From Fedora Project Wiki

Revision as of 10:38, 5 January 2024 by Ppisar (talk | contribs) (→‎Dependencies: Add chatty)


Removing OpenSSL 1.1 package

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

We are going to remove the openssl11 package from Fedora 40.

Owner


Current status

Detailed Description

In Fedora 36 we switched to OpenSSL 3.0 branch. This is a brand new version with new architecture. We left the openssl1.1 package for the applications that were unable to switch to the new API/architecture, 3rd-party applications, etc. The package was marked as deprecated in F37.

OpenSSL 1.1.1 has reached EOL in September 2023. We want to remove it from Fedora.

Feedback

Benefit to Fedora

This proposal ensures than no new packages in Fedora will use the deprecated OpenSSL version that will cause an overall increase of security/stability.

It will also reduce the maintenance burden for the OpenSSL maintainers, especially when new CVEs are published.

Scope

  • Proposal owners: provide assistance in migration to other developers.
  • Other developers: Patch their packages to work with OpenSSL 3.0.
  • Release engineering: This feature doesn't require coordination with release engineering.
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with Community Initiatives:

Upgrade/compatibility impact

3rd-party packages depending on OpenSSL 1.1.1 should be replaced with new versions using new OpenSSL 3.0+.

How To Test

OpenSSL 1.1 should not be available to install from Fedora repository. No packages should depend on OpenSSL 1.1.1.

User Experience

Shouldn't be affected.

Dependencies

We have found at least the following packages depending on OpenSSL 1.1:

  • chatty-0:0.8.0-1.fc40.src.rpm
  • gloo-0.5.0^git20230824.01a0c81-6.fc40.src.rpm
  • opensmtpd-6.8.0p2-12.fc39.src.rpm
  • python3.6-3.6.15-20.fc39.src.rpm

Contingency Plan

None. We don't have a reason to maintain openssl1.1 anymore.

Formally we could return openssl1.1 back to distro as a contingency plan.

  • Contingency mechanism: (What to do? Who will do it?) Package owners should update their packages to remove the dependency
  • Contingency deadline: beta freeze
  • Blocks release? Yes

Documentation

Should be mentioned in Release Notes.

Release Notes

openssl1.1 package is removed and should not be used by any packages.