Date: Sat, 30 Nov 2019 11:43:45 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Magnus Hagander <magnus@hagander.net>,
	Daniel Gustafsson <daniel@yesql.se>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: Update minimum SSL version
Message-ID: <20191130024345.GD99291@paquier.xyz>
References: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com>
 <224FD25C-BA10-44FA-95AA-F97C35FB3BB0@yesql.se>
 <CABUevEy4meLCVnrTbjU9zoJvRoWUjvmdmUUkaoAqKYkk0MWHYA@mail.gmail.com>
 <20191129125727.GN2505@paquier.xyz>
 <13786.1575041447@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="at6+YcpfzWZg/htY"
Content-Disposition: inline
In-Reply-To: <13786.1575041447@sss.pgh.pa.us>
Precedence: bulk


--at6+YcpfzWZg/htY
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Nov 29, 2019 at 10:30:47AM -0500, Tom Lane wrote:
> What's the impact going to be on buildfarm members with older openssl
> installations?  Perhaps "none", if they aren't running the ssl test
> suite, but we should be clear about it.

The buildfarm logs don't directly report the version of OpenSSL used
as far as I recalled, and a quick lookup shows that..  Anyway, I
recall that all Windows buildfarm members linking to OpenSSL use at
least 1.0.2 on HEAD.  For the others, I would be ready to suspect that
some of them are still using 0.9.8 and 1.0.0.

Anyway, as we still support OpenSSL down to 0.9.8 on HEAD, shouldn't
we just patch the SSL TAP tests to make sure that we don't enforce an
incorrect minimum version at configuration time?

[... thinks more ...]

Actually, no, what I am writing here is incorrect.  We should make
sure of that the default configuration is correct at initdb time, and
the patch does not do that.
--
Michael

--at6+YcpfzWZg/htY
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAl3h12EACgkQnvQgOdby
QH0Dxg//aj+pYhnqN2+DCp1vblUsw+vcEjd3CaH3n08itiS01+7/tt1SNsP8CfvR
VWgp1t5XyQhF70RNwIqOOFW63PPMqWdgzSTByoms9Sj+fG8buneVu+GUxaYfkkMn
216yaqppcqc8OuxWo4gLk7ZmhJ8i6lWXyrAcxRuhW8E/+6VINAmM566NSGqWWzCs
Q4ffiJHx1f7qQL6kr1TqcnUCTqbBrwmhHh69vpkOysLyx9bcMiJDp5dB+1VSvJtO
rIJs/QHNtpt5e2suwmByvJ1ZXoiIZvcWe6BqtQ0ARks3JRJ/2yHsipG2vgiNxPPX
rtEBU9wqtHpJkCMZ5WolVvAiqWWB8lhJ45KcuuuSUx7S2OFhGcn+zoZyA78wzABg
8PqcYbwwACt9s+Nwuv2vQNDt08XS2iLbbI5YYfkJ6W45WzybCinVr7MBPcDY3AwJ
v3uGYQ8q2pgKI+lmVhD5b2zemMf4gtm+9/nAf+9xXmZyg5MCjOrLthaaFF/PNKEh
hDbqTFINKvP0ncvpRfd3aUWm8oRKq6xpB6H2ky0JdqZTilJMl7Mxb4IM52ts+9QK
PfC7ViT5e+EJQYtGqIKoSBn1eu9RU43VJ+p2XJpZ5l71OTEa/iZaimmU7t2cNCvm
o6GJEszWrM1OguHGRng6Up2S83KohlXWaGfKZmWDEvSOi/XKagQ=
=LKxa
-----END PGP SIGNATURE-----

--at6+YcpfzWZg/htY--