3 ms·
It would be technically possible but then they would end up having to maintain and offer two sets of every dependency, i.e. apache-ssl101 and apache-ssl102. Als
by 0x0 10y ago
It would be technically possible but then they would end up having to maintain and offer two sets of every dependency, i.e. apache-ssl101 and apache-ssl102. Also, distros usually freeze what they have, so this would only be of interest for backports or perhaps if there was a need to supply old openssl versions even if a newer one is available before the freeze.
The "solution" here is just to wait it out for new major releases of the various distros, and not expect everyone to change core libraries every six months :)
- wmf 10y agoFor example, Debian Jessie shipped with 1.0.1 even though 1.0.2 was already out, probably because not every app had been ported to 1.0.2 yet. But their "megafreeze" development model amplifies a 6-month scale problem into a many-year problem. If they had shipped both 1.0.1 and 1.0.2 then apps could have incrementally switched over at their own pace. Naturally, each app would only link against one version of OpenSSL so there'd be no need for apache-ssl101 and apache-ssl102.
- 0x0 10y agoWell, Jessie froze on November 5th 2014, and OpenSSL 1.0.2 was released on January 22nd 2015. I do appreciate the "megafreeze" to work out all the quirks for a few months so I can have a stable release that works well for several years. If you only have one single app to host, I can see it's annoying to be stuck with last year's software. When you have dozens or hundreds of small websites and app backends, you really start to appreciate stable versions. :)