Re: [Buildroot] [PATCH 1/2] package/mbedtls3: new package

From: Peter Korsgaard <peter@korsgaard.com>
To: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Joachim Wiberg <troglobit@gmail.com>,
	Samuel Martin <s.martin49@gmail.com>,
	Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
	Buildroot Mailing List <buildroot@buildroot.org>
Subject: Re: [Buildroot] [PATCH 1/2] package/mbedtls3: new package
Date: Sat, 08 Jan 2022 17:54:13 +0100	[thread overview]
Message-ID: <87zgo6f9sa.fsf@dell.be.48ers.dk> (raw)
In-Reply-To: <CAPi7W80y_knjUqY1TuKsxbqvgPET08pS9vee07zM7HCm9w4qYg@mail.gmail.com> (Fabrice Fontaine's message of "Sat, 8 Jan 2022 16:03:49 +0100")

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Hi,
 > Le sam. 8 janv. 2022 à 15:14, Peter Korsgaard <peter@korsgaard.com> a écrit :
 >> 
 >> >>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:
 >> 
 >> Hi,
 >> 
 >> > Indeed, this is also an alternative, even if I think that adding
 >> > mbedtls3 would be a great addition.
 >> > For example, libcurl supports mbedts 3.0 since its version 7.79 and
 >> > https://github.com/curl/curl/commit/3f126138be3c459a2794d35f8170e92e65a50dad.
 >> > Otherwise, as requested by Thomas, I sent an email to mbedtls mailing
 >> > list:
 >> > https://lists.trustedfirmware.org/archives/list/mbed-tls@lists.trustedfirmware.org/thread/HEHCNQZTBOZV56RTGRTGSQQRMEWYJPGI/
 >> 
 >> What is the plan from upstream regarding mbedtls 2.x? Will it be
 >> maintained in parallel with 3.x for some time (and for how long?) or is
 >> it effectively EOL already?
 > 2.16.x is EOL since December 2021:
 > https://tls.mbed.org/tech-updates/blog/announcing-lts-branch-mbedtls-2.16
 > The next LTS branch is 2.28 which will be maintained until end of
 > 2024: https://github.com/ARMmbed/mbedtls/blob/development/BRANCHES.md

Ok, so we should ideally move our mbedtls version to 2.28.x before
2022.02. What about 3.x, is that also a LTS or is that considered a
not-yet-stable development version?

For the question if we need to maintain both 2.28.x and 3.x in
parallel I guess it really depends on if the packages we have depending
on mbedtls (E.G. bctoolbox, bmx7, mongrel2, shadowsocks-libev) can (be
patched to) work with mbedtls 3.x or not?

If they can (or are no longer maintained upstream), then I would prefer
to only support mbedtls 3.x going forward. If on the other hand mbedtls
3.x isn't really stable yet and only needed for hiawatha, then indeed we
should perhaps just postpone it a bit and use the internal mbedtls copy
in hiawatha or downgrade / drop TLS support.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot