Build fails for version 47.0.0 with BoringSSL on Debian 13 (trixie)

[diafygi]

Howdy, I'm trying to follow these instructions for building cryptography using BoringSSL as the backend:

https://cryptography.io/en/latest/installation/#building-with-boringssl-libressl-or-aws-lc

However, I'm getting the following errors, when cryptography-cffi is trying to compile _openssl.c:

        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_checkfld_typedef_X509V3_CTX':
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2462:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types]
        cargo:warning= 2462 |   { X509 * *tmp = &p->issuer_cert; (void)tmp; }
        cargo:warning=      |                   ^
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2463:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types]
        cargo:warning= 2463 |   { X509 * *tmp = &p->subject_cert; (void)tmp; }
        cargo:warning=      |                   ^

My system is Debian 13 (trixie). Here's output for building boringssl (successfully builds):

debian@debian:/tmp$ git clone https://boringssl.googlesource.com/boringssl
Cloning into 'boringssl'...
remote: Sending approximately 348.57 MiB ...
remote: Counting objects: 36, done
remote: Total 134701 (delta 80496), reused 134701 (delta 80496)
Receiving objects: 100% (134701/134701), 348.54 MiB | 25.00 MiB/s, done.
Resolving deltas: 100% (80496/80496), done.
debian@debian:/tmp$ cd boringssl/
debian@debian:/tmp/boringssl$ cmake -GNinja -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DBUILD_SHARED_LIBS=1 -DCMAKE_INSTALL_PREFIX="/tmp/boringssl-install"
-- The C compiler identification is GNU 14.2.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- The CXX compiler identification is GNU 14.2.0
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/c++ - skipped
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Checking for module 'libunwind-generic>=1.3.0'
--   Package 'libunwind-generic', required by 'virtual:world', not found
libunwind not found. Disabling unwind tests.
-- The ASM compiler identification is GNU
-- Found assembler: /usr/bin/cc
-- Failed to find LLVM FileCheck
-- Found Git: /usr/bin/git (found version "2.47.3")
-- Google Benchmark version: v1.9.5, normalized to 1.9.5
-- Looking for shm_open in rt
-- Looking for shm_open in rt - found
-- Performing Test HAVE_CXX_FLAG_WALL
-- Performing Test HAVE_CXX_FLAG_WALL - Success
-- Performing Test HAVE_CXX_FLAG_WEXTRA
-- Performing Test HAVE_CXX_FLAG_WEXTRA - Success
-- Performing Test HAVE_CXX_FLAG_WSHADOW
-- Performing Test HAVE_CXX_FLAG_WSHADOW - Success
-- Performing Test HAVE_CXX_FLAG_WFLOAT_EQUAL
-- Performing Test HAVE_CXX_FLAG_WFLOAT_EQUAL - Success
-- Performing Test HAVE_CXX_FLAG_WOLD_STYLE_CAST
-- Performing Test HAVE_CXX_FLAG_WOLD_STYLE_CAST - Success
-- Performing Test HAVE_CXX_FLAG_WCONVERSION
-- Performing Test HAVE_CXX_FLAG_WCONVERSION - Success
-- Performing Test HAVE_CXX_FLAG_WFORMAT_2
-- Performing Test HAVE_CXX_FLAG_WFORMAT_2 - Success
-- Performing Test HAVE_CXX_FLAG_WERROR
-- Performing Test HAVE_CXX_FLAG_WERROR - Success
-- Performing Test HAVE_CXX_FLAG_WSUGGEST_OVERRIDE
-- Performing Test HAVE_CXX_FLAG_WSUGGEST_OVERRIDE - Success
-- Performing Test HAVE_CXX_FLAG_PEDANTIC
-- Performing Test HAVE_CXX_FLAG_PEDANTIC - Success
-- Performing Test HAVE_CXX_FLAG_PEDANTIC_ERRORS
-- Performing Test HAVE_CXX_FLAG_PEDANTIC_ERRORS - Success
-- Performing Test HAVE_CXX_FLAG_WSHORTEN_64_TO_32
-- Performing Test HAVE_CXX_FLAG_WSHORTEN_64_TO_32 - Failed
-- Performing Test HAVE_CXX_FLAG_FSTRICT_ALIASING
-- Performing Test HAVE_CXX_FLAG_FSTRICT_ALIASING - Success
-- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED_DECLARATIONS
-- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED_DECLARATIONS - Success
-- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED
-- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED - Success
-- Performing Test HAVE_CXX_FLAG_WSTRICT_ALIASING
-- Performing Test HAVE_CXX_FLAG_WSTRICT_ALIASING - Success
-- Performing Test HAVE_CXX_FLAG_WTHREAD_SAFETY
-- Performing Test HAVE_CXX_FLAG_WTHREAD_SAFETY - Failed
-- Performing Test HAVE_CXX_FLAG_COVERAGE
-- Performing Test HAVE_CXX_FLAG_COVERAGE - Success
-- Performing Test STD_REGEX -- success
-- Performing Test STEADY_CLOCK -- success
-- Performing Test CMAKE_HAVE_LIBC_PTHREAD
-- Performing Test CMAKE_HAVE_LIBC_PTHREAD - Success
-- Found Threads: TRUE
-- Performing Test PTHREAD_AFFINITY -- success
-- Configuring done (3.1s)
-- Generating done (0.0s)
-- Build files have been written to: /tmp/boringssl/build
debian@debian:/tmp/boringssl$ ninja -C build install
ninja: Entering directory `build'
[700/701] Install the project...
-- Install configuration: ""
-- Installing: /tmp/boringssl-install/lib/libcrypto.so
-- Installing: /tmp/boringssl-install/lib/libssl.so
-- Set non-toolchain portion of runtime path of "/tmp/boringssl-install/lib/libssl.so" to ""
-- Installing: /tmp/boringssl-install/bin/bssl
-- Set non-toolchain portion of runtime path of "/tmp/boringssl-install/bin/bssl" to ""
-- Installing: /tmp/boringssl-install/include
-- Installing: /tmp/boringssl-install/include/openssl
-- Installing: /tmp/boringssl-install/include/openssl/xwing.h
-- Installing: /tmp/boringssl-install/include/openssl/x509v3_errors.h
-- Installing: /tmp/boringssl-install/include/openssl/x509v3.h
-- Installing: /tmp/boringssl-install/include/openssl/x509_vfy.h
-- Installing: /tmp/boringssl-install/include/openssl/x509.h
-- Installing: /tmp/boringssl-install/include/openssl/type_check.h
-- Installing: /tmp/boringssl-install/include/openssl/trust_token.h
-- Installing: /tmp/boringssl-install/include/openssl/tls_prf.h
-- Installing: /tmp/boringssl-install/include/openssl/tls1.h
-- Installing: /tmp/boringssl-install/include/openssl/time.h
-- Installing: /tmp/boringssl-install/include/openssl/thread.h
-- Installing: /tmp/boringssl-install/include/openssl/target.h
-- Installing: /tmp/boringssl-install/include/openssl/stack.h
