Hello,

I have started working on upgrading the entire distribution to OpenSSL 1.1.0. This is however not the easiest task since many packages are just incompatible with the API changes of OpenSSL.

Therefore, I started this in an own branch, upgraded all sorts of packages that won't build and patched those who could be patched. However, this is still quite chaotic and I need some help of the maintainers of some of the packages to do this for their own packages.

I have already dropped some packages in this process that a) were incompatible with OpenSSL 1.1.0, b) where no patches were available and c) that are not maintained upstream any longer. I also cherry-picked those commits to the current next tree. If someone disagrees, please open a separate discussion.

The packages dropped are:

* Pound * vsftp * sslscan

Packages which currently don't build and I could not patch very easily:

* php * asterisk * openvpn

I suppose Erik is best to upgrade to openvpn 2.4, Dirk upgrades asterisk and I am quite sure that there is a few people out there who have been working on php. Please raise your hands.

I would like to have the openssl 1.1 branch ready for merge into next at the end of December. Please make sure that any patches have been submitted until then.

Please work on top of this branch:

https://git.ipfire.org/pub/git/people/ms/ipfire-2.x.git openssl-11

https://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=shortlog;h=refs/heads/o...

Please also submit improvements of other packages that we can make sure of (i.e. better cipher suites for Apache, etc.)...

Best, -Michael