Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88189
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain belski.net from 85.214.73.107 cause and error)
To: "'Jakub Zelenka'" <bukka@php.net>,
	"'PHP internals list'" <internals@lists.php.net>
References: <CAEKnhAHGBdx_DZO-Fn5ABan821V_aDFvVDwZDEcSfzfaqTPKqw@mail.gmail.com>
In-Reply-To: <CAEKnhAHGBdx_DZO-Fn5ABan821V_aDFvVDwZDEcSfzfaqTPKqw@mail.gmail.com>
Date: Mon, 14 Sep 2015 22:17:05 +0200
Message-ID: <031f01d0ef2a$55776fa0$00664ee0$@belski.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQMjgmdrxwvUET8b12ee7AWKoWcJ+5uXTLyg
Content-Language: en-us
Subject: RE: [PHP-DEV] Bumping minimal OpenSSL version to 0.9.8
From: anatol.php@belski.net ("Anatol Belski")

Hi Jakub,

> -----Original Message-----
> From: jakub.php@gmail.com [mailto:jakub.php@gmail.com] On Behalf Of =
Jakub
> Zelenka
> Sent: Monday, September 14, 2015 2:04 PM
> To: PHP internals list <internals@lists.php.net>; Anatol Belski
> <anatol.php@belski.net>
> Subject: [PHP-DEV] Bumping minimal OpenSSL version to 0.9.8
>=20
> Hi,
>=20
> At the moment the minimal OpenSSL version is 0.9.6.
>=20
> I realised yesterday that there are some types changes between 0.9.7 =
and
> 0.9.8 that would have to be address in overflow checks =
(EVP_DigestUpdate and
> related). I also noticed that 0.9.6 might not even compile without =
warnings as
> it's checking return type for some function that did not return =
anything in 0.9.6.
> We also have few other old places where we don't check retval because =
of that.
>=20
> The thing is that the last update for 0.9.7 stable branch is in 2008 =
and
> 0.9.6 in 2005. Both of them have been long time EOL so I don't think =
that it
> makes any sense to spend any time on making them compatible for PHP 7.
> So I think we should bump minimal version to 0.9.8.
>=20
> Anatol would you be ok if this is done for 7.0? I don't think that =
anyone would
> ever use PHP 7 and such an old version of OpenSSL together so there =
should be
> no issue IMHO.
>=20
0.9.8 as the lowest supported OpenSSL sounds plausible to me. Despite =
the OpenSSL team announcend EOL of the 0.9.8 and 1.0.0 series for the =
end of this year, distributions like CentOS will support it probably =
even longer (but not sure how they keep their 0.9.8 builds secure after =
its official EOL, probably some painful backporting). Fe Debian old =
stable has OpenSSL 1.0.1. Still 0.9.8 were a plausible option for =
today's situation, IMHO. Maybe it can be raised once more at the PHP 7.1 =
times, but that's something to see then. If there are no objections, =
raising the requirement to 0.9.8 should be done for 7.0

Regards

Anatol