Horton
Menu

Re: Cutting support for OpenSSL 1.0.1 and 1.0.2 in 17~?

Jacob Champion <jchampion@timescale.com>

View thread
From: Jacob Champion <jchampion@timescale.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Daniel Gustafsson <daniel@yesql.se>, Postgres hackers <pgsql-hackers@lists.postgresql.org>
Date: 2023-05-26T16:10:17Z
Lists: pgsql-hackers 
On Thu, May 25, 2023 at 7:09 PM Michael Paquier <michael@paquier.xyz> wrote:
> Please find attached an updated patch only for the removal of 1.0.1.
> Thanks for the review.

Nice! Sorry about the new complications with LibreSSL. :(

> -  # Functions introduced in OpenSSL 1.0.2. LibreSSL does not have
> +  # Function introduced in OpenSSL 1.0.2. LibreSSL does not have
>    # SSL_CTX_set_cert_cb().
> -  AC_CHECK_FUNCS([X509_get_signature_nid SSL_CTX_set_cert_cb])
> +  AC_CHECK_FUNCS([SSL_CTX_set_cert_cb])

Can X509_get_signature_nid be moved to the required section up above?
As it is now, anyone configuring with -Dssl=auto can still pick up a
1.0.1 build, which Meson accepts, and then the build fails downstream.
If we require the function instead, Meson will ignore 1.0.1 (or, for
-Dssl=openssl, complain before we compile).

t/001_ssltests.pl has a reference to 1.0.1 that can probably be
entirely deleted:

    # ... (Nor for OpenSSL
    # 1.0.1, but that's old enough that accommodating it isn't worth the cost.)

Thanks,
--Jacob

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Remove obsolete unconstify()

  2. Only perform pg_strong_random init when required

  3. Remove support for OpenSSL older than 1.1.0

  4. Support SSL_R_VERSION_TOO_LOW when using LibreSSL

  5. Support disallowing SSL renegotiation when using LibreSSL

  6. Doc: Use past tense for things which happened in the past

  7. Remove support for OpenSSL 1.0.1

  8. Remove support for OpenSSL 0.9.8 and 1.0.0