Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125440
Message-ID: <223b29d5-ec13-4380-ae54-a474e2354429@gmx.de>
Date: Thu, 5 Sep 2024 19:19:45 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: PHP internals list <internals@lists.php.net>
Content-Language: de-DE
Subject: [PHP-DEV] Update OpenSSL *minor* version on Windows?
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
UI-OutboundReport: notjunk:1;M01:P0:LrxxMrSFGRg=;wklro5Xue6H70bLw9xWHSHM68mS
 cQV9Gxb0+IZmyhTeh+JyNq1CMlVsNu3EjSKQSMlON1tTApATu1G54xUyBZAhMZbHBOCYJKQz1
 7Lt5L09gAAg4uRFBAooSrizqU7kvrqZM9upApGbnPDE2cNMgTNWiZPGPL6wS5FLH4mTTIBQW+
 WqcfjJD8JlvrUeD7j8PZp8zvfU7SvAJYmEXZCm+Bi/TIHEPaxoXwSw6WWt0GiYBvcVV6e8lAn
 DK3/IcK3rDhXcSj8sWNYn6Gonv47+gVAO44mZdE75I+wIfYJ0nP/9X/3H0zwQ0H1na9T3bSNu
 etNDpZv/mlLKSICYefqtt0pl5P0KwyhwssnS+LSWVj3Q06aZXTA4dktBlbZkY/wrWsXraMtDN
 TpvVS8hvDrSVlf7/AlLLRm2xF1gEEHZhwO+3C55SJND3ZIFt73nvS2do8FKo4KEn7/WHSLNPx
 BNg2F+XTzoeGsUYPhmvmeuSToHgVKl1DzheiaVv55ftgLSblqBdFOgZlEBVIK7MVlLqwoqQY6
 leKkwGAfLzioGiWwKrl3pI8I0PWFbuYmGqsLlcJgJ6kv3J2IwACg56OFhj6uHTO5DRdSUe5XD
 2y+hufOW7A30EcG8ToVIzf7sv56oYqOVJv9OOhYKPk6Ut7G+DNl6rXJ89p6l633Eo803JQZ2S
 I0n/Y+0v9ghdo+Avb82SBBGqiSGnlUZMRXXyA63cYcF6VFSaPenSy7DEV/SskpjQ+gJrkTZqU
 CRJ/T0c/F2kQaZioSlrMUgb9St0lRiNHyIiYnFO1t90/gxBlCOw/YrFedbSZCkTKjiu/EJbx4
 kXRKc7L+aDCWW7QMKtDH1M92dYLOT3YsZX9xP9U8b2QNE=
From: cmbecker69@gmx.de ("Christoph M. Becker")

Hi all,

I've mentioned this already in a pull request[1], but figure this should
be discussed on the mailing list.  Quoting myself from that PR:

| PHP 8.4 is supposed to be supported until 31st Dec 2028, but OpenSSL
| 3.0 will only be supported until 7th September 2026. This might even
| be an issue for PHP 8.3. Unfortunately, even OpenSSL 3.3 support ends
| on 9th April 2026 (thus even earlier than 3.0), but we likely need to
| update to more recent OpenSSL minor versions.

Jakub mentioned in that PR that we may want to wait for OpenSSL 3.4.0
which is scheduled for GA in October, and likely is supported one year
longer as OpenSSL 3.3.0.  I think that makes sense (particularly since
OpenSSL 3.4.0-alpha1 has been released today, and I have not detected
any serious issues with it when building nor when running the test
suite; there is a very minor issue regarding the path of the default
cert area which now has a trailing backslash appended[2], but that
doesn't really matter and might be "fixed", here or there).

I'm still not happy considering that this would still leave more than
one year of lacking upstream support, where our Windows builds might
need to be fixed with some publicly available patches, in case there are
any security vulnerabilites (I'm presuming that the PHP project will not
afford a support contract; it seems these don't even apply to Open
Source downstream consumers).

So I wonder about the stability of OpenSSL minor versions nowadays, and
whether we want to update to a new minor version during the lifecycle of
a PHP minor release.  For instance regarding PHP 8.3, we may consider
updating OpenSSL to 3.4 roughly in a year, when PHP 8.3 has still actve
support for about four months, so we could still react to issues with
that update.

So one question is whether we should ship OpenSSL 3.4.0-alpha1 for PHP
8.4.0beta5, or to postpone that a bit.

And the other question is whether we are generally fine with updating to
newer OpenSSL versions during the lifecycle of a minor PHP release
(presuming that there are no BC issues, of course).

Thoughts?

[1] <https://github.com/php/php-src/pull/15713>
[2]
<https://github.com/openssl/openssl/blob/8af4c02ea952ca387691c4a077c260ba045fe285/crypto/x509/x509_def.c#L52>

Christoph