openssh bugs - Jul 2023 - [Bug 3595] New: Configure.ac Check Header Versions

https://bugzilla.mindrot.org/show_bug.cgi?id=3595

            Bug ID: 3595
           Summary: Configure.ac Check Header Versions
           Product: Portable OpenSSH
           Version: 9.3p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: Build system
          Assignee: unassigned-bugs at mindrot.org
          Reporter: soup_79 at hotmail.com

When compiling against openssl 3, the configure.ac header check fails
when the library version does not match even though OpenSSL >=3
maintains compatibility between major and minor releases.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3595

--- Comment #1 from soup_79 at hotmail.com ---
The versions in question are 
Version: openssh-9.3_p2
Openssl: OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.1.1 30 May 2023)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3595

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
Notwithstanding the API compatibility promises in
https://www.openssl.org/policies/releasestrat.html, compiling mixed
header/library versions seems like volunteering for unnecessary
problems, and if you want to do that there's always
--without-openssl-header-check.

Which vendor(s) are shipping library updates without updating the
corresponding headers?   Apple?

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3595

--- Comment #3 from soup_79 at hotmail.com ---
It is a gentoo based system.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3595

--- Comment #4 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to soup_79 from comment #3)
> It is a gentoo based system.
then why are you installing mixed library and header versions?

I don't think we would be interested in relaxing the default checks as
it adds yet another variable we may end up having to debug.  If you
want to force it you have the option to do so with
--without-openssl-header-check.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3595

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WORKSFORME
             Status|NEW                         |RESOLVED

--- Comment #5 from Darren Tucker <dtucker at dtucker.net> ---
There doesn't seem to be any compelling reason to allow this by
default, so we are not interested in relaxing the compile-time checks
further.  You should compile with the matching headers and libraries,
but if not you already have the --without-openssl-header-check option
and get to own any breakage that it causes.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.