Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate formulae to openssl@3 #134251

Closed
carlocab opened this issue Jun 20, 2023 · 21 comments · Fixed by #134260
Closed

Migrate formulae to openssl@3 #134251

carlocab opened this issue Jun 20, 2023 · 21 comments · Fixed by #134260
Assignees
Labels
help wanted Task(s) needing PRs from the community or maintainers openssl-3-migration Related to switching to an OpenSSL 3 dependency

Comments

@carlocab
Copy link
Member

carlocab commented Jun 20, 2023

I'm opening this issue to track progress on the migration to OpenSSL 3, since OpenSSL 1.1 wil be EOL relatively soon. This also serves as a call for help with this migration.

Below is a list of formulae that need to be migrated to openssl@3. If you'd like to help out, please open a pull request that targets the openssl-migration-staging branch that updates one of the formulae listed below to use openssl@3 instead of openssl@1.1.

If you encounter brew audit failures, then it is possible that either:

  1. Your pull request does not target the openssl-migration-staging branch. Please close your pull request and open a new one that targets the right branch.
  2. The formula you are trying to migrate has a dependency that hasn't yet been migrated to use openssl@3 instead. Please open a pull request to migrate those dependencies first, and then rebase your original pull request against the openssl-migration-staging branch after your pull request migrating the relevant dependencies has been merged to openssl-migration-staging.
`openssl@1.1` dependents with linkage to `openssl@1.1`

The following formulae have an openssl@1.1 dependency, but they have no linkage with openssl@1.1 on Linux. A few thoughts on how you might handle these:

  • If the formula doesn't actually use OpenSSL, then the openssl@1.1 dependency can just be removed.
  • If the formula uses OpenSSL, then it may be using a vendored version or is linking to the wrong version (e.g. openssl@3). This is common for formulae that build using Rust. Please migrate the formula to use openssl@3 and adjust the build so that it links with the new openssl@3 dependency. In the case of formulae that use Rust, it may suffice to set OPENSSL_DIR and OPENSSL_NO_VENDOR. There are many examples of this in Homebrew/core. It may also be useful to update the test to catch future instances of mis-linkage.
Dependents of `openssl@1.1` with no linkage

These formulae have no openssl@1.1 dependency, but have linkage with openssl@1.1 (on Linux). These will have to be handled on a case-by-case basis, but some of my comments regarding the previous category might apply here too. But we will want to persuade these formulae to use openssl@3 instead.

Details

@Bo98
Copy link
Member

Bo98 commented Jun 20, 2023

To clarify, are we still doing this "top-down"? I ask because otherwise the dependencies listed in the tab may list both OpenSSL versions.

@carlocab
Copy link
Member Author

carlocab commented Jun 20, 2023

Yes, we are. brew audit <formula> should still catch recursive dependency conflicts (except on Linux).

@Bo98
Copy link
Member

Bo98 commented Jun 20, 2023

Great, thanks! It wasn't clear to me which audit we were skipping here.

@carlocab
Copy link
Member Author

carlocab commented Jun 20, 2023

The recursive dep conflict check is now skipped only when doing brew audit --tap, and only for PRs that target openssl-migration-staging.

@carlocab
Copy link
Member Author

For reference, there is a list of dependents of openssl@1.1 sorted according to the number of dependents they have here. It may be useful to go from the top of that list going down. (But it's not exactly a topological sort, so that order isn't 100% correct.)

@carlocab
Copy link
Member Author

Ok, once we've merged the following, I think the OpenSSL 3 migration is ready to 🚢:

There are still a number of outstanding PRs, but I don't consider any of them significant enough to block #134260.

CC @Homebrew/core for thoughts.

@p-linnane
Copy link
Member

This is a huge win, especially in such a short time frame. :shipit:

@carlocab
Copy link
Member Author

Thanks everyone for the help!

@limingxinleo
Copy link

When I use ssh with openssl@3

The command will cause CPU 100%, when I change the shell window.

@carlocab
Copy link
Member Author

Please open a new issue instead of commenting on closed ones.

@Homebrew Homebrew locked as resolved and limited conversation to collaborators Jun 27, 2023
@carlocab
Copy link
Member Author

carlocab commented Jul 1, 2023

I opened #135527 to track the remaining stragglers.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
help wanted Task(s) needing PRs from the community or maintainers openssl-3-migration Related to switching to an OpenSSL 3 dependency
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants