Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90994
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.49 as permitted sender)
MIME-Version: 1.0
Reply-To: bishop@php.net
Sender: bishop.bettini@gmail.com
In-Reply-To: <CAEKnhAH53BWSJY0hZADh3CQAUEojBP2pdZ7gvKp-EecnhwQiuA@mail.gmail.com>
References: <CAEKnhAH53BWSJY0hZADh3CQAUEojBP2pdZ7gvKp-EecnhwQiuA@mail.gmail.com>
Date: Thu, 28 Jan 2016 09:44:44 -0500
Message-ID: <CAEYWF=6PdYsjV4U67heZuGas_iy_hPysBBRzE3iyHsNVnMY2gw@mail.gmail.com>
To: Jakub Zelenka <bukka@php.net>
Cc: PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c0ce6665ca454052a65f730
Subject: Re: [PHP-DEV] Bumping minimal OpenSSL version to 1.0.1 in master for
 PHP 7.1
From: bishop@php.net (Bishop Bettini)

--94eb2c0ce6665ca454052a65f730
Content-Type: text/plain; charset=UTF-8

On Thu, Jan 28, 2016 at 8:39 AM, Jakub Zelenka <bukka@php.net> wrote:

> I would like to bump a minimal OpenSSL version to 1.0.1 in our master. It
> means dropping support for OpenSSL 0.9.8 and 1.0.0 in master. Both of these
> versions are EOL as of 2015/12/31 and users should not use them. It will
> help with maintainability (simplify code and testing) and porting to
> OpenSSL 1.1.0.
>
> This would be just for master which means next minor version (7.1). We
> already quickly discussed this in
> https://www.mail-archive.com/internals@lists.php.net/msg80502.html some
> time ago and I think that now is the right time to do that (before looking
> to OpenSSL 1.1 compatibility).
>
> Are there any objections?


No objection to the requirement. Perhaps we should "recommend" 1.0.1r+ and
1.0.2f+, because of security vulnerabilities in earlier versions:

https://mta.openssl.org/pipermail/openssl-announce/2016-January/000058.html

--94eb2c0ce6665ca454052a65f730--