Re: openssl3 plans?

[Greg Troxel <gdt%lexort.com@localhost>]

Taylor R Campbell <riastradh%NetBSD.org@localhost> writes:

> Are there plans for openssl3 in pkgsrc?
>
> openssl11 has just a week left before EOL on 2023-09-11, according to
> <https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/>.

Given how unbaked the world is about adapting to 3, in terms of
upstreams and new releases, that seems overly aggressive.

There is wip/openssl3.  I am not clear on if it is up to date, and what
happens if one installs it and points the openssl bl3 stuff at it sort
of as if it were committed as an upgrade.  A bulk build is in order.

There has not been any recent discussion on tech-pkg about moving to
openssl3 in any near-term actually doing it sort of way.  (Mentioning
that we have to eventually doesn't count :-)

It's after 9/1, and thus updating openssl before the branch is not
possible per https://www.pkgsrc.org/quarterly/.  It's not something I
would approve in pre-freeze as it's pretty obvious there will be a lot
of breakage.

However, it's 100% ok to start thinking about "what do we need to do to
update to openssl3 as soon as we come out of freeze"?  (mess in October
that we get totally fixed before December 1 is much much more ok!)

This really belongs on tech-pkg, but I think it's:

  verify/fix that wip/openssl3 is up to date.  It's at 3.1.0 and it
  looks like 3.1.2 is current so that probably isn't hard.

  think and then argue about if we have two and a choice, or just
  openssl3.

  Try out a local update, basically build/replace it and fudge the bl3
  so it gets used, or do an uncommitted update.

  build a few things and do basic checks

  do a bulk build on netbsd 8/9/10 x86_64

  do testing on other OSes, other CPUs

  fix a ton of packages which have not released updates, probably\

  assess what we are leaving behind.  revisit the just-one or both
  choice, even if someone has to choose only one.