Choice of the openssl version for 23.10 and 24.04

[Adrien Nader]

Hi,

A few weeks ago, openssl maintainers announced moving to a time-based
release (April and October):

https://www.openssl.org/blog/blog/2023/09/29/OpenSSL-Update-ICMC23/

> Key takeaway 3 : Time Based Release Policy
> We’re transitioning to time-based releases. This shift ensures
> predictability, allowing our users and developers to plan better and
> benefit from timely updates. The releases will be scheduled every
> April and October.

Based on this and the openssl 3.0 release date, I'd expect a new LTS
version to be released (almost) in time for 26.04 but not for 24.04.

*IF* an openssl LTS release is out in April 26.04, we might want to
track the corresponding openssl git branch during the 26.04 release in
order to be able to ship it. This is more than two years away however
and a lot can happen until then. I don't have a crystal ball
unfortunately. In any case, we'll know if the planned and the actual
release cadence and calendar match.

-- 
Adrien

On Wed, May 31, 2023, Adrien Nader wrote:
> Hi,
> 
> On Thu, May 18, 2023, Adrien Nader wrote:
> > On Wed, May 17, 2023, Dimitri John Ledkov wrote:
> > > We had similar dilemma around focal release. And I did SRU one off upgrade
> > > from 1.1.0 to 1.1.1. it was a minor disaster. (As in like the sad
> > > depressing songs in A minor scale).
> > > 
> > > It is best to stick to one openssl version in a release.
> > > 
> > > It is best to stick to longer supported one.
> > > 
> > > It is best not to chase minor ones that nobody will use or want long term.
> > 
> > Note that experimental currently has 3.1 (yes, it's experimental and it
> > doesn't have to go anywhere else).
> > 
> > I need to get in touch with the team on the debian side and ask them
> > their plans regarding versions support.
> 
> I don't actually have a particularly good channel to discuss with them.
> 
> I guess it would also make more sense that the people doing the updates
> in the stable releases do, especially if that involves more than Debian.
> 
> -- 
> Adrien
>