11091 2017-02-21 09:47:14 +0000 update openssl to 1.1 2017-08-17 10:31:47 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.3 x86 Multiple RESOLVED FIXED LET Medium+ enhancement 2.4 M3 1 alex.kanavin alex.kanavin mark.hatle meta.mr.watcher meta.watcher randy.macleod ross.burton --- --- No (bug/feature does not impact docs) oldest_to_newest 70852 0 alex.kanavin 2017-02-21 09:47:14 +0000 This is non-trivial [1] and so should be a separate task outside of regular package update crunch. Initial recipe is here [2] [1] http://lists.openembedded.org/pipermail/openembedded-core/2016-December/130132.html [2] https://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/log/?h=akanavin/openssl-1.1 73004 1 mark.hatle 2017-05-03 15:41:47 +0000 At present, we expect we will still need the 1.0.x version of OpenSSL. This is due to various issues like the FIPS-140-2 module, as well as the EOL policy for 1.1 is shorter then the current 1.0.2. 73031 2 alex.kanavin 2017-05-04 08:21:45 +0000 Openssl 1.0 will be provided for as long as it's supported upstream, but it will not be the default. If you want or need 1.0, the recipe should explictly ask for it (DEPENDS = "openssl10"). Openssl 1.1 will be updated again to a newer not-yet-released version before it goes out of support. Can you review and test the patchset please? It's basically ready, and is held up only by u-boot still stuck at 1.0 (they have incomplete patches, which they can't quite finish off). Due to dependency chains this causes a file conflict with 1.1. 75715 3 ross.burton 2017-08-08 10:44:20 +0000 I think this new logcheck warning is from the ssl upgrade: [log_check] WARNING: StartCom_Certification_Authority.pem does not contain a certificate or CRL: skipping