Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:97393
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain heroku.com designates 209.85.220.174 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
In-Reply-To: <CANUQDCifCT3_GmWh=+m+a9D6NFAS=dyvB=DoZJVoGq3Y9tEsrA@mail.gmail.com>
Date: Tue, 13 Dec 2016 23:18:45 +0100
Cc: Jakub Zelenka <bukka@php.net>,
 Pierre Joye <pierre.php@gmail.com>,
 Stanislav Malyshev <smalyshev@gmail.com>,
 PHP internals list <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <D7F173AD-B958-449C-A7E2-F5752F75D941@heroku.com>
References: <CAEKnhAH53BWSJY0hZADh3CQAUEojBP2pdZ7gvKp-EecnhwQiuA@mail.gmail.com> <CAEKnhAHKBMLrpJ0hGsHhH-yR6c-tDUpkhmkO_HnZdWWV90pEcA@mail.gmail.com> <10aa7da4-9880-811a-92f8-71ae5dcce621@gmail.com> <CAEZPtU7pvFQtTLBOsObN3r9Or-5N+q+b1kCRXGD7gZRxsVDGEw@mail.gmail.com> <CAEKnhAFisPHSP2XRyPaJeO_hUUTLN5wL7efgcUEa76qgT9tq1w@mail.gmail.com> <CANUQDCg9qi+k-RRZMcOept6C9_xiKJvys95jnPs2+cDMkqvjPw@mail.gmail.com> <CAEKnhAGXdcJTdJveg5evhHcGEs4DiRdQoJ+n9VO0svXDF_WjpQ@mail.gmail.com> <CANUQDCifCT3_GmWh=+m+a9D6NFAS=dyvB=DoZJVoGq3Y9tEsrA@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Subject: Re: [PHP-DEV] Bumping minimal OpenSSL version to 1.0.1 in master for PHP 7.1
From: dz@heroku.com (David Zuelke)

On 13.12.2016, at 11:31, Niklas Keller <me@kelunik.com> wrote:
>=20
> OpenSSL support for 1.0.1 will end this year.
>=20
> Support for version 1.0.1 will cease on 2016-12-31. No further =
releases of
>> 1.0.1 will be made after that date. Security fixes only will be =
applied to
>> 1.0.1 until then.
>> Version 1.0.0 is no longer supported.
>> Version 0.9.8 is no longer supported.
>=20
>=20
> We dropped 0.9.8 and 1.0.0 in 7.1.
>=20
> Should we drop support for 1.0.1 in master, so it's dropped for 7.2 =
then,
> as it will be unsupported then?

Please no.

Ubuntu's 14.04 LTS is on 1.0.1f and gets security backports. EOL is =
April 2019.

Unless there is a hard reason (API changes or whatever) that PHP 7.2 =
absolutely cannot live without, it's a bad idea, as folks on 14.04 or =
similar (think RHEL etc) then have to either rely on third parties for =
updates, or vendor in a newer version, even though their system libssl =
is still receiving security updates.

David