On Fri, 2 Mar 2018 10:04:44 +0100 Emilio Pozuelo Monfort <po...@debian.org> wrote: > On 01/03/18 22:31, Alessandro Ghedini wrote: > > Package: release.debian.org > > Severity: normal > > User: release.debian....@packages.debian.org > > Usertags: transition > > > > Hello, > > > > I'd like to request a transition for curl in order to unblock the migration > > to OpenSSL 1.1 (#871056). > > Good! > > > This is necessary due to the fact that the curl ABI > > exposes a structure inherited from libssl itself, which was changed in the 1.1 > > update (see #844018 for more information). > > > > It is for the most part a clean ABI bump, however a few packages that build > > depend on both libcurl and libssl will need source uploads so they can also > > migrate to OpenSSL 1.1. The following packages were identified as part of the > > discussion in #858398: > > > > * hhvm: #858927 (sid-only) > > * lastpass-cli: #858991 > > * libapache2-mod-auth-cas: 858992 > > * netsurf: #859230 > > * xmltooling: #859831 > > * zurl: #859841 > > xmltooling / Shibboleth / xml-security-c don't seem ready yet. Apparently there > are patches upstream but there have been no new releases and they are not easy > to backport. I suppose at some point we'll need to stop blocking on them. They > can be fixed later and re-enter testing when that happens, there's still plenty > of time before the freeze.
Indeed xmltooling requires both openssl based curl, and openssl-1.0. In Ubuntu, we did not manage to resolve it, hence I have uploaded "curl3"[0] package into ubuntu that provides libcurl-openssl1.0-dev, which builds curl against openssl1.0 and provides a library that xmltooling can link against. This was done out of time constraints due to imminent Ubuntu release. Ideally xmltooling should be ported to openssl-1.1 as a long term maintainable solution. Regards, Dimitri. [0] https://launchpad.net/ubuntu/+source/curl3/7.58.0-2ubuntu2
