[Buildroot] Migration to OpenSSL 1.1.1?

[Buildroot] Migration to OpenSSL 1.1.1?

[Marcel Patzlaff]

Hello,

after reading https://www.openssl.org/source/ (especially the part where 
the version support is stated), the following question pops up:
Are there plans to migrate the openssl package to 1.1.1?
Not long ago, a switch was introduced to drop-in replace openssl with 
libressl (which has OpenSSL 1.0.1 API compatibility).
Are there reasons for this?
Or are there problems with OpenSSL 1.1.1 which I do not know about yet?

Kind regards,
Marcel

-- 


Gesch?ftsf?hrung: Susanne Kunschert, Thomas Pilz
Pilz GmbH & Co. KG, Sitz: Ostfildern, HRA 210 893, Amtsgericht Stuttgart
Kompl. Ges. Peter Pilz GmbH, Sitz: Ostfildern, HRB 210 612, Amtsgericht Stuttgart
Umsatzsteuer: ID-Nr. DE 145 355 773, WEEE-Reg.-Nr. DE 71636849
This email is intended solely for the use of the named address(es). Any unauthorised disclosure, copying or distribution of these confidential information contained therein, or the taking of any action based on it, is prohibited. The sender disclaims any liability for the integrity of this email. Legally binding declarations must be in written form.
Umweltschutz liegt uns am Herzen! - Bitte denken Sie an unsere Umwelt, bevor Sie diese E-Mail drucken.
We do care about the environment! - Please consider the environment before printing this e-mail.

[Buildroot] Migration to OpenSSL 1.1.1?

[Matthew Weber]

Marcel,

On Tue, Jan 15, 2019 at 4:30 AM Marcel Patzlaff <M.Patzlaff@pilz.de> wrote:
>
> Hello,
>
> after reading https://www.openssl.org/source/ (especially the part where
> the version support is stated), the following question pops up:
> Are there plans to migrate the openssl package to 1.1.1?

There are some efforts starting to bump to the latest stable 1.1.1.
We're hoping we can get things bumped before things freeze for the
next release.

> Not long ago, a switch was introduced to drop-in replace openssl with
> libressl (which has OpenSSL 1.0.1 API compatibility).
> Are there reasons for this?
> Or are there problems with OpenSSL 1.1.1 which I do not know about yet?

I'm not familiar enough with the differences.  My reason for the bump
is to get some buffer performance rewrites in the latest 1.1.1 which
improve cryptography performance when a hardware engine is used.

Matt

[Buildroot] Migration to OpenSSL 1.1.1?

[Thomas Petazzoni]

Hello,

+Peter in Cc.

On Tue, 15 Jan 2019 06:17:28 -0600, Matthew Weber wrote:

> On Tue, Jan 15, 2019 at 4:30 AM Marcel Patzlaff <M.Patzlaff@pilz.de> wrote:
> >
> > Hello,
> >
> > after reading https://www.openssl.org/source/ (especially the part where
> > the version support is stated), the following question pops up:
> > Are there plans to migrate the openssl package to 1.1.1?  
> 
> There are some efforts starting to bump to the latest stable 1.1.1.
> We're hoping we can get things bumped before things freeze for the
> next release.

The freeze for 2019.02 is going to happen at the end of January, I am
not sure this leaves us enough time to fix all the consequences of a
bump to OpenSSL 1.1.1.

However, since 2019.02 is going to be a LTS maintained for one year,
perhaps we want to have OpenSSL 1.1.1 in that LTS, knowing that it will
be maintained, while older OpenSSL versions might not. Is there any
information available on whether OpenSSL still maintains 1.0.x ? Peter,
what do you think ?

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[Buildroot] Migration to OpenSSL 1.1.1?

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Petazzoni <thomas.petazzoni@bootlin.com> writes:

Hi,

 >> There are some efforts starting to bump to the latest stable 1.1.1.
 >> We're hoping we can get things bumped before things freeze for the
 >> next release.

 > The freeze for 2019.02 is going to happen at the end of January, I am
 > not sure this leaves us enough time to fix all the consequences of a
 > bump to OpenSSL 1.1.1.

 > However, since 2019.02 is going to be a LTS maintained for one year,
 > perhaps we want to have OpenSSL 1.1.1 in that LTS, knowing that it will
 > be maintained, while older OpenSSL versions might not. Is there any
 > information available on whether OpenSSL still maintains 1.0.x ? Peter,
 > what do you think ?

The official policy is listed here:

https://www.openssl.org/policies/releasestrat.html

So it will be supported almost (but not completely) until the end of the
2019.02 maintenance cycle.

Given how close we are to RC1, I would suggest we stick to 1.0.2 for
2019.02.

-- 
Bye, Peter Korsgaard