Bug#827061: transition: openssl
Control: tags -1 confirmed
On 25/10/16 20:09, Moritz Muehlenhoff wrote:
> On Wed, Oct 19, 2016 at 10:44:08PM +0200, Kurt Roeckx wrote:
>> On Mon, Oct 17, 2016 at 08:52:31PM +0200, Emilio Pozuelo Monfort wrote:
>>>
>>> I'm sorry but I'm going to have to nack this for Stretch, as much as I like to
>>> approve transitions and get new stuff in. I have looked at the opened bugs and
>>> I'm afraid this still is too disruptive. I have noticed that you have forwarded
>>> some of them and sent patches, and I appreciate that. We can do this early in
>>> the Buster cycle, so let's look at the status of this and prepare for the
>>> transition when Stretch gets released.
>>
>> Is having 2 version of OpenSSL in Stretch an option?
>
> We've discussed this within the security team and we'd be fine with
> a one-time exception to have two openssl releases in stretch; the API
> changes are clearly too invasive to cover the entire Debian archive,
> but 1.1 also carries sufficiently important new features (like support
> for chacha20/poly1305) to warrant the extra complexity.
>
> (It's the release team's call of course).
19:46 < nthykier> pochu: seen jmm_ reply to the libssl thread?
19:46 < jcristau> adsb: yay for binary debdiffs in q-v! thanks a bunch.
19:46 < pochu> yep
19:47 < pochu> nthykier: so my concern was there was a big risk that we
wouldn't finish the transition intime, delaying the release. but if the security
team is fine with (potentially, as I'll try not to) shipping both, then we
should be fine, and I think I'll ack it
19:48 < pochu> of course we'll still try to get rid of the old one
19:48 < nthykier> ack, I think that just made me pro on doing that as well
19:48 < pochu> cool, good to see we're on the same page
So let's do this. Let's try to get it finished and only ship openssl 1.1. We
still have three months until the full freeze, and depending on how many
packages (and which ones, for risk management etc) are left to be fixed after
that, I may be happy to grant exceptions. But worst case we just ship both.
But please, wait a little bit so that we can sort out the PIE fallout. You can
start preparing the updates and upload to experimental to clear NEW if you want.
We'll let you know once it's ok to upload to sid.
BTW I noticed Fedora has started this transition as well, so they may have some
patches that we are missing in the BTS.
Also, please bump all the bugs to serious.
Cheers,
Emilio
Reply to: