From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 83359 invoked by alias); 21 Jul 2019 18:32:54 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 83351 invoked by uid 89); 21 Jul 2019 18:32:53 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.1 spammy=maintenance, H*M:1c69fb81, H*M:google, cygwincom X-HELO: mail-ot1-f50.google.com Received: from mail-ot1-f50.google.com (HELO mail-ot1-f50.google.com) (209.85.210.50) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Sun, 21 Jul 2019 18:32:52 +0000 Received: by mail-ot1-f50.google.com with SMTP id z23so9560289ote.13 for ; Sun, 21 Jul 2019 11:32:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:date:from:to:subject:references:user-agent; bh=q2ZK7XiveLUFO+C8W/spJjmKo21g44qrvSng94r/Vu0=; b=OrMkSobvMwJ9S4SOs03rLEdnsdlLQ0iuX3/8FGiiK/m9PD8gXrZHUz6/WlpdHufzpK 3BM15o1VM0BBtxrLu3k7vwJ2aoZN2J34Ntb4fBL85pPAFmFN8c9ZbuG/ijWuSllLvysy ceeOSatVk2YwaeUSckTFg/D/NxeHZXWVczWmtZG+HINxTyVjIGZ7LOtQF+u/0txd+886 53tNzkzFPwoF1jiWKRiG2zjcz09IBgfQWvXerSV5X2S+mPQQCUGSukRu5oCfBHuy1luX i7DVp7QjItUJdFO0TkHHBrtD5wYQOzPFIRMXysghfeO7ZqsALrKrgswYk8VM1X8/IufD 9lQw== Return-Path: Received: from iNX ([2605:6000:9fc0:56:6045:8f05:def0:5b7]) by smtp.gmail.com with ESMTPSA id x5sm12801107oif.39.2019.07.21.11.32.49 for (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Sun, 21 Jul 2019 11:32:49 -0700 (PDT) Message-ID: <5d34afd1.1c69fb81.8cfdd.7f14@mx.google.com> Date: Sun, 21 Jul 2019 18:32:00 -0000 From: Steven Penny To: cygwin@cygwin.com Subject: Re: cURL dependencies broken References: <87d0i31eyy.fsf@Rainer.invalid> Content-Type: text/plain; charset=utf8; format=flowed User-Agent: Suede Mail/2.8.0 (github.com/cup/suede) X-SW-Source: 2019-07/txt/msg00161.txt.bz2 On Sun, 21 Jul 2019 19:20:53, Achim Gratz wrote: > Or maybe you should do that and lose the attitude? You are projecting. It was you who flatly refuted my position with no research at all. > Just to keep the record straight, you've been originally asking about > direct dependencies of curl, not transitory ones; so no, I didn't look > at those. I never said children only, I think you assumed that. A grandchild is still a dependency. Perhaps if I had said "direct dependencies" as you did, then it would be fair to make that assumption. > What has been obsoleted is actually libopenssl100; and it was > replaced by compatibility shims in libssl-1.0 for libraries and > applications that did not yet make the jump to the new API. Right, so even in that case why is OpenLdap using "libopenssl100" instead of "libssl1.0"? > It would all have been fairly obvious if you had looked at the announcement > mails and the actual library names. Please do not assume what mails I do and do not look at. > Your cygcheck output shows that this obsoletion has worked just the way it was > supposed to. In the general case yes, this is an elegant solution. However we are not in the general case, we are talking about a security sensitive package. I think it would be reasonable to expect that the cascading dependencies should be updated in tandem in this case. Else you are left with "weakest link" syndrome, where the end user is getting none of security fixes in regard to cURL with OpenLdap, or worse they assume they are. It looks like OpenLdap has been able to use OpenSSL 1.1 for over 2 years now: - http://openldap.org/lists/openldap-bugs/201704/msg00053.html - ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release but maybe it has not been changed because the package is abandoned: https://cygwin.com/cygwin-pkg-maint Can we pull OpenLdap out of cURL until this is resolved? Else I can voluteer to pick up maintenance. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple