Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90997
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.54 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
In-Reply-To: <CAEYWF=6PdYsjV4U67heZuGas_iy_hPysBBRzE3iyHsNVnMY2gw@mail.gmail.com>
References: <CAEKnhAH53BWSJY0hZADh3CQAUEojBP2pdZ7gvKp-EecnhwQiuA@mail.gmail.com>
	<CAEYWF=6PdYsjV4U67heZuGas_iy_hPysBBRzE3iyHsNVnMY2gw@mail.gmail.com>
Date: Thu, 28 Jan 2016 15:17:44 +0000
Message-ID: <CAEKnhAE=f9j=JbGQaJuUXK5Juq+tPdAbyC6MAx_sh83mZ9xd9g@mail.gmail.com>
To: Bishop Bettini <bishop@php.net>
Cc: PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1141c87ea34375052a666bd2
Subject: Re: [PHP-DEV] Bumping minimal OpenSSL version to 1.0.1 in master for
 PHP 7.1
From: bukka@php.net (Jakub Zelenka)

--001a1141c87ea34375052a666bd2
Content-Type: text/plain; charset=UTF-8

Hi

On Thu, Jan 28, 2016 at 2:44 PM, Bishop Bettini <bishop@php.net> wrote:

> On Thu, Jan 28, 2016 at 8:39 AM, Jakub Zelenka <bukka@php.net> wrote:
>
>> I would like to bump a minimal OpenSSL version to 1.0.1 in our master. It
>> means dropping support for OpenSSL 0.9.8 and 1.0.0 in master. Both of
>> these
>> versions are EOL as of 2015/12/31 and users should not use them. It will
>> help with maintainability (simplify code and testing) and porting to
>> OpenSSL 1.1.0.
>>
>> This would be just for master which means next minor version (7.1). We
>> already quickly discussed this in
>> https://www.mail-archive.com/internals@lists.php.net/msg80502.html some
>> time ago and I think that now is the right time to do that (before looking
>> to OpenSSL 1.1 compatibility).
>>
>> Are there any objections?
>
>
> No objection to the requirement. Perhaps we should "recommend" 1.0.1r+ and
> 1.0.2f+, because of security vulnerabilities in earlier versions:
>
> https://mta.openssl.org/pipermail/openssl-announce/2016-January/000058.html
>
>

I wouldn't go too far. The thing is that some distros picks one version and
then applies their security patches on top of it. For example RHEL 7 picked
1.0.1e and then it has releases like openssl-1.0.1e-51.el7 (not sure if
it's the last one... :) ) which still has the security fixes. Also I'm
almost sure that new vulnerabilities will happen and we would have to bump
that recommendation every time it happens. From our point of view, the most
important thing are the api changes and range of versions that we need to
test. So bumping the requirement to 1.0.1 will be enough IMHO ;)

Anyway thanks for your feedback!

Cheers

Jakub

--001a1141c87ea34375052a666bd2--