OpenSSL 1.0.2l this week

[rvagg]

 Forthcoming OpenSSL releases
============================

The OpenSSL project team would like to announce the forthcoming release
of OpenSSL versions 1.0.2l and 1.1.0f.

These releases will be made available on 25th May 2017 between
approximately 1200-1600 UTC.

Note: These are bug-fix only releases. No security defects are addressed
in these releases.

Please also note that, as per our previous announcements, support for
1.0.1 ended on 31st December 2016.

"These are bug-fix only releases" i.e. I don't believe we'll be rushing anything here, nor does there appear to be a need for an announcement on this (unless somehow this release makes a bit of noise that is unsettling to some just because it's OpenSSL and that's unsettling in itself). So I imagine we'll just be seeing this slot in as a normal dependency upgrade across our active release lines which are all on 1.0.2.

@nodejs/security @nodejs/security-wg — if there are any alternative ideas on policy or procedure on this one please let us know.

[shigeki]

As long as I see commit logs up to the latest HEAD of 1.0.2, there are several bug fixes in ssl and crypto but no security fixes of even low severity.

The back-ported patch of f439065 was applied to Node in a few weeks ago and it is no longer needed after upgrading.

I think we need not a security assessment of this openssl release and are not in a hurry to release Node.

@nodejs/collaborators I call someone for a volunteer to work on upgrading of the openssl. Its procedure is written in https://github.com/nodejs/node/blob/master/deps/openssl/doc/UPGRADING.md and I will be a reviewer.

[danbev]

I call someone for a volunteer to work on upgrading of the openssl.

I'd be happy to take a look at this.

[shigeki]

@danbev Okay, please check the doc and ask me if you have any questions. After releasing openssl-1.0.2l on 25th May, you can submit a PR and run CI. I will review it.

[rvagg]

It's out now, https://www.openssl.org/news/openssl-1.0.2-notes.html, I haven't looked at the diff but the release notes are underwhelming:

config now recognises 64-bit mingw and chooses mingw64 instead of mingw

[danbev]

It's out now, https://www.openssl.org/news/openssl-1.0.2-notes.html, I haven't looked at the diff but the release notes are underwhelming:

Great, I'm going to take a look at this today.