3 ms·
HEADLINE Remove openssl1.0 DESCRIPTION stretch made OpenSSL 1.1 the default openssl package. Unfortunately, OpenSSL 1.0 was kept around, since so many thing
by CaliforniaKarl 9y ago
HEADLINE
Remove openssl1.0
DESCRIPTION
stretch made OpenSSL 1.1 the default openssl package. Unfortunately, OpenSSL 1.0 was kept around, since so many things depended on it.
There should now be enough time that a firm stance can be taken toward not allowing OpenSSL 1.0 in Debian Buster.
Once TLS 1.3 is finalized, OpenSSL 1.2 will be released with TLS 1.3 support. Not supporting TLS 1.3 in buster would (in my opinion) make Debian appear less in other people's eyes. That means supporting OpenSSL 1.2, and having three OpenSSL packages (1.0, 1.1, and 1.2) is too much for one distribution.
DISTRIBUTION
buster
- zdw 9y agoHow would you feel about a switch to one of the forks, such as BoringSSL or LibreSSL?
- CaliforniaKarl 9y agoSorry, I'm not in support of switching from OpenSSL to BoringSSL or LibreSSL as the default. On a fairly regular basis, I use alot of the weirder things that I don't think BoringSSL or LibreSSL support. For example, I was working on iOS profile stuff that called on OpenSSL's S/MIME enveloping functionality to make signed/encrypted profiles.
- heftysync 9y agoOpenSSL doesn't follow semantic versioning. This is not a simple version upgrade. They knowingly broke the API between 1.0 and 1.1 and it can require substantial changes. They also refused to provide a compatibility shim to make it easier for developers to migrate. This is not a Debian problem. This is an OpenSSL problem where they forced each upstream program author to make changes in order to upgrade. You'll have to wait for each upstream program author to update.
- aleden 9y agoAndroid Studio relies on OpenSSL 1.