-- Installing: /tmp/boringssl-install/include/openssl/ssl3.h
-- Installing: /tmp/boringssl-install/include/openssl/ssl.h
-- Installing: /tmp/boringssl-install/include/openssl/srtp.h
-- Installing: /tmp/boringssl-install/include/openssl/span.h
-- Installing: /tmp/boringssl-install/include/openssl/slhdsa.h
-- Installing: /tmp/boringssl-install/include/openssl/siphash.h
-- Installing: /tmp/boringssl-install/include/openssl/sha2.h
-- Installing: /tmp/boringssl-install/include/openssl/sha.h
-- Installing: /tmp/boringssl-install/include/openssl/service_indicator.h
-- Installing: /tmp/boringssl-install/include/openssl/safestack.h
-- Installing: /tmp/boringssl-install/include/openssl/rsa.h
-- Installing: /tmp/boringssl-install/include/openssl/ripemd.h
-- Installing: /tmp/boringssl-install/include/openssl/rc4.h
-- Installing: /tmp/boringssl-install/include/openssl/rand.h
-- Installing: /tmp/boringssl-install/include/openssl/prefix_symbols_internal_c.h
-- Installing: /tmp/boringssl-install/include/openssl/prefix_symbols_internal_S.h
-- Installing: /tmp/boringssl-install/include/openssl/prefix_symbols.h
-- Installing: /tmp/boringssl-install/include/openssl/posix_time.h
-- Installing: /tmp/boringssl-install/include/openssl/pool.h
-- Installing: /tmp/boringssl-install/include/openssl/poly1305.h
-- Installing: /tmp/boringssl-install/include/openssl/pki
-- Installing: /tmp/boringssl-install/include/openssl/pki/verify_error.h
-- Installing: /tmp/boringssl-install/include/openssl/pki/verify.h
-- Installing: /tmp/boringssl-install/include/openssl/pki/signature_verify_cache.h
-- Installing: /tmp/boringssl-install/include/openssl/pki/ocsp.h
-- Installing: /tmp/boringssl-install/include/openssl/pki/certificate.h
-- Installing: /tmp/boringssl-install/include/openssl/pkcs8.h
-- Installing: /tmp/boringssl-install/include/openssl/pkcs7.h
-- Installing: /tmp/boringssl-install/include/openssl/pkcs12.h
-- Installing: /tmp/boringssl-install/include/openssl/pem.h
-- Installing: /tmp/boringssl-install/include/openssl/params.h
-- Installing: /tmp/boringssl-install/include/openssl/ossl_typ.h
-- Installing: /tmp/boringssl-install/include/openssl/opensslv.h
-- Installing: /tmp/boringssl-install/include/openssl/opensslconf.h
-- Installing: /tmp/boringssl-install/include/openssl/objects.h
-- Installing: /tmp/boringssl-install/include/openssl/obj_mac.h
-- Installing: /tmp/boringssl-install/include/openssl/obj.h
-- Installing: /tmp/boringssl-install/include/openssl/nid.h
-- Installing: /tmp/boringssl-install/include/openssl/mlkem.h
-- Installing: /tmp/boringssl-install/include/openssl/mldsa.h
-- Installing: /tmp/boringssl-install/include/openssl/mem.h
-- Installing: /tmp/boringssl-install/include/openssl/md5.h
-- Installing: /tmp/boringssl-install/include/openssl/md4.h
-- Installing: /tmp/boringssl-install/include/openssl/lhash.h
-- Installing: /tmp/boringssl-install/include/openssl/kdf.h
-- Installing: /tmp/boringssl-install/include/openssl/is_boringssl.h
-- Installing: /tmp/boringssl-install/include/openssl/hrss.h
-- Installing: /tmp/boringssl-install/include/openssl/hpke.h
-- Installing: /tmp/boringssl-install/include/openssl/hmac.h
-- Installing: /tmp/boringssl-install/include/openssl/hkdf.h
-- Installing: /tmp/boringssl-install/include/openssl/ex_data.h
-- Installing: /tmp/boringssl-install/include/openssl/evp_errors.h
-- Installing: /tmp/boringssl-install/include/openssl/evp.h
-- Installing: /tmp/boringssl-install/include/openssl/err.h
-- Installing: /tmp/boringssl-install/include/openssl/engine.h
-- Installing: /tmp/boringssl-install/include/openssl/ecdsa.h
-- Installing: /tmp/boringssl-install/include/openssl/ecdh.h
-- Installing: /tmp/boringssl-install/include/openssl/ec_key.h
-- Installing: /tmp/boringssl-install/include/openssl/ec.h
-- Installing: /tmp/boringssl-install/include/openssl/e_os2.h
-- Installing: /tmp/boringssl-install/include/openssl/dtls1.h
-- Installing: /tmp/boringssl-install/include/openssl/dsa.h
-- Installing: /tmp/boringssl-install/include/openssl/digest.h
-- Installing: /tmp/boringssl-install/include/openssl/dh.h
-- Installing: /tmp/boringssl-install/include/openssl/des.h
-- Installing: /tmp/boringssl-install/include/openssl/curve25519.h
-- Installing: /tmp/boringssl-install/include/openssl/ctrdrbg.h
-- Installing: /tmp/boringssl-install/include/openssl/crypto.h
-- Installing: /tmp/boringssl-install/include/openssl/cpu.h
-- Installing: /tmp/boringssl-install/include/openssl/conf.h
-- Installing: /tmp/boringssl-install/include/openssl/cms.h
-- Installing: /tmp/boringssl-install/include/openssl/cmac.h
-- Installing: /tmp/boringssl-install/include/openssl/cipher.h
-- Installing: /tmp/boringssl-install/include/openssl/chacha.h
-- Installing: /tmp/boringssl-install/include/openssl/cast.h
-- Installing: /tmp/boringssl-install/include/openssl/bytestring.h
-- Installing: /tmp/boringssl-install/include/openssl/buffer.h
-- Installing: /tmp/boringssl-install/include/openssl/buf.h
-- Installing: /tmp/boringssl-install/include/openssl/bn.h
-- Installing: /tmp/boringssl-install/include/openssl/blowfish.h
-- Installing: /tmp/boringssl-install/include/openssl/blake2.h
-- Installing: /tmp/boringssl-install/include/openssl/bio.h
-- Installing: /tmp/boringssl-install/include/openssl/base64.h
-- Installing: /tmp/boringssl-install/include/openssl/base.h
-- Installing: /tmp/boringssl-install/include/openssl/asn1t.h
-- Installing: /tmp/boringssl-install/include/openssl/asn1_mac.h
-- Installing: /tmp/boringssl-install/include/openssl/asn1.h
-- Installing: /tmp/boringssl-install/include/openssl/asm_base.h
-- Installing: /tmp/boringssl-install/include/openssl/arm_arch.h
-- Installing: /tmp/boringssl-install/include/openssl/aes.h
-- Installing: /tmp/boringssl-install/include/openssl/aead.h
-- Installing: /tmp/boringssl-install/lib/cmake/OpenSSL/OpenSSLTargets.cmake
-- Installing: /tmp/boringssl-install/lib/cmake/OpenSSL/OpenSSLTargets-noconfig.cmake
-- Installing: /tmp/boringssl-install/lib/cmake/OpenSSL/OpenSSLConfig.cmake

