[Backport support/2.16] Support OpenSSL 4.0, add Fedora 45 to GHA#10934
Conversation
to fix a build error against OpenSSL 4.0. OpenSSL 4.0 made `X509_NAME*` pointers returned by `X509_get_subject_name()`, `X509_REQ_get_subject_name()` and related getters const. In contrast, under OpenSSL 1.x, setters expect non-const pointers, hence our new typedef `X509NameConstPtr`. - Use `X509NameConstPtr` parameters in `GetX509NameCN()`, `CreateCert()` and, `CreateCertIcingaCA()` to match the const expectations per OpenSSL version - Replace `X509_REQ_get_subject_name()` with `X509_NAME_new()` + `X509_REQ_set_subject_name()` for CSR subject modification, since the returned data can't be directly modified now (cherry picked from commit c02434e)
to fix a build error against OpenSSL 4.0. OpenSSL 4.0 made `ASN1_INTEGER` an opaque type. Also, `X509_get0_serialNumber()` must be used now, which returns `const ASN1_INTEGER*`. (cherry picked from commit ee648b3)
The release of Fedora 45 will take months, but a distro shipping OpenSSL 4 is necessary to ensure persistent OpenSSL 4 compatibility. (cherry picked from commit c2da81d)
|
Don't merge this yet. This implicitly removes support for OpenSSL 1.0.2 and thus implies that there won't be any potential 2.16.x security fixes for distributions like Amazon Linux 2. I want that we are all aware of that before merging. |
|
julianbrost
left a comment
julianbrost
left a comment
There was a problem hiding this comment.
The purpose of me marking this PR as draft was so that this doesn't get merged yet. Now you've got a request changes comment as a temporary placeholder stating that I want to consider things first that I would have liked to already consider as part of the review of #10868.
julianbrost
left a comment
julianbrost
left a comment
There was a problem hiding this comment.
I talked to a few people today to make sure we are all on the same page that this change breaks OpenSSL 1.0.2 compatibility and thus specifically means that Amazon Linux 2 will not receive any further Icinga 2 releases, even if they were security fixes. So let's hope it's gone for good!
2 participants
Backport of #10868 to
support/2.16, triggered by a label.This is an automated backport PR. Please review it carefully before merging.