ? key : X509_get_pubkey(subject);
+ 
+ #define WRAP_MID 0		/* Ensure intermediate. */
+@@ -781,9 +781,9 @@
+ 
+ static char *parse_subject_name(X509 *cert)
+ {
+-    X509_NAME *name = X509_get_subject_name(cert);
+-    X509_NAME_ENTRY *entry;
+-    ASN1_STRING *entry_str;
++    const X509_NAME *name = X509_get_subject_name(cert);
++    const X509_NAME_ENTRY *entry;
++    const ASN1_STRING *entry_str;
+     unsigned char *namebuf;
+     int nid = NID_commonName;
+     int len;
+Index: getdns/src/tls/anchor-internal.c
+===================================================================
+--- getdns.orig/src/tls/anchor-internal.c	2026-07-06 13:06:08.180052843 +0200
++++ getdns/src/tls/anchor-internal.c	2026-07-06 13:06:08.174052812 +0200
+@@ -60,10 +60,12 @@
+ 	ASN1_BIT_STRING* s;
+ 
+ 	if((s=X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL))) {
+-		if(s->length > 0) {
+-			val = s->data[0];
+-			if(s->length > 1)
+-				val |= s->data[1] << 8;
++		const unsigned char *data = ASN1_STRING_get0_data(s);
++		int len = ASN1_STRING_length(s);
++		if(len > 0) {
++			val = data[0];
++			if(len > 1)
++				val |= data[1] << 8;
+ 		}
+ 		ASN1_BIT_STRING_free(s);
+ 	}

diff --git a/getdns.spec b/getdns.spec
index 81ee70c..de4afb8 100644
--- a/getdns.spec
+++ b/getdns.spec
@@ -15,6 +15,8 @@ Url: http://www.getdnsapi.net
 Source: http://www.getdnsapi.net/dist/%{name}-%{upstream_version}.tar.gz
 Source1: http://www.getdnsapi.net/dist/%{name}-%{upstream_version}.tar.gz.asc
 Source2: http://keys.gnupg.net/pks/lookup?op=get&search=0xE5F8F8212F77A498#/willem.nlnetlabs.nl
+# https://github.com/getdnsapi/getdns/pull/551
+Patch: 0001-fix-for-openssl4-compat.patch
 BuildRequires:  gcc
 BuildRequires: libidn2-devel unbound-devel doxygen libevent-devel
 BuildRequires: pkgconfig openssl-devel libyaml-devel