Here's my full output for trying to install cryptography (which fails during _openssl.c compilation):

debian@debian:/tmp$ python3 -m venv venv
debian@debian:/tmp$ source venv/bin/activate
(venv) debian@debian:/tmp$ OPENSSL_DIR="/tmp/boringssl-install" pip install --no-cache-dir --no-binary cryptography cryptography
Collecting cryptography
  Downloading cryptography-47.0.0.tar.gz (830 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 830.9/830.9 kB 10.2 MB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Collecting cffi>=2.0.0 (from cryptography)
  Downloading cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl.metadata (2.6 kB)
Collecting pycparser (from cffi>=2.0.0->cryptography)
  Downloading pycparser-3.0-py3-none-any.whl.metadata (8.2 kB)
Downloading cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl (219 kB)
Downloading pycparser-3.0-py3-none-any.whl (48 kB)
Building wheels for collected packages: cryptography
  Building wheel for cryptography (pyproject.toml) ... error
  error: subprocess-exited-with-error
  
  × Building wheel for cryptography (pyproject.toml) did not run successfully.
  │ exit code: 1
  ╰─> [756 lines of output]
      Running `maturin pep517 build-wheel -i /tmp/venv/bin/python3 --compatibility off`
      🍹 Building a mixed python/rust project
      🔗 Found pyo3 bindings with abi3 support
      🐍 Found CPython 3.13 at /tmp/venv/bin/python3
      📡 Using build options locked from pyproject.toml
         Compiling target-lexicon v0.13.5
         Compiling proc-macro2 v1.0.106
         Compiling quote v1.0.45
         Compiling unicode-ident v1.0.24
         Compiling find-msvc-tools v0.1.9
         Compiling shlex v1.3.0
         Compiling vcpkg v0.2.15
         Compiling pkg-config v0.3.33
         Compiling libc v0.2.186
         Compiling cc v1.2.60
         Compiling once_cell v1.21.4
         Compiling openssl v0.10.78
         Compiling heck v0.5.0
         Compiling foreign-types-shared v0.1.1
         Compiling foreign-types v0.3.2
         Compiling itoa v1.0.18
         Compiling cfg-if v1.0.4
         Compiling bitflags v2.11.1
         Compiling cryptography-openssl v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-openssl)
         Compiling pyo3-build-config v0.28.3
         Compiling base64 v0.22.1
         Compiling cryptography-key-parsing v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-key-parsing)
         Compiling self_cell v1.2.2
         Compiling pem v3.0.6
         Compiling syn v2.0.117
         Compiling openssl-sys v0.9.114
         Compiling cryptography-cffi v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-cffi)
         Compiling pyo3-ffi v0.28.3
         Compiling pyo3-macros-backend v0.28.3
         Compiling pyo3 v0.28.3
         Compiling cryptography-rust v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust)
         Compiling openssl-macros v0.1.1
         Compiling asn1_derive v0.24.1
         Compiling asn1 v0.24.1
         Compiling cryptography-x509 v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-x509)
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_checkfld_typedef_X509V3_CTX':
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2462:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types]
      warning: cryptography-cffi@0.1.0:  2462 |   { X509 * *tmp = &p->issuer_cert; (void)tmp; }
      warning: cryptography-cffi@0.1.0:       |                   ^
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2463:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types]
      warning: cryptography-cffi@0.1.0:  2463 |   { X509 * *tmp = &p->subject_cert; (void)tmp; }
      warning: cryptography-cffi@0.1.0:       |                   ^
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_d_DSA_generate_parameters_ex':
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:5837:41: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Wsign-conversion]
      warning: cryptography-cffi@0.1.0:  5837 |   return DSA_generate_parameters_ex(x0, x1, x2, x3, x4, x5, x6);
      warning: cryptography-cffi@0.1.0:       |                                         ^~
      ...
      SNIP: many more warnings removed
      ...
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_f_sk_X509_value':
      warning: cryptography-cffi@0.1.0: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:21620:32: warning: conversion to 'size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
      warning: cryptography-cffi@0.1.0: 21620 |   { result = sk_X509_value(x0, x1); }
      warning: cryptography-cffi@0.1.0:       |                                ^~
      error: failed to run custom build command for `cryptography-cffi v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-cffi)`
      
