Hi, On 20.05.2026 17:57, Adolf Belka wrote: > Hi Michael, > > On 20/05/2026 17:32, Michael Tremer wrote: >> Hello Adolf, >> >> Thanks for looking into this. >> >> I wasn’t quite aware how outdated we are on squid, so let’s change that. > > I think Matthias looked at updating squid from the 6.x to 7.x branch but felt > uncomfortable with how to deal with some of the changes in that new branch.
I'm watching - and yes, I'm feeling very uncomfortable with these v7.x changes. ;-)) But I got 'squid 7.xx' running without seen problems - currently v7.5 with Core 201. But I was in fact "very unpleased" with the various changes which came with v7.0.1. A lot of features were removed - Ident protocol support, cache object protocol support, 'cachemgr.cgi' tool, just to name a few. Because of these changes, the ‘proxy.cgi’ file should to be revised in a few places. And this was a job I avoided until now, I just hadn't the nerves. I took a look at the code and wasn't sure which parts should be removed and which parts need to stay. So I didn't touch the CGI, crossed my fingers and started 'squid 7.5'. It works. > Maybe we can both have a try and see what happens. Check if we can we make it > work as expected. I will look back at the previous email chain on the > discussion on moving to squid-7.x Yep. We can try this together. At the moment I'm only unsure which parts of 'proxy.cgi' must be removed and which have to stay. The whole thing is currently running - I use only the basic squid functions without any authentication. With a few changes I even got 'privoxy 4.1.0' running. First thing I could do (e.g.) is trying to get 'squid 7.5' compiling and running without nettle support as you wrote below. Would that help as a first step? Best Matthias >> I checked the code and there are exactly two places where nettle is being >> used: >> >> * The base64 encoder/decoder >> >> https://git.ipfire.org/?p=thirdparty/squid.git;a=blob;f=include/base64.h;hb=5c1d937d2068e4861f206884cebb02d2958d3563#l13 >> >> * Some code to compute MD5 checksums >> >> https://git.ipfire.org/?p=thirdparty/squid.git;a=blob;f=include/md5.h;hb=5c1d937d2068e4861f206884cebb02d2958d3563#l13 > > This was the bit where the build failed as it could not find MD5_DIGEST_SIZE. > It could be that the base64 encoder/decoder might have been next in line. > >> >> Both have an alternative implementation, so it is absolutely safe for us to >> build squid with --without-nettle. That way we won’t be held back until they >> have agreed on a unified API. >> > Let me know if this helps. > > I will try it and see. Everything before the squid build had no problems with > nettle-4.0, I just need to see if there is anything still to come in the > build tree. I will look at it when/if it comes. > > Regards, > > Adolf. > >> >> All the best, >> -Michael >> >>> On 20 May 2026, at 13:47, Adolf Belka <[email protected]> wrote: >>> >>> Hi all, >>> >>> For information. >>> >>> A new nettle version has come out. Our old version was 3.10.2 and the new >>> one is 4.0 >>> >>> Unfortunately nettle-4.0 has a new API/ABI and several packages that use >>> nettle have found that it won't build for them. >>> >>> Many of those packages have already issued updated versions that now work >>> with nettle-4.0 >>> >>> That is not the case with squid. Here we have a greater problem. >>> >>> Currently we are on squid-6.14 and the current release is squid-7.5. >>> squid-6.14 fails to build with nettle-4.0 as there are changes in various >>> variables/parameters. >>> >>> squid-7.5 does not yet have any fix for the nettle API/ABI changes. