pgsql: Remove support for OpenSSL older than 1.1.0
Hackorum builds and tests every patch posted to the lists, not only commitfest submissions. This is Hackorum's own CI rather than the PostgreSQL project's, and it is still under testing - please report anything that looks wrong.
You can run a PostgreSQL built from this patch straight from Docker, with no checkout and no build:
docker run --rm -p 5432:5432 ghcr.io/hackorum-dev/postgres-patch:t238692psql -h localhost -U postgresBuilt from patchset v3 (message #3), September 20, 2026 at 07:50 AM.
Every patchset is also pushed to a branch of our PostgreSQL fork, so you can check out the same tree CI built. Without a PostgreSQL checkout:
git clone --branch t238692_3 https://github.com/hackorum-dev/postgres.gitIn a checkout you already have, add the fork once:
git remote add hackorum https://github.com/hackorum-dev/postgres.gitthen, for this patchset and every later one:
git fetch hackorum t238692_3 && git checkout t238692_3Patchset v3 (message #3) is on t238692_3
Remove support for OpenSSL older than 1.1.0
OpenSSL 1.0.2 has been EOL from the upstream OpenSSL project for
some time, and is no longer the default OpenSSL version with any
vendor which package PostgreSQL. By retiring support for OpenSSL
1.0.2 we can remove a lot of no longer required complexity for
managing state within libcrypto which is now handled by OpenSSL.
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: /messages/by-id/ZG3JNursG69dz1lr@paquier.xyz
Discussion: /messages/by-id/CA+hUKGKh7QrYzu=8yWEUJvXtMVm_CNWH1L_TLWCbZMwbi1XP2Q@mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/a70e01d4306fdbcd5fbedb4ca97e5c21c995da60
Modified Files
--------------
configure | 31 ++--
configure.ac | 12 +-
contrib/pgcrypto/openssl.c | 8 -
doc/src/sgml/installation.sgml | 2 +-
doc/src/sgml/libpq.sgml | 36 ++---
meson.build | 23 +--
src/backend/libpq/be-secure-openssl.c | 24 +--
src/common/Makefile | 3 +-
src/common/hmac_openssl.c | 20 +--
src/common/meson.build | 1 -
src/common/protocol_openssl.c | 117 ---------------
src/include/common/openssl.h | 14 +-
src/include/pg_config.h.in | 15 --
src/interfaces/libpq/fe-connect.c | 18 ---
src/interfaces/libpq/fe-secure-openssl.c | 246 -------------------------------
src/interfaces/libpq/fe-secure.c | 35 ++---
src/interfaces/libpq/libpq-int.h | 23 ---
src/test/ssl/t/001_ssltests.pl | 3 +-
18 files changed, 55 insertions(+), 576 deletions(-)
Hi Daniel,
On Mon, 2 Sept 2024 at 21:54, Daniel Gustafsson <dgustafsson@postgresql.org>
wrote:
Remove support for OpenSSL older than 1.1.0
I am trying to update my buildfarm animals for this, and although I fixed
massasauga (essentially by skipping the test for now), I am unclear why
snakefly still fails (now, much later into the cycle).
Could you point me on how to fix snakefly?
(I've tried to disable SSL tests, but that doesn't seem to be helping).
https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=snakefly&dt=2024-09-03%2009%3A56%3A46
-
Thanks
Robins
On 3 Sep 2024, at 12:36, Robins Tharakan <tharakan@gmail.com> wrote:
I am trying to update my buildfarm animals for this, and although I fixed massasauga (essentially by skipping the test for now), I am unclear why snakefly still fails (now, much later into the cycle).
Could you point me on how to fix snakefly?
(I've tried to disable SSL tests, but that doesn't seem to be helping).https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=snakefly&dt=2024-09-03%2009%3A56%3A46
The BF run entry claims it's failing in the ssl_passphrase_callbackCheck stage
which is odd, since without SSL it shouldn't recurse into that test module at
all.
Looking at massasauga it did recurse into there but then subsequently skipped
the test due to OpenSSL being missing. However, it would first need to compile
the test module in order to reach the SKIP statement in the TAP test, and I
believe that's where snakefly is failing. If I recompile postgres without SSL
and ensure that it cannot see any OpenSSL headers via standard includes I can
reproduce the error, the excerpt from install.log being the expected
compilation failure:
ssl_passphrase_func.c:29:23: error: unknown type name 'SSL_CTX'
static void set_rot13(SSL_CTX *context, bool isServerStart);
^
ssl_passphrase_func.c:52:3: error: use of undeclared identifier 'openssl_tls_init_hook'
openssl_tls_init_hook = set_rot13;
^
ssl_passphrase_func.c:56:11: error: unknown type name 'SSL_CTX'
set_rot13(SSL_CTX *context, bool isServerStart)
^
ssl_passphrase_func.c:63:2: error: call to undeclared function 'SSL_CTX_set_default_passwd_cb'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
SSL_CTX_set_default_passwd_cb(context, rot13_passphrase);
^
4 errors generated.
Does massasauga have OpenSSL headers such that the compiler can find them via
standard includes, and snakefly doesn't?
The buildfarm client should honor the rules in the src/test/modules Makefile
which skips the subdirectory when OpenSSL isn't present, but since the TAP test
have a SKIP clause I guess we should support it. The attached diff fixes it
for me, are you able to test that on snakefly?
--
Daniel Gustafsson