Re: Cutting support for OpenSSL 1.0.1 and 1.0.2 in 17~?

Joe Conway <mail@joeconway.com>

From: Joe Conway <mail@joeconway.com>
To: Daniel Gustafsson <daniel@yesql.se>, Peter Eisentraut <peter@eisentraut.org>
Cc: Michael Paquier <michael@paquier.xyz>, Jacob Champion <jacob.champion@enterprisedb.com>, Thomas Munro <thomas.munro@gmail.com>, Postgres hackers <pgsql-hackers@lists.postgresql.org>, Mikael Kjellström <mikael.kjellstrom@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Date: 2024-08-05T12:38:00Z
Lists: pgsql-hackers
On 7/15/24 17:42, Daniel Gustafsson wrote:
>> On 14 Jul 2024, at 14:03, Peter Eisentraut <peter@eisentraut.org>
>> wrote:
>> 
>> On 12.07.24 21:42, Daniel Gustafsson wrote:
>>>> On 11 Jul 2024, at 23:22, Peter Eisentraut
>>>> <peter@eisentraut.org> wrote: The 0001 patch removes the
>>>> functions pgtls_init_library() and pgtls_init() but keeps the
>>>> declarations in libpq-int.h.  This should be fixed.
>>> Ah, nice catch. Done in the attached rebase.
>> 
>> This patch version looks good to me.
> 
> Thanks for review, I will go ahead with this once back from vacation
> at the tail end of July when I can properly handle the BF.
> 
>> Small comments on the commit message of 0002: Typo "checkig".
>> Also, maybe the commit message title can be qualified a little,
>> since we're not really doing "Remove pg_strong_random
>> initialization." but something like "Remove unnecessary ..."?
> 
> Good points, will address before pushing.

I know I am way late to this thread, and I have only tried a cursory 
skim of it given the length, but have we made any kind of announcement 
(packagers at least?) that we intend to not support Postgres 18 with ssl 
on RHEL 7.9 and derivatives? Yes, RHEL 7 just passed EOL, but there is 
commercial extended support available until July 2028[1] which means 
many people will continue to use it.

Joe

[1] 
https://www.redhat.com/en/blog/announcing-4-years-extended-life-cycle-support-els-red-hat-enterprise-linux-7
-- 
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com



Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →
  1. Remove obsolete unconstify()

  2. Only perform pg_strong_random init when required

  3. Remove support for OpenSSL older than 1.1.0

  4. Support SSL_R_VERSION_TOO_LOW when using LibreSSL

  5. Support disallowing SSL renegotiation when using LibreSSL

  6. Doc: Use past tense for things which happened in the past

  7. Remove support for OpenSSL 1.0.1

  8. Remove support for OpenSSL 0.9.8 and 1.0.0