From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <goca-cygwin-apps@m.gmane-mx.org>
Received: from ciao.gmane.io (ciao.gmane.io [116.202.254.214])
 by sourceware.org (Postfix) with ESMTPS id 2105E3857416
 for <cygwin-apps@cygwin.com>; Wed, 27 Oct 2021 13:24:38 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 2105E3857416
Received: from list by ciao.gmane.io with local (Exim 4.92)
 (envelope-from <goca-cygwin-apps@m.gmane-mx.org>) id 1mfiux-0006B7-MT
 for cygwin-apps@cygwin.com; Wed, 27 Oct 2021 15:24:35 +0200
X-Injected-Via-Gmane: http://gmane.org/
To: cygwin-apps@cygwin.com
From: Andrew Schulman <schulman.andrew@epa.gov>
Subject: Re: [ATTN MAINTAINERS] OpenSSL 1.0 dependencies
Date: Wed, 27 Oct 2021 09:24:28 -0400
Message-ID: <m3kinglls5mfkvtd8eig8rtmf5299ufcdo@4ax.com>
References: <87tuh7iqkm.fsf@Rainer.invalid>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Newsreader: Forte Agent 4.2/32.1118
X-Archive: encrypt
X-Spam-Status: No, score=-3032.2 required=5.0 tests=BAYES_00,
 HEADER_FROM_DIFFERENT_DOMAINS, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS,
 TXREP autolearn=no autolearn_force=no version=3.4.4
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on
 server2.sourceware.org
X-BeenThere: cygwin-apps@cygwin.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Cygwin package maintainer discussion list <cygwin-apps.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin-apps>,
 <mailto:cygwin-apps-request@cygwin.com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin-apps/>
List-Post: <mailto:cygwin-apps@cygwin.com>
List-Help: <mailto:cygwin-apps-request@cygwin.com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin-apps>,
 <mailto:cygwin-apps-request@cygwin.com?subject=subscribe>
X-List-Received-Date: Wed, 27 Oct 2021 13:24:39 -0000

> 
> We should get rid of dependencies to the obsolete OpensSSL 1.0 library
> that is no longer maintained upstream and has several critical bugs.
> 
> Current and previous versions of the following packages depend on the
> outdated libopenssl100 (a lot of these have many packages depending on
> them in turn and/or are orphaned):
...
> lftp
...

Are you sure about lftp? AFAIK it only uses libssl1.1:

$ lftp --version
LFTP | Version 4.9.2 | Copyright (c) 1996-2020 Alexander V. Lukyanov
...
Libraries used: Expat 2.4.1, idn2 2.3.2, libiconv 1.16, OpenSSL 1.1.1l  24
Aug 2021, Readline 8.1,
zlib 1.2.11

$ ldd /usr/bin/lftp | grep ssl
    cygssl-1.1.dll => /usr/bin/cygssl-1.1.dll (0x4c7bc0000)