This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.
We are going to remove the openssl11 package from Fedora 40.
In Fedora 36 we switched to OpenSSL 3.0 branch. This is a brand new version with new architecture. We left the openssl1.1 package for the applications that were unable to switch to the new API/architecture, 3rd-party applications, etc. The package was marked as deprecated in F37.
OpenSSL 1.1.1 has reached EOL in September 2023. We want to remove it from Fedora.
This proposal ensures than no new packages in Fedora will use the deprecated OpenSSL version that will cause an overall increase of security/stability.
It will also reduce the maintenance burden for the OpenSSL maintainers, especially when new CVEs are published.
Proposal owners: provide assistance in migration to other developers.
Other developers: Patch their packages to work with OpenSSL 3.0.
Release engineering: This feature doesn’t require coordination with release engineering.
Policies and guidelines: N/A (not needed for this Change)
Trademark approval: N/A (not needed for this Change)
Alignment with Community Initiatives:
3rd-party packages depending on OpenSSL 1.1.1 should be replaced with new versions using new OpenSSL 3.0+.
OpenSSL 1.1 should not be available to install from Fedora repository. No packages should depend on OpenSSL 1.1.1.
Shouldn’t be affected.
We have found at least the following packages depending on OpenSSL 1.1:
- Contingency mechanism: (What to do? Who will do it?) Package owners should update their packages to remove the dependency
- Contingency deadline: beta freeze
- Blocks release? Yes
Should be mentioned in Release Notes.
openssl1.1 package is removed and should not be used by any packages.