Am 22.10.26 um 17:00 schrieb Mark Thomas:
The key differences in version 2.0.17 compared to 2.0.16 are:
- Windows binaries built with OpenSSL 3.5.9
- Add TLS PSK support
- Align OCSP checks with JSSE so that a certificate that is itself a
trust anchor (whether a self-signed root or a certificate trusted
directly via the configured trust store) is not subject to OCSP
checking
The 2.0.x branch is primarily intended for use with Tomcat 10.1.x
onwards but can be used with earlier versions as long as the APR/native
connector is not used.
The proposed release artifacts can be found at [1],
and the build was done using tag [2].
The Apache Tomcat Native 2.0.17 release is
[ ] Stable, go ahead and release
[ ] Broken because of ...
+1 for release
- checked artefacts for completeness
- checked artefact gpg signatures and sha512 hashes
- compared source tarballs against git sources
- checked OpenSSL version in Windows binaries
- checked some consistencies against own jnirelease.sh results
- built it against OpenSSL 4.1.0, 4.0.3, 3.6.5 and 3.5.9, each on the
Platforms SLES 12 and 15 and RHEL 7, 8, 9 and 10 (all x86_64). APR was
1.7.6.
- only build warnings with OpenSSL 4 (twice constness, once
depracation); see below A)
- tested via TC unit tests with tcnative/OpenSSL but only the SSL/TLS
related tests on the above platforms using TC 11.0.27, 10.1.61 and
9.0.123 with September patch levels of JDK 8, 11, 17, 21, 25, 27 and 28
EA from Adoptium Temurin, Amazon Corretto, Azul Zulu, Oracle, RedHat
and OpenJDK (where available and applicable). Tests TC 9 with JDK 25-28
not yet done.
- No noteworthy test failures, only the usual sporadic failure noise.
Thanks for RM!
Best Regards,
Rainer
A) Compilation warnings
:::::::::::::::::::::::
Only in combination with OpenSSL 4, the first one only with 4.1:
src/sslutils.c: In function 'decode_OCSP_url':
src/sslutils.c:693:5: warning: 'ASN1_STRING_length' is deprecated
(declared at /path/to/openssl410/include/openssl/asn1.h:794): Since
OpenSSL 4.1; use ASN1_STRING_get_length() [-Wdeprecated-declarations]
len = ASN1_STRING_length(os);
^
src/sslutils.c: In function 'ssl_ocsp_request':
src/sslutils.c:1109:13: warning: assignment discards 'const' qualifier
from pointer target type [enabled by default]
ext = X509_get_ext(cert,nid);
^
src/sslutils.c:1110:12: warning: assignment discards 'const' qualifier
from pointer target type [enabled by default]
os = X509_EXTENSION_get_data(ext);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
