F45 Change Proposal: OpenSSL40 [SelfContained]

Project Discussion Change Proposals
, ,
1

:link: OpenSSL40

Wiki

Announced

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

:link: Summary
OpenSSL 4.0 is going to land in April 2026. It is a major release with many significant changes, and we should start preparing to it.

:link: Owner

:link: Detailed Description
OpenSSL upstream has started development of the version OpenSSL 4.0
It will imply soname bump, removing ENGINE support, etc. As OpenSSL uses time-based release planning, the release would happen in April 2026.

If I’m not mistaken, this change could land only in Fedora 45, but I think it’s worth considering the transition already.

We definitely would need an openssl3-compat package(s) including the one with engine support but I would better avoid being a primary maintainer of it.

:link: Feedback

:link: Benefit to Fedora
Fedora would get the latest stable version of OpenSSL, a corner-stone crypto toolkit used in a gazillion of projects.

We also get rid of engine support which is currently slowly degrading because of being superseded by providers.

:link: Scope

  • Proposal owners: rebasing OpenSSL to 4.0, and building OpenSSH and maybe some other crucial components to provide the system in an accessible state.

Maintaining the openssl3-compat package (but I would prefer offloading it to someone else)

Rebuild their components against new version of OpenSSL (probably implying mass rebuild).

Mass rebuild is required.

  • Trademark approval: N/A (not needed for this Change)

  • Alignment with the Fedora Strategy: yes

:link: Upgrade/compatibility impact
It depends on the compat package presence. If it is present, previous packages would continue working. If not, the 3rd-party packages and packages using engines and deprecated API removed in 4.0 will be broken.

:link: Early Testing (Optional)

:link: How To Test
All the components relying on OpenSSL should be rebuilt with the new version and pass the regular tests. If the compat package is provided, the spec files for the packages not switching to the new version should be updated.

:link: User Experience
There should not be any major UX changes.

:link: Dependencies
A lot of them.

:link: Contingency Plan
Providing the compat package for OpenSSL 3.

:link: Documentation
No upstream documentation yet

:link: Release Notes
OpenSSL is rebased to 4.0, and there are a lot of changes…

Last edited by @alking 2025-10-01T14:01:13Z

Last edited by @alking 2025-10-01T14:01:13Z

2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

4

Generally in favor, but I think the openssl3-compat package is likely to be required, so we need a confirmed maintainer before this proposal should be accepted.

It would seem to be desirable to perform a rebuild of all openssl dependent packages in Fedora so that the packagers have early warnings IRT any breakage, and to allow them to work with upstreams for fixes (as my guess is that not all openssl3 consuming packagers are going to just work).

1 Like
5

A small detail: Please don’t name the compat package openssl3-compat, but openssl3. See Naming Guidelines :: Fedora Docs

1 Like
6

Previously the packages had -compat in their name

7

I know. It was contradicting the packaging guidelines (or it was following an ancient version of them). Please refrain from doing it again; instead, follow the current packaging guidelines. Thanks.

2 Likes
8

This change proposal has now been submitted to FESCo with ticket #3481 for voting.

To find out more, please visit our Changes Policy documentation.

9

I don’t really think this is a “Self Contained Change”…

10

I agree, it should be turned into system-wide change.