Heads up: OpenSSL3 transition

[Robie Basak]

On Fri, Nov 19, 2021 at 12:54:22PM -0500, Sergio Durigan Junior wrote:
> I'd like to raise something.  I apologize for sending this message in
> such short notice.
> 
> I am working on net-snmp, squid and a few other packages during this
> transition, and I am feeling concerned with how uncomfortable some of
> our upstreams seem to be regarding their patches to support OpenSSL 3.
> I can mention a few cases here.
> 
> net-snmp has a patch to support OpenSSL 3 in theory, but they are still
> discussing a few details here:
> https://github.com/net-snmp/net-snmp/issues/294 .  It seems like they
> have sorted out most of the issues so far, which is good, but I'm still
> not 100% confident in backporting their patch yet.

Just to add to this, when we do have patches ready, what should be our
process to get any security-sensitive backport patches reviewed - in the
cases that we're introducing them ahead of an upstream release - to
avoid inadvertent security regressions?

Robie
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-release/attachments/20211122/b509e868/attachment.sig>