openssl version

[Jason W]

I am going to keep it as openssl-0.9.8m since it is good to know the patchlevel with openssl.  Changing the dep files on any patchlevel update is not hard, though of course we normally keep version numbers out of extension names.  I thought I had mentioned somewhere in the last few posts I was wanting to keep the "m" in the extension name but it looks like I didn't. 

[Kingdomcome]

OpenSSH is very closely tied to OpenSSL, Im not sure how close or if there would be any problems, but I can rebuild once openSSL appears in the repo.

[Jason W]

It would be nice if you could rebuild openssh against the openssl-0.9.8m that is available in the above link so they can be uploaded both at once.  That way we don't risk a partially broken openssh in the repo.

[Kingdomcome]

Sorry, I read right past that post originally.  I have just submitted an openssh extension built against openssl-0.9.8m

[Jason W]

New openssl and openssh are uploaded, and dep files have been adjusted.  

Refer to the dep file adjusting script in the Programming and Scripting section to adjust you existing
dep files to replace the openssl-0.9.8h entries with openssl-0.9.8m.

[Jason W]

Running Appsaudit and using the "Update Dependencies" function will fix your dep files in the tce directory and replace openssl-0.9.8h entries with openssl-0.9.8m.  Then you can select the openssl-0.9.8h.tcz extension and select it for deletion as it will not be a listed dependency anymore.  Then simply install openssl-0.9.8m.tcz and openssl-0.9.8m-dev.tcz to replace it.  Installing openssl-0.9.8m could be done before updating the dep files without issue.  And be sure to reboot after replacing the extensions.

That should do it, please ask if there is any trouble moving to the new openssl with an existing tce directory.

[danielibarnes]

Jason, maro, Kingdomecome:
Thanks for picking this up and making it available so quickly in a compatible way. I'll build lighttpd against it and submit it as soon as I can.

[danielibarnes]

FWIW 0.9.8n is out today.

[Jason W]

TC 3.0 would likely be a good time to update to a newer 0.9.8 as it is not totally seamless, a small number of apps will likely have issue.

[maro]

Thanks Jason for your quick action after the "curl investigation".

I noticed that there are now a few .dep files with two entries for 'openssl-0.9.8m.tcz'. Whilst this is completely harmless, it might be still a good idea to tidy things up. The .dep files are: hedgewars.tcz.dep, lyx.tcz.dep, and wpa_gui.tcz.dep

Furthermore I wonder how you plan to proceed with the "elimination" of '0.9.8k'. Whilst my analysis was triggered off by 'curl', the investigation involved all extensions depending on '0.9.8k'. I'm pretty sure that none of the remaining six extensions (i.e. dropbox, links, tshark, vsftpd-ssl, wireshark and x11vnc) will require '0.9.8k', as can be seen in the log files provided with the analysis.

[Jason W]

Dep files updated, thanks.

For those built against a certain ssl directory, it seems that if libs in that ssl directory are not found, it soes with the ones in $PATH. 

Hopefully, openssl updates will not be frequent, and only in response from adequate pressure from the community.

Thanks for your help in it.

[robc]

Furthermore I wonder how you plan to proceed with the "elimination" of '0.9.8k'. Whilst my analysis was triggered off by 'curl', the investigation involved all extensions depending on '0.9.8k'. I'm pretty sure that none of the remaining six extensions (i.e. dropbox, links, tshark, vsftpd-ssl, wireshark and x11vnc) will require '0.9.8k', as can be seen in the log files provided with the analysis.

I have already updated x11vnc, I just need to package it up and submit it. I can probably get to wireshark/tshark and vsftpd tomorrow.

[danielibarnes]

Hopefully, openssl updates will not be frequent, and only in response from adequate pressure from the community.

What about vulnerabilities?

[Jason W]

Updating with each openssl release, especially when they are one month apart, is a lot of testing and adjusting existing dep files. 

But the patch difference between the m and n version is small:

http://www.openssl.org/news/secadv_20100324.txt

For the sake of existing dep files and all that, I can apply the patch to the m version so the extension name remains the same.  I don't think there should be breakage with the patch applied, and in effect we will then have version n.

[robc]

version 1.0.0 has finally been released...3.x?