Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-03 Thread Ruediger Pluem
On 02.06.2010 18:23, Joe Orton wrote: > Thanks very much for all the responses. There is strong consensus for > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > A new RFC, then, for trunk/2.3 and beyond: > > - support and build warning-free with OpenSSL >= 0.9.8 > - su

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Justin Erenkrantz
On Wed, Jun 2, 2010 at 4:23 PM, Joe Orton wrote: > Thanks very much for all the responses.  There is strong consensus for > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > A new RFC, then, for trunk/2.3 and beyond: > > - support and build warning-free with OpenSSL >= 0.9

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Joe Orton
On Wed, Jun 02, 2010 at 01:18:17PM -0500, William Rowe wrote: > On 6/2/2010 11:23 AM, Joe Orton wrote: > > Thanks very much for all the responses. There is strong consensus for > > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > > > A new RFC, then, for trunk/2.3 and b

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread William A. Rowe Jr.
On 6/2/2010 11:23 AM, Joe Orton wrote: > Thanks very much for all the responses. There is strong consensus for > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > A new RFC, then, for trunk/2.3 and beyond: > > - support and build with OpenSSL >= 0.9.7a, albeit with (har

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Rainer Jung
On 02.06.2010 18:23, Joe Orton wrote: Thanks very much for all the responses. There is strong consensus for retaining support for some varieties of 0.9.8 and possibly some 0.9.7. A new RFC, then, for trunk/2.3 and beyond: - support and build warning-free with OpenSSL>= 0.9.8 - support and buil

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Jeff Trawick
On Wed, Jun 2, 2010 at 12:23 PM, Joe Orton wrote: > Thanks very much for all the responses.  There is strong consensus for > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > A new RFC, then, for trunk/2.3 and beyond: > > - support and build warning-free with OpenSSL >= 0.

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread William A. Rowe Jr.
On 5/25/2010 7:45 AM, Joe Orton wrote: > I'd like to drop support for versions of OpenSSL older than 1.0 in the > trunk mod_ssl. We have 200+ lines of compat macro junk and still six > different compiler warnings remain in a trunk build against 1.0.0. +1 to axing all SSLC related conditionals,

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Jim Jagielski
On Jun 2, 2010, at 12:33 PM, Sander Temme wrote: > > On Jun 2, 2010, at 9:30 AM, Jim Jagielski wrote: > >> >> On Jun 2, 2010, at 12:23 PM, Joe Orton wrote: >> >>> Thanks very much for all the responses. There is strong consensus for >>> retaining support for some varieties of 0.9.8 and poss

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Sander Temme
On Jun 2, 2010, at 9:30 AM, Jim Jagielski wrote: > > On Jun 2, 2010, at 12:23 PM, Joe Orton wrote: > >> Thanks very much for all the responses. There is strong consensus for >> retaining support for some varieties of 0.9.8 and possibly some 0.9.7. >> >> A new RFC, then, for trunk/2.3 and bey

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Sander Temme
On Jun 2, 2010, at 9:23 AM, Joe Orton wrote: > Thanks very much for all the responses. There is strong consensus for > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > A new RFC, then, for trunk/2.3 and beyond: > > - support and build warning-free with OpenSSL >= 0.9

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Jim Jagielski
On Jun 2, 2010, at 12:23 PM, Joe Orton wrote: > Thanks very much for all the responses. There is strong consensus for > retaining support for some varieties of 0.9.8 and possibly some 0.9.7. > > A new RFC, then, for trunk/2.3 and beyond: > > - support and build warning-free with OpenSSL >= 0.