      Caused by:
        process didn't exit successfully: `/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-4216e6fbe89a516c/build-script-build` (exit status: 1)
        --- stdout
        cargo:rerun-if-env-changed=PYO3_PYTHON
        cargo:rerun-if-changed=../../_cffi_src/
        cargo:rerun-if-changed=../../cryptography/__about__.py
        cargo:rustc-cfg=python_implementation="CPython"
        cargo:rerun-if-env-changed=CC_FORCE_DISABLE
        CC_FORCE_DISABLE = None
        cargo:rerun-if-env-changed=CC_x86_64-unknown-linux-gnu
        CC_x86_64-unknown-linux-gnu = None
        cargo:rerun-if-env-changed=CC_x86_64_unknown_linux_gnu
        CC_x86_64_unknown_linux_gnu = None
        cargo:rerun-if-env-changed=HOST_CC
        HOST_CC = None
        cargo:rerun-if-env-changed=CC
        CC = None
        cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT
        cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS
        CRATE_CC_NO_DEFAULTS = None
        cargo:rerun-if-env-changed=CFLAGS
        CFLAGS = None
        cargo:rerun-if-env-changed=HOST_CFLAGS
        HOST_CFLAGS = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu
        CFLAGS_x86_64_unknown_linux_gnu = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu
        CFLAGS_x86_64-unknown-linux-gnu = None
        cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT
        cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS
        CRATE_CC_NO_DEFAULTS = None
        cargo:rerun-if-env-changed=CFLAGS
        CFLAGS = None
        cargo:rerun-if-env-changed=HOST_CFLAGS
        HOST_CFLAGS = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu
        CFLAGS_x86_64_unknown_linux_gnu = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu
        CFLAGS_x86_64-unknown-linux-gnu = None
        cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT
        cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS
        CRATE_CC_NO_DEFAULTS = None
        cargo:rerun-if-env-changed=CFLAGS
        CFLAGS = None
        cargo:rerun-if-env-changed=HOST_CFLAGS
        HOST_CFLAGS = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu
        CFLAGS_x86_64_unknown_linux_gnu = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu
        CFLAGS_x86_64-unknown-linux-gnu = None
        cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT
        cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS
        CRATE_CC_NO_DEFAULTS = None
        cargo:rerun-if-env-changed=CFLAGS
        CFLAGS = None
        cargo:rerun-if-env-changed=HOST_CFLAGS
        HOST_CFLAGS = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu
        CFLAGS_x86_64_unknown_linux_gnu = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu
        CFLAGS_x86_64-unknown-linux-gnu = None
        cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT
        cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS
        CRATE_CC_NO_DEFAULTS = None
        cargo:rerun-if-env-changed=CFLAGS
        CFLAGS = None
        cargo:rerun-if-env-changed=HOST_CFLAGS
        HOST_CFLAGS = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu
        CFLAGS_x86_64_unknown_linux_gnu = None
        cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu
        CFLAGS_x86_64-unknown-linux-gnu = None
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_checkfld_typedef_X509V3_CTX':
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2462:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types]
        cargo:warning= 2462 |   { X509 * *tmp = &p->issuer_cert; (void)tmp; }
        cargo:warning=      |                   ^
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2463:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types]
        cargo:warning= 2463 |   { X509 * *tmp = &p->subject_cert; (void)tmp; }
        cargo:warning=      |                   ^
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_d_DSA_generate_parameters_ex':
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:5837:41: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Wsign-conversion]
        cargo:warning= 5837 |   return DSA_generate_parameters_ex(x0, x1, x2, x3, x4, x5, x6);
        cargo:warning=      |                                         ^~
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:5837:49: warning: conversion to 'size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
        ...
        SNIP: many more warnings removed
        ...
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_f_sk_X509_value':
        cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:21620:32: warning: conversion to 'size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
        cargo:warning=21620 |   { result = sk_X509_value(x0, x1); }
        cargo:warning=      |                                ^~
      
        --- stderr
      
      
        error occurred in cc-rs: command did not execute successfully (status code exit status: 1): LC_ALL="C" "cc" "-O3" "-ffunction-sections" "-fdata-sections" "-fPIC" "-m64" "-I" "/tmp/boringssl-install/include" "-I" "/tmp/venv/include" "-I" "/usr/include/python3.13" "-Wall" "-Wextra" "-Wconversion" "-Wno-error=sign-conversion" "-Wno-unused-parameter" "-fmacro-prefix-map=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out=." "-DPy_LIMITED_API=0x030800f0" "-o" "/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/b15af52c22fd75a7-_openssl.o" "-c" "/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c"
      
      
      warning: build failed, waiting for other jobs to finish...
      💥 maturin failed
        Caused by: Failed to build a native library through cargo
        Caused by: Cargo build finished with "exit status: 101": `env -u CARGO PYO3_BUILD_EXTENSION_MODULE="1" PYO3_ENVIRONMENT_SIGNATURE="cpython-3.13-64bit" PYO3_PYTHON="/tmp/venv/bin/python3" PYTHON_SYS_EXECUTABLE="/tmp/venv/bin/python3" "cargo" "rustc" "--profile" "release" "--message-format" "json-render-diagnostics" "--locked" "--manifest-path" "/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/Cargo.toml" "--lib"`
      Error: command ['maturin', 'pep517', 'build-wheel', '-i', '/tmp/venv/bin/python3', '--compatibility', 'off'] returned non-zero exit status 1
      [end of output]
  
  note: This error originates from a subprocess, and is likely not a problem with pip.
  ERROR: Failed building wheel for cryptography
Failed to build cryptography
ERROR: Failed to build installable wheels for some pyproject.toml based projects (cryptography)

[alex]

What version of boring ssl are you using? We test with latest head only All that is necessary for evil to succeed is for good people to do nothing.

