Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:97928 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 33502 invoked from network); 23 Jan 2017 08:31:56 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 23 Jan 2017 08:31:56 -0000 Authentication-Results: pb1.pair.com smtp.mail=alice@librelamp.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=alice@librelamp.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain librelamp.com designates 45.79.96.192 as permitted sender) X-PHP-List-Original-Sender: alice@librelamp.com X-Host-Fingerprint: 45.79.96.192 librelamp.com Received: from [45.79.96.192] ([45.79.96.192:58982] helo=librelamp.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 90/3C-00729-A7FB5885 for ; Mon, 23 Jan 2017 03:31:55 -0500 Received: from localhost.localdomain (68-189-44-253.dhcp.rdng.ca.charter.com [68.189.44.253]) by librelamp.com (Postfix) with ESMTPSA id 5ADEB1196 for ; Mon, 23 Jan 2017 08:31:52 +0000 (UTC) To: internals@lists.php.net References: Message-ID: Date: Mon, 23 Jan 2017 00:31:51 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] Re: PHP 7.0 and openssl 1.1 From: alice@librelamp.com (Alice Wonder) If someone on such a distro really can't use PHP 7.1.x, LibreSSL can be installed in parallel to OpenSSL (I do on CentOS) and I suspect php 7.0 will build against it (5.6.x does and 7.1.x does) Also, I suspect older OpenSSL shared libraries could probably be installed in parallel. So it can be done if really needed. On 01/22/2017 07:24 PM, Rasmus Lerdorf wrote: > Ok, I thought perhaps the changes for just openssl-1.1 api compatibility > would be easier to separate out, but I guess not. I did have a look at it > and you are right, while some of the changes are trivial, others are more > involved. Fedora 26, and I would guess any Linux distro release that comes > out this year, will ship with openssl-1.1 so they will not be able to run > any version of PHP prior to 7.1. > > -Rasmus > > On Sun, Jan 22, 2017 at 11:33 AM, Jakub Zelenka wrote: > >> Hi Rasmus, >> >> On Sun, Jan 22, 2017 at 1:28 AM, Rasmus Lerdorf >> wrote: >> >>> Jakub, what do you think about back-porting the openssl-1.1 supporting >>> changes to the PHP-7.0 branch? I think it is too early to have PHP-7.0 not >>> compile on new Linux versions and right now it doesn't compile on any Linux >>> that has openssl-1.1. >>> >>> >> The thing is that the patch required quite a lot of changes and it was >> based on the AEAD and OpenSSL error storing changes so the it changed quite >> a lot of code. So all changes together makes some difference between 7.0 >> and 7.1: >> >> [jakub@localhost 71]$ git diff --stat PHP-7.0 ext/openssl/*.[c,h] >> ext/openssl/openssl.c | 1991 ... >> ext/openssl/php_openssl.h | 25 ... >> ext/openssl/xp_ssl.c | 199 ... >> 3 files changed, 1613 insertions(+), 602 deletions(-) >> >> This shows just openssl ext source files but there are some other changes >> for phar and some tweaks in tests. >> >> For that reason I decided that it will be better to target just 7.1 to >> have full QA cycle which was a good decision because I needed to fix few >> things in beta and rc. >> >> It means that the back-port would require some work to extract just the >> porting bits and all test it. It might be slightly trickier as 7.0 still >> support 0.9.8 which might complicate things a bit. Also there is still one >> failing SNI tests that needs some looking and couple of things needs a look >> as well so the port is still not 100% complete. In general I'm not so sure >> if it's really worth it to invest too much time into back-porting it as I'm >> not sure how many users would really appreciate it (meaning how many users >> are not able to update to PHP 7.1 and need to use OpenSSL 1.1.). It might >> be also quite a big patch for the point release but if RM is ok with that >> and someone wants to spend that time on porting it, I can do the review. >> Personally I have got some other stuff on my list (including finishing the >> port in 7.1 and some other OpenSSL fixes) so won't probably have time for >> anything else than review. >> >> Cheers >> >> Jakub >> >