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Joe Orton
Thanks very much for all the responses. There is strong consensus for retaining support for some varieties of 0.9.8 and possibly some 0.9.7. A new RFC, then, for trunk/2.3 and beyond: - support and build warning-free with OpenSSL >= 0.9.8 - support and build with OpenSSL >= 0.9.7a, albeit with

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Jeff Trawick
On Wed, Jun 2, 2010 at 3:16 AM, Issac Goldstand wrote: > On 6/1/2010 6:37 PM, Igor Galić wrote: >>> >>> * Solaris 10: 0.9.7 with backports... don't recall what's in the >>> Coolstack but someone else may be able to tell us. >>> >> >> The Coolstack and the Webstack both use the system's SSL binding

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Nick Kew
On 31 May 2010, at 22:10, Sander Temme wrote: > I think this goes hand in hand with what operating system versions we will be > targeting for 2.4. We should inventory which versions of the libraries are > offered on each and then make the decision whether to accomodate: I don't think that's o

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-02 Thread Issac Goldstand
On 6/1/2010 6:37 PM, Igor Galić wrote: * Solaris 10: 0.9.7 with backports... don't recall what's in the Coolstack but someone else may be able to tell us. The Coolstack and the Webstack both use the system's SSL bindings. Coolstack symlinks it: libssl.so.0.9.7 => /usr/sfw/l

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-06-01 Thread Igor Galić
> Deprecating obsolete libraries is a good thing, especially if there is > a compelling replacement. > > I think this goes hand in hand with what operating system versions we > will be targeting for 2.4. We should inventory which versions of the > libraries are offered on each and then make th

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-31 Thread Dr Stephen Henson
On 31/05/2010 22:10, Sander Temme wrote: > > Please note that no released version of Apache knows how to put OpenSSL into > FIPS mode. When your Many Users run Apache in a situation with FIPS > requirements, which and whose patches do they use? Work on FIPS integration > at Apache itself stalled

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-31 Thread Sander Temme
On May 29, 2010, at 6:02 AM, Steve Marquess wrote: > Dr Stephen Henson wrote: >> On 25/05/2010 13:45, Joe Orton wrote: >> >>> I'd like to drop support for versions of OpenSSL older than 1.0 in the >>> trunk mod_ssl. We have 200+ lines of compat macro junk and still six >>> different compiler

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-29 Thread Justin Erenkrantz
On Tue, May 25, 2010 at 6:14 AM, Jeff Trawick wrote: > There's no ready answer to this, but I wonder:  How much of the > current conditional logic is required to support the OpenSSL in > > fully patched RHEL 4 > fully patched Solaris 10 > (some other typical server platform that bundles OpenSSL)

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-29 Thread Steve Marquess
Dr Stephen Henson wrote: On 25/05/2010 13:45, Joe Orton wrote: I'd like to drop support for versions of OpenSSL older than 1.0 in the trunk mod_ssl. We have 200+ lines of compat macro junk and still six different compiler warnings remain in a trunk build against 1.0.0. pro: simplify code:

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-25 Thread Eric Covener
On Tue, May 25, 2010 at 9:03 AM, Dr Stephen Henson wrote: > On 25/05/2010 13:45, Joe Orton wrote: > con: means FIPS 140-2 support would be dropped too. FIPS 140-2 is not > supported > in 1.0.0, only 0.9.8 (well 0.9.7 too but we recommend everyone use the 1.2 > module with 0.9.8 if possible). Doe

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-25 Thread Jeff Trawick
On Tue, May 25, 2010 at 8:45 AM, Joe Orton wrote: > I'd like to drop support for versions of OpenSSL older than 1.0 in the > trunk mod_ssl.  We have 200+ lines of compat macro junk and still six > different compiler warnings remain in a trunk build against 1.0.0. > > pro: simplify code: remove ssl

Re: RFC: drop support for OpenSSL < 1.0 in trunk/2.3?

2010-05-25 Thread Dr Stephen Henson
On 25/05/2010 13:45, Joe Orton wrote: > I'd like to drop support for versions of OpenSSL older than 1.0 in the > trunk mod_ssl. We have 200+ lines of compat macro junk and still six > different compiler warnings remain in a trunk build against 1.0.0. > > pro: simplify code: remove ssl_toolkit_c