Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120848
Content-Type: multipart/signed;
	boundary="Apple-Mail=_C530AC54-20AF-4255-A5F9-EA1CDDF3344C";
	protocol="application/pgp-signature";
	micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.600.7\))
Date: Tue, 18 Jul 2023 16:23:02 -0500
References: <989f473a-010b-5a2b-017c-f8fb00467c14@gmx.de>
 <deih8itddt2g2q80hq3c3dcgrj257f0hd3@4ax.com>
 <D345D75F-9562-4F23-8873-BE632360365A@benramsey.com>
To: PHP Developers Mailing List <internals@lists.php.net>
In-Reply-To: <D345D75F-9562-4F23-8873-BE632360365A@benramsey.com>
Message-ID: <F927C552-504D-4CE5-B48B-176EEE75B0DE@benramsey.com>
Subject: Re: [PHP-DEV] PHP 8.1 and OpenSSL
From: ben@benramsey.com (Ben Ramsey)

--Apple-Mail=_C530AC54-20AF-4255-A5F9-EA1CDDF3344C
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

> On Jul 5, 2023, at 10:44, Ben Ramsey <ben@benramsey.com> wrote:
>=20
>> On Jun 13, 2023, at 15:06, Jan Ehrhardt <phpdev@ehrhardt.nl> wrote:
>>=20
>> Hi Christoph,
>>=20
>> "Christoph M. Becker" in php.internals (Wed, 18 Jan 2023 13:20:41 =
+0100):
>>> While the official builds for PHP 8.2 already use OpenSSL 3.0, the =
PHP
>>> 8.1 builds are still using OpenSSL 1.1.1.  However, OpenSSL 1.1.1 is
>>> only supported till 2023-09-11[1], while PHP 8.1 is supported till
>>> 2024-11-25[2].  Although I don't like bumping the OpenSSL version in =
the
>>> middle of PHP 8.1's lifetime, I suppose it is necessary to avoid =
falling
>>> behind security support.  And if we do that bump, we better do it =
sooner
>>> than later.
>>>=20
>>> So, if there are no unforeseen problems, I suggest to build PHP
>>> 8.1.16RC1 with OpenSSL 3.0 (PHP 8.1.15RC1 has already been built =
with
>>> OpenSSL 1.1.1).
>>>=20
>>> Thoughts?  Objections?
>>>=20
>>> [1] <https://www.openssl.org/policies/releasestrat.html>
>>> [2] <https://www.php.net/supported-versions.php>
>>=20
>> I noticed that PHP 8.1.20 at https://windows.php.net/download/ was =
built
>> with OpenSSL 1.1.1t and PHP 8.2.7 & 8.3.0 Alpha 1 with OpenSSL 3.0.8. =
What
>> will be the official policy for 8.1, 8.2 and 8.3? All 3 versions with
>> OpenSSL 3.0.x or 8.1 still with OpenSSL 1.1.1? And none of the three
>> versions with OpenSSL 3.1.x? Please clarify.
>=20
>=20
> What=E2=80=99s the process for changing this? Do release managers need =
to change the way we bundle the packages, or does something need to be =
merged into the PHP-8.1 branch?


Does anyone know the answer to this question?

Cheers,
Ben



--Apple-Mail=_C530AC54-20AF-4255-A5F9-EA1CDDF3344C
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQToXQMR3fpbrPOmEOewLZeYnIwHGwUCZLcCtgAKCRCwLZeYnIwH
G9/4AQCQ7NOqHUWK3rn6B8zasetfD9xdQdTJvrLXBGMvRLt+xAD/flcb1wwXJ7q6
qGiACIwB2AYXDRZzJ7pBP/ZSwE2TPi8=
=uDL2
-----END PGP SIGNATURE-----

--Apple-Mail=_C530AC54-20AF-4255-A5F9-EA1CDDF3344C--