On Fri, 2 Mar 2018 10:04:44 +0100 Emilio Pozuelo Monfort <
pochu@debian.org> wrote:
> On 01/03/18 22:31, Alessandro Ghedini wrote:
> > Package:
release.debian.org> > Severity: normal
> > User:
release.debian.org@packages.debian.org> > Usertags: transition
> >
> > Hello,
> >
> > I'd like to request a transition for curl in order to unblock the migration
> > to OpenSSL 1.1 (#871056).
>
> Good!
>
> > This is necessary due to the fact that the curl ABI
> > exposes a structure inherited from libssl itself, which was changed in the 1.1
> > update (see #844018 for more information).
> >
> > It is for the most part a clean ABI bump, however a few packages that build
> > depend on both libcurl and libssl will need source uploads so they can also
> > migrate to OpenSSL 1.1. The following packages were identified as part of the
> > discussion in #858398:
> >
> > * hhvm: #858927 (sid-only)
> > * lastpass-cli: #858991
> > * libapache2-mod-auth-cas: 858992
> > * netsurf: #859230
> > * xmltooling: #859831
> > * zurl: #859841
>
> xmltooling / Shibboleth / xml-security-c don't seem ready yet. Apparently there
> are patches upstream but there have been no new releases and they are not easy
> to backport. I suppose at some point we'll need to stop blocking on them. They
> can be fixed later and re-enter testing when that happens, there's still plenty
> of time before the freeze.
Indeed xmltooling requires both openssl based curl, and openssl-1.0. In Ubuntu, we did not manage to resolve it, hence I have uploaded "curl3"[0] package into ubuntu that provides libcurl-openssl1.0-dev, which builds curl against openssl1.0 and provides a library that xmltooling can link against.
This was done out of time constraints due to imminent Ubuntu release. Ideally xmltooling should be ported to openssl-1.1 as a long term maintainable solution.
Regards,
Dimitri.