…

On Mon, Apr 27, 2026, 8:36 AM Daniel Roesler ***@***.***> wrote: *diafygi* created an issue (pyca/cryptography#14754) <#14754> Howdy, I'm trying to follow these instructions for building cryptography using BoringSSL as the backend: https://cryptography.io/en/latest/installation/#building-with-boringssl-libressl-or-aws-lc However, I'm getting the following errors, when cryptography-cffi is trying to compile _openssl.c: cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_checkfld_typedef_X509V3_CTX': cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2462:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types] cargo:warning= 2462 | { X509 * *tmp = &p->issuer_cert; (void)tmp; } cargo:warning= | ^ cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2463:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types] cargo:warning= 2463 | { X509 * *tmp = &p->subject_cert; (void)tmp; } cargo:warning= | ^ My system is Debian 13 (trixie). Here's output for building boringssl (successfully builds): ***@***.***:/tmp$ git clone https://boringssl.googlesource.com/boringssl Cloning into 'boringssl'... remote: Sending approximately 348.57 MiB ... remote: Counting objects: 36, done remote: Total 134701 (delta 80496), reused 134701 (delta 80496) Receiving objects: 100% (134701/134701), 348.54 MiB | 25.00 MiB/s, done. Resolving deltas: 100% (80496/80496), done. ***@***.***:/tmp$ cd boringssl/ ***@***.***:/tmp/boringssl$ cmake -GNinja -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DBUILD_SHARED_LIBS=1 -DCMAKE_INSTALL_PREFIX="/tmp/boringssl-install" -- The C compiler identification is GNU 14.2.0 -- Detecting C compiler ABI info -- Detecting C compiler ABI info - done -- Check for working C compiler: /usr/bin/cc - skipped -- Detecting C compile features -- Detecting C compile features - done -- The CXX compiler identification is GNU 14.2.0 -- Detecting CXX compiler ABI info -- Detecting CXX compiler ABI info - done -- Check for working CXX compiler: /usr/bin/c++ - skipped -- Detecting CXX compile features -- Detecting CXX compile features - done -- Checking for module 'libunwind-generic>=1.3.0' -- Package 'libunwind-generic', required by 'virtual:world', not found libunwind not found. Disabling unwind tests. -- The ASM compiler identification is GNU -- Found assembler: /usr/bin/cc -- Failed to find LLVM FileCheck -- Found Git: /usr/bin/git (found version "2.47.3") -- Google Benchmark version: v1.9.5, normalized to 1.9.5 -- Looking for shm_open in rt -- Looking for shm_open in rt - found -- Performing Test HAVE_CXX_FLAG_WALL -- Performing Test HAVE_CXX_FLAG_WALL - Success -- Performing Test HAVE_CXX_FLAG_WEXTRA -- Performing Test HAVE_CXX_FLAG_WEXTRA - Success -- Performing Test HAVE_CXX_FLAG_WSHADOW -- Performing Test HAVE_CXX_FLAG_WSHADOW - Success -- Performing Test HAVE_CXX_FLAG_WFLOAT_EQUAL -- Performing Test HAVE_CXX_FLAG_WFLOAT_EQUAL - Success -- Performing Test HAVE_CXX_FLAG_WOLD_STYLE_CAST -- Performing Test HAVE_CXX_FLAG_WOLD_STYLE_CAST - Success -- Performing Test HAVE_CXX_FLAG_WCONVERSION -- Performing Test HAVE_CXX_FLAG_WCONVERSION - Success -- Performing Test HAVE_CXX_FLAG_WFORMAT_2 -- Performing Test HAVE_CXX_FLAG_WFORMAT_2 - Success -- Performing Test HAVE_CXX_FLAG_WERROR -- Performing Test HAVE_CXX_FLAG_WERROR - Success -- Performing Test HAVE_CXX_FLAG_WSUGGEST_OVERRIDE -- Performing Test HAVE_CXX_FLAG_WSUGGEST_OVERRIDE - Success -- Performing Test HAVE_CXX_FLAG_PEDANTIC -- Performing Test HAVE_CXX_FLAG_PEDANTIC - Success -- Performing Test HAVE_CXX_FLAG_PEDANTIC_ERRORS -- Performing Test HAVE_CXX_FLAG_PEDANTIC_ERRORS - Success -- Performing Test HAVE_CXX_FLAG_WSHORTEN_64_TO_32 -- Performing Test HAVE_CXX_FLAG_WSHORTEN_64_TO_32 - Failed -- Performing Test HAVE_CXX_FLAG_FSTRICT_ALIASING -- Performing Test HAVE_CXX_FLAG_FSTRICT_ALIASING - Success -- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED_DECLARATIONS -- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED_DECLARATIONS - Success -- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED -- Performing Test HAVE_CXX_FLAG_WNO_DEPRECATED - Success -- Performing Test HAVE_CXX_FLAG_WSTRICT_ALIASING -- Performing Test HAVE_CXX_FLAG_WSTRICT_ALIASING - Success -- Performing Test HAVE_CXX_FLAG_WTHREAD_SAFETY -- Performing Test HAVE_CXX_FLAG_WTHREAD_SAFETY - Failed -- Performing Test HAVE_CXX_FLAG_COVERAGE -- Performing Test HAVE_CXX_FLAG_COVERAGE - Success -- Performing Test STD_REGEX -- success -- Performing Test STEADY_CLOCK -- success -- Performing Test CMAKE_HAVE_LIBC_PTHREAD -- Performing Test CMAKE_HAVE_LIBC_PTHREAD - Success -- Found Threads: TRUE -- Performing Test PTHREAD_AFFINITY -- success -- Configuring done (3.1s) -- Generating done (0.0s) -- Build files have been written to: /tmp/boringssl/build ***@***.***:/tmp/boringssl$ ninja -C build install ninja: Entering directory `build' [700/701] Install the project... -- Install configuration: "" -- Installing: /tmp/boringssl-install/lib/libcrypto.so -- Installing: /tmp/boringssl-install/lib/libssl.so -- Set non-toolchain portion of runtime path of "/tmp/boringssl-install/lib/libssl.so" to "" -- Installing: /tmp/boringssl-install/bin/bssl -- Set non-toolchain portion of runtime path of "/tmp/boringssl-install/bin/bssl" to "" -- Installing: /tmp/boringssl-install/include -- Installing: /tmp/boringssl-install/include/openssl -- Installing: /tmp/boringssl-install/include/openssl/xwing.h -- Installing: /tmp/boringssl-install/include/openssl/x509v3_errors.h -- Installing: /tmp/boringssl-install/include/openssl/x509v3.h -- Installing: /tmp/boringssl-install/include/openssl/x509_vfy.h -- Installing: /tmp/boringssl-install/include/openssl/x509.h -- Installing: /tmp/boringssl-install/include/openssl/type_check.h -- Installing: /tmp/boringssl-install/include/openssl/trust_token.h -- Installing: /tmp/boringssl-install/include/openssl/tls_prf.h -- Installing: /tmp/boringssl-install/include/openssl/tls1.h -- Installing: /tmp/boringssl-install/include/openssl/time.h -- Installing: /tmp/boringssl-install/include/openssl/thread.h -- Installing: /tmp/boringssl-install/include/openssl/target.h -- Installing: /tmp/boringssl-install/include/openssl/stack.h -- Installing: /tmp/boringssl-install/include/openssl/ssl3.h -- Installing: /tmp/boringssl-install/include/openssl/ssl.h -- Installing: /tmp/boringssl-install/include/openssl/srtp.h -- Installing: /tmp/boringssl-install/include/openssl/span.h -- Installing: /tmp/boringssl-install/include/openssl/slhdsa.h -- Installing: /tmp/boringssl-install/include/openssl/siphash.h -- Installing: /tmp/boringssl-install/include/openssl/sha2.h -- Installing: /tmp/boringssl-install/include/openssl/sha.h -- Installing: /tmp/boringssl-install/include/openssl/service_indicator.h -- Installing: /tmp/boringssl-install/include/openssl/safestack.h -- Installing: /tmp/boringssl-install/include/openssl/rsa.h -- Installing: /tmp/boringssl-install/include/openssl/ripemd.h -- Installing: /tmp/boringssl-install/include/openssl/rc4.h -- Installing: /tmp/boringssl-install/include/openssl/rand.h -- Installing: /tmp/boringssl-install/include/openssl/prefix_symbols_internal_c.h -- Installing: /tmp/boringssl-install/include/openssl/prefix_symbols_internal_S.h -- Installing: /tmp/boringssl-install/include/openssl/prefix_symbols.h -- Installing: /tmp/boringssl-install/include/openssl/posix_time.h -- Installing: /tmp/boringssl-install/include/openssl/pool.h -- Installing: /tmp/boringssl-install/include/openssl/poly1305.h -- Installing: /tmp/boringssl-install/include/openssl/pki -- Installing: /tmp/boringssl-install/include/openssl/pki/verify_error.h -- Installing: /tmp/boringssl-install/include/openssl/pki/verify.h -- Installing: /tmp/boringssl-install/include/openssl/pki/signature_verify_cache.h -- Installing: /tmp/boringssl-install/include/openssl/pki/ocsp.h -- Installing: /tmp/boringssl-install/include/openssl/pki/certificate.h -- Installing: /tmp/boringssl-install/include/openssl/pkcs8.h -- Installing: /tmp/boringssl-install/include/openssl/pkcs7.h -- Installing: /tmp/boringssl-install/include/openssl/pkcs12.h -- Installing: /tmp/boringssl-install/include/openssl/pem.h -- Installing: /tmp/boringssl-install/include/openssl/params.h -- Installing: /tmp/boringssl-install/include/openssl/ossl_typ.h -- Installing: /tmp/boringssl-install/include/openssl/opensslv.h -- Installing: /tmp/boringssl-install/include/openssl/opensslconf.h -- Installing: /tmp/boringssl-install/include/openssl/objects.h -- Installing: /tmp/boringssl-install/include/openssl/obj_mac.h -- Installing: /tmp/boringssl-install/include/openssl/obj.h -- Installing: /tmp/boringssl-install/include/openssl/nid.h -- Installing: /tmp/boringssl-install/include/openssl/mlkem.h -- Installing: /tmp/boringssl-install/include/openssl/mldsa.h -- Installing: /tmp/boringssl-install/include/openssl/mem.h -- Installing: /tmp/boringssl-install/include/openssl/md5.h -- Installing: /tmp/boringssl-install/include/openssl/md4.h -- Installing: /tmp/boringssl-install/include/openssl/lhash.h -- Installing: /tmp/boringssl-install/include/openssl/kdf.h -- Installing: /tmp/boringssl-install/include/openssl/is_boringssl.h -- Installing: /tmp/boringssl-install/include/openssl/hrss.h -- Installing: /tmp/boringssl-install/include/openssl/hpke.h -- Installing: /tmp/boringssl-install/include/openssl/hmac.h -- Installing: /tmp/boringssl-install/include/openssl/hkdf.h -- Installing: /tmp/boringssl-install/include/openssl/ex_data.h -- Installing: /tmp/boringssl-install/include/openssl/evp_errors.h -- Installing: /tmp/boringssl-install/include/openssl/evp.h -- Installing: /tmp/boringssl-install/include/openssl/err.h -- Installing: /tmp/boringssl-install/include/openssl/engine.h -- Installing: /tmp/boringssl-install/include/openssl/ecdsa.h -- Installing: /tmp/boringssl-install/include/openssl/ecdh.h -- Installing: /tmp/boringssl-install/include/openssl/ec_key.h -- Installing: /tmp/boringssl-install/include/openssl/ec.h -- Installing: /tmp/boringssl-install/include/openssl/e_os2.h -- Installing: /tmp/boringssl-install/include/openssl/dtls1.h -- Installing: /tmp/boringssl-install/include/openssl/dsa.h -- Installing: /tmp/boringssl-install/include/openssl/digest.h -- Installing: /tmp/boringssl-install/include/openssl/dh.h -- Installing: /tmp/boringssl-install/include/openssl/des.h -- Installing: /tmp/boringssl-install/include/openssl/curve25519.h -- Installing: /tmp/boringssl-install/include/openssl/ctrdrbg.h -- Installing: /tmp/boringssl-install/include/openssl/crypto.h -- Installing: /tmp/boringssl-install/include/openssl/cpu.h -- Installing: /tmp/boringssl-install/include/openssl/conf.h -- Installing: /tmp/boringssl-install/include/openssl/cms.h -- Installing: /tmp/boringssl-install/include/openssl/cmac.h -- Installing: /tmp/boringssl-install/include/openssl/cipher.h -- Installing: /tmp/boringssl-install/include/openssl/chacha.h -- Installing: /tmp/boringssl-install/include/openssl/cast.h -- Installing: /tmp/boringssl-install/include/openssl/bytestring.h -- Installing: /tmp/boringssl-install/include/openssl/buffer.h -- Installing: /tmp/boringssl-install/include/openssl/buf.h -- Installing: /tmp/boringssl-install/include/openssl/bn.h -- Installing: /tmp/boringssl-install/include/openssl/blowfish.h -- Installing: /tmp/boringssl-install/include/openssl/blake2.h -- Installing: /tmp/boringssl-install/include/openssl/bio.h -- Installing: /tmp/boringssl-install/include/openssl/base64.h -- Installing: /tmp/boringssl-install/include/openssl/base.h -- Installing: /tmp/boringssl-install/include/openssl/asn1t.h -- Installing: /tmp/boringssl-install/include/openssl/asn1_mac.h -- Installing: /tmp/boringssl-install/include/openssl/asn1.h -- Installing: /tmp/boringssl-install/include/openssl/asm_base.h -- Installing: /tmp/boringssl-install/include/openssl/arm_arch.h -- Installing: /tmp/boringssl-install/include/openssl/aes.h -- Installing: /tmp/boringssl-install/include/openssl/aead.h -- Installing: /tmp/boringssl-install/lib/cmake/OpenSSL/OpenSSLTargets.cmake -- Installing: /tmp/boringssl-install/lib/cmake/OpenSSL/OpenSSLTargets-noconfig.cmake -- Installing: /tmp/boringssl-install/lib/cmake/OpenSSL/OpenSSLConfig.cmake Here's my full output for trying to install cryptography (which fails during _openssl.c compilation): ***@***.***:/tmp$ python3 -m venv venv ***@***.***:/tmp$ source venv/bin/activate (venv) ***@***.***:/tmp$ OPENSSL_DIR="/tmp/boringssl-install" pip install --no-cache-dir --no-binary cryptography cryptography Collecting cryptography Downloading cryptography-47.0.0.tar.gz (830 kB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 830.9/830.9 kB 10.2 MB/s eta 0:00:00 Installing build dependencies ... done Getting requirements to build wheel ... done Preparing metadata (pyproject.toml) ... done Collecting cffi>=2.0.0 (from cryptography) Downloading cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl.metadata (2.6 kB) Collecting pycparser (from cffi>=2.0.0->cryptography) Downloading pycparser-3.0-py3-none-any.whl.metadata (8.2 kB) Downloading cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl (219 kB) Downloading pycparser-3.0-py3-none-any.whl (48 kB) Building wheels for collected packages: cryptography Building wheel for cryptography (pyproject.toml) ... error error: subprocess-exited-with-error × Building wheel for cryptography (pyproject.toml) did not run successfully. │ exit code: 1 ╰─> [756 lines of output] Running `maturin pep517 build-wheel -i /tmp/venv/bin/python3 --compatibility off` 🍹 Building a mixed python/rust project 🔗 Found pyo3 bindings with abi3 support 🐍 Found CPython 3.13 at /tmp/venv/bin/python3 📡 Using build options locked from pyproject.toml Compiling target-lexicon v0.13.5 Compiling proc-macro2 v1.0.106 Compiling quote v1.0.45 Compiling unicode-ident v1.0.24 Compiling find-msvc-tools v0.1.9 Compiling shlex v1.3.0 Compiling vcpkg v0.2.15 Compiling pkg-config v0.3.33 Compiling libc v0.2.186 Compiling cc v1.2.60 Compiling once_cell v1.21.4 Compiling openssl v0.10.78 Compiling heck v0.5.0 Compiling foreign-types-shared v0.1.1 Compiling foreign-types v0.3.2 Compiling itoa v1.0.18 Compiling cfg-if v1.0.4 Compiling bitflags v2.11.1 Compiling cryptography-openssl v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-openssl) Compiling pyo3-build-config v0.28.3 Compiling base64 v0.22.1 Compiling cryptography-key-parsing v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-key-parsing) Compiling self_cell v1.2.2 Compiling pem v3.0.6 Compiling syn v2.0.117 Compiling openssl-sys v0.9.114 Compiling cryptography-cffi v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-cffi) Compiling pyo3-ffi v0.28.3 Compiling pyo3-macros-backend v0.28.3 Compiling pyo3 v0.28.3 Compiling cryptography-rust v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust) Compiling openssl-macros v0.1.1 Compiling asn1_derive v0.24.1 Compiling asn1 v0.24.1 Compiling cryptography-x509 v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-x509) warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_checkfld_typedef_X509V3_CTX': warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2462:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types] warning: ***@***.***: 2462 | { X509 * *tmp = &p->issuer_cert; (void)tmp; } warning: ***@***.***: | ^ warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2463:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types] warning: ***@***.***: 2463 | { X509 * *tmp = &p->subject_cert; (void)tmp; } warning: ***@***.***: | ^ warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_d_DSA_generate_parameters_ex': warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:5837:41: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Wsign-conversion] warning: ***@***.***: 5837 | return DSA_generate_parameters_ex(x0, x1, x2, x3, x4, x5, x6); warning: ***@***.***: | ^~ ... SNIP: many more warnings removed ... warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_f_sk_X509_value': warning: ***@***.***: /tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:21620:32: warning: conversion to 'size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion] warning: ***@***.***: 21620 | { result = sk_X509_value(x0, x1); } warning: ***@***.***: | ^~ error: failed to run custom build command for `cryptography-cffi v0.1.0 (/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/cryptography-cffi)` Caused by: process didn't exit successfully: `/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-4216e6fbe89a516c/build-script-build` (exit status: 1) --- stdout cargo:rerun-if-env-changed=PYO3_PYTHON cargo:rerun-if-changed=../../_cffi_src/ cargo:rerun-if-changed=../../cryptography/__about__.py cargo:rustc-cfg=python_implementation="CPython" cargo:rerun-if-env-changed=CC_FORCE_DISABLE CC_FORCE_DISABLE = None cargo:rerun-if-env-changed=CC_x86_64-unknown-linux-gnu CC_x86_64-unknown-linux-gnu = None cargo:rerun-if-env-changed=CC_x86_64_unknown_linux_gnu CC_x86_64_unknown_linux_gnu = None cargo:rerun-if-env-changed=HOST_CC HOST_CC = None cargo:rerun-if-env-changed=CC CC = None cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS CRATE_CC_NO_DEFAULTS = None cargo:rerun-if-env-changed=CFLAGS CFLAGS = None cargo:rerun-if-env-changed=HOST_CFLAGS HOST_CFLAGS = None cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu CFLAGS_x86_64_unknown_linux_gnu = None cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu CFLAGS_x86_64-unknown-linux-gnu = None cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS CRATE_CC_NO_DEFAULTS = None cargo:rerun-if-env-changed=CFLAGS CFLAGS = None cargo:rerun-if-env-changed=HOST_CFLAGS HOST_CFLAGS = None cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu CFLAGS_x86_64_unknown_linux_gnu = None cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu CFLAGS_x86_64-unknown-linux-gnu = None cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS CRATE_CC_NO_DEFAULTS = None cargo:rerun-if-env-changed=CFLAGS CFLAGS = None cargo:rerun-if-env-changed=HOST_CFLAGS HOST_CFLAGS = None cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu CFLAGS_x86_64_unknown_linux_gnu = None cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu CFLAGS_x86_64-unknown-linux-gnu = None cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS CRATE_CC_NO_DEFAULTS = None cargo:rerun-if-env-changed=CFLAGS CFLAGS = None cargo:rerun-if-env-changed=HOST_CFLAGS HOST_CFLAGS = None cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu CFLAGS_x86_64_unknown_linux_gnu = None cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu CFLAGS_x86_64-unknown-linux-gnu = None cargo:rerun-if-env-changed=CC_ENABLE_DEBUG_OUTPUT cargo:rerun-if-env-changed=CRATE_CC_NO_DEFAULTS CRATE_CC_NO_DEFAULTS = None cargo:rerun-if-env-changed=CFLAGS CFLAGS = None cargo:rerun-if-env-changed=HOST_CFLAGS HOST_CFLAGS = None cargo:rerun-if-env-changed=CFLAGS_x86_64_unknown_linux_gnu CFLAGS_x86_64_unknown_linux_gnu = None cargo:rerun-if-env-changed=CFLAGS_x86_64-unknown-linux-gnu CFLAGS_x86_64-unknown-linux-gnu = None cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_checkfld_typedef_X509V3_CTX': cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2462:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types] cargo:warning= 2462 | { X509 * *tmp = &p->issuer_cert; (void)tmp; } cargo:warning= | ^ cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:2463:19: error: initialization of 'X509 **' {aka 'struct x509_st **'} from incompatible pointer type 'const X509 **' {aka 'const struct x509_st **'} [-Wincompatible-pointer-types] cargo:warning= 2463 | { X509 * *tmp = &p->subject_cert; (void)tmp; } cargo:warning= | ^ cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_d_DSA_generate_parameters_ex': cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:5837:41: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Wsign-conversion] cargo:warning= 5837 | return DSA_generate_parameters_ex(x0, x1, x2, x3, x4, x5, x6); cargo:warning= | ^~ cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:5837:49: warning: conversion to 'size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion] ... SNIP: many more warnings removed ... cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c: In function '_cffi_f_sk_X509_value': cargo:warning=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c:21620:32: warning: conversion to 'size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion] cargo:warning=21620 | { result = sk_X509_value(x0, x1); } cargo:warning= | ^~ --- stderr error occurred in cc-rs: command did not execute successfully (status code exit status: 1): LC_ALL="C" "cc" "-O3" "-ffunction-sections" "-fdata-sections" "-fPIC" "-m64" "-I" "/tmp/boringssl-install/include" "-I" "/tmp/venv/include" "-I" "/usr/include/python3.13" "-Wall" "-Wextra" "-Wconversion" "-Wno-error=sign-conversion" "-Wno-unused-parameter" "-fmacro-prefix-map=/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out=." "-DPy_LIMITED_API=0x030800f0" "-o" "/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/b15af52c22fd75a7-_openssl.o" "-c" "/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/target/release/build/cryptography-cffi-911296b1e50a30ef/out/_openssl.c" warning: build failed, waiting for other jobs to finish... 💥 maturin failed Caused by: Failed to build a native library through cargo Caused by: Cargo build finished with "exit status: 101": `env -u CARGO PYO3_BUILD_EXTENSION_MODULE="1" PYO3_ENVIRONMENT_SIGNATURE="cpython-3.13-64bit" PYO3_PYTHON="/tmp/venv/bin/python3" PYTHON_SYS_EXECUTABLE="/tmp/venv/bin/python3" "cargo" "rustc" "--profile" "release" "--message-format" "json-render-diagnostics" "--locked" "--manifest-path" "/tmp/pip-install-7fh7g3a3/cryptography_524ce9cedc9849f1974959e33fdbd5ea/src/rust/Cargo.toml" "--lib"` Error: command ['maturin', 'pep517', 'build-wheel', '-i', '/tmp/venv/bin/python3', '--compatibility', 'off'] returned non-zero exit status 1 [end of output] note: This error originates from a subprocess, and is likely not a problem with pip. ERROR: Failed building wheel for cryptography Failed to build cryptography ERROR: Failed to build installable wheels for some pyproject.toml based projects (cryptography) — Reply to this email directly, view it on GitHub <#14754>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBADHPPTGNG6UFRISQ34X547RAVCNFSM6AAAAACYIC2NM2VHI2DSMVQWIX3LMV43ASLTON2WKOZUGMZTMOJUGU4TSOA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[diafygi]

What version of boring ssl are you using? We test with latest head only

Commit 151cf73e7e8f939424d19b2a5b0575787c721297, same as the ci.yml.

[diafygi]

Interesting, it looks like the CI build also finds the same issues, but they are marked as warning: and not error:, so the build succeeds.

https://github.com/pyca/cryptography/actions/runs/24994386143/job/73187493273#step:14:344

Also looks like this is happening in AWS-LC builds:

https://github.com/pyca/cryptography/actions/runs/24994386143/job/73187493266#step:14:345

I've also tried this using aws-lc as the backend, and it fails on Debian 13 with the same error:. So this issue affects both BoringSSL and AWS-LC.

[alex]

I guess warning vs. error is maybe a compiler version difference? Bad news I can't find an obvious way to fix this directly.

The good news is that the only consumer is in pyOpenSSL and it's deprecated, so "just delete this functionality from pyOpenSSL is probably the best way forward."

[diafygi]

It appears this issue is coming up on Ubuntu 25.10 (questing) in addition to Debian 13, so it's not just Debian.

Ubuntu 24.04: gcc 13.3.0 (build succeeds)
Debian 13: gcc 14.2.0 (build fails)
Ubuntu 25.10: gcc 15.2.0 (build fails)

I'm guessing that gcc >= 14 will fail the build.

[alex]

fix here is just going to be to delete this functionality after hte next pyopenssl release

[diafygi]

@alex from the discussion on the related CFFI issue (python-cffi/cffi#245), it looks like @MLopez-Ibanez figured out exactly where the issue is in the cryptography code, along with the related GCC 14 change:

python-cffi/cffi#245 (comment)

[reaperhulk]

Yeah, the problem is that they're not const in OpenSSL so we either live with warnings (which have now been promoted to errors in newer gcc) or have to detect and switch declarations at compile time based on the variant we're compiling against. As @alex mentioned our fix for this is just going to be removing the functionality in pyopenssl so we can entirely remove these cffi bindings.

[diafygi]

@reaperhulk totally understand. In the meantime, I'd like to propose that we at least fix this error so that users don't have to run old distros in order to be able to use the post-quantum crypto features.

I've opened pull request #14770 as a proposed fix.

EDIT: Updated the pull request from #14769 to #14770