On Tue, Aug 3, 2021 at 7:10 AM Simo Sorce <s...@redhat.com> wrote: > > On Tue, 2021-08-03 at 06:50 -0400, Neal Gompa wrote: > > On Tue, Aug 3, 2021 at 5:59 AM Simo Sorce <s...@redhat.com> wrote: > > > > > > On Mon, 2021-08-02 at 17:43 -0400, Neal Gompa wrote: > > > > On Mon, Aug 2, 2021 at 5:39 PM Stephen Gallagher <sgall...@redhat.com> > > > > wrote: > > > > > > > > > > On Mon, Aug 2, 2021 at 11:11 AM Simo Sorce <s...@redhat.com> wrote: > > > > > > > > > > > > I think at this stage it may be safer to defer to F36, and land > > > > > > OpenSSL > > > > > > 3.0 in rawhide right after F35 forks out. > > > > > > > > > > > > > > > > I'm generally in agreement here; I think it's too much risk too late > > > > > in the cycle. Could you re-propose the Change for F36? > > > > > > > > I'm not sure I agree, but the Change owners can request the proposal > > > > to be deferred to F36, which I *personally* would accept if > > > > they intended to import OpenSSL 3.0 into Rawhide *right* after > > > > branching. No more delaying it since it's clearly being done in RHEL > > > > (which is already super-backwards to begin with). This Change has > > > > already been deferred once (it was originally planned for F34). I > > > > don't want it deferred again without a plan to work on it *in Fedora*. > > > > > > > > Otherwise, just abandon the Change entirely. > > > > > > Neal, > > > you are addressing this as if the OpenSSL maintainers are being > > > capricious. > > > > > > We deferred the introduction of OpenSSL 3.0 in Fedora because we did > > > not want a mess in a distribution that is actually used, out of concern > > > for our users. > > > > > > We can "dump" OpenSSL 3.0 in Fedora at any time, but we consciously > > > choose not to as to avoid pain for users. We cannot drop the Change > > > because we have to introduce OpenSSL 3.0 at some point, we just want to > > > introduce it when it's right for Fedora. > > > > > > > My irritation comes from the lack of communication from the Change > > owner. This Change has already been deferred once (for good reason, > > mind you). I'm annoyed that this is being deferred again because this > > time the Change owner hasn't said *anything* at all. Everyone else > > seems to be speaking (even Florian, which confuses me). I wouldn't > > mind the Change being deferred again for solid technical reasons, but > > I don't know how to trust that this Change is ever going to get done > > because zero work happened and zero communication happened. > > The fact work isn't visible, doesn't mean nothing happened. >
To most people, it appears that nothing has happened, yes. It would have been nice to know that stuff happened. > That said, upstream broke the ABI between alpha and beta1 so we are > very happy that we "have done nothing" in Fedora and delayed the > change. > Sure, but the Change proposal[1] explicitly says that the work would start *after* the beta release in June. The beta release came out June 17[2], and nothing happened afterward in Fedora, presumably because Sahana was working on rebasing to it in CentOS Stream 9, which completed a month later[3]. Note that now Beta 2 came out a week ago[4], which seems to carry *some* ABI stability (which is a surprise to me, honestly...). From my naive point of view, once that rebase work was complete, I would have expected the same effort to land in Fedora, since we already had the openssl1.1 compatibility package created a year ago[5]. Then we could have integrated it as part of the mass build last week instead of needing a targeted rebuild for it in a side-tag. For what it's worth, there seem to be 633 source packages that produce 940 binary packages that link to OpenSSL, so it's not *that* crazy to do a targeted rebuild: > ngompa@localhost ~> sudo dnf -q repoquery --qf "%{SOURCERPM}" --whatdepends > openssl-libs --latest=1 --exclude=\*.i686 | wc -l > 633 > ngompa@localhost ~> sudo dnf -q repoquery --whatdepends openssl-libs > --latest=1 --exclude=\*.i686 | wc -l > 940 Basically, my problem is that I don't think Sahana was prepared on how to handle doing this work properly and they just need to be aware that communication is extremely important when doing stuff like this. Sahara took this over from Tomáš Mráz, who left Red Hat to work for the OpenSSL Foundation on OpenSSL full-time. In that transfer, I don't think anyone educated Sahana on how to handle Fedora Changes. However, regardless of all the previous mistakes, I still don't think that OpenSSL 3.0 necessarily needs to be skipped for Fedora Linux 35 based on all that. What *would* concern me is OpenSSL 3.0's own release schedule, or rather the lack of one. It is unclear when OpenSSL 3.0 final is supposed to be released. Digging into the upstream project information, it seems like there's not much left[6]. But I'm unsure if they do relatively fixed milestones or very fluid milestones. That's also combined with no estimates of when OpenSSL 3.0 final is supposed to be released, at least none that I can find. [1]: https://fedoraproject.org/wiki/Changes/OpenSSL3.0 [2]: https://www.openssl.org/blog/blog/2021/06/17/OpenSSL3.0ReleaseCandidate/ [3]: https://gitlab.com/redhat/centos-stream/rpms/openssl/-/merge_requests/15 [4]: https://github.com/openssl/openssl/releases/tag/openssl-3.0.0-beta2 [5]: https://src.fedoraproject.org/rpms/openssl1.1 [6]: https://github.com/openssl/openssl/milestone/15 -- 真実はいつも一つ!/ Always, there's only one truth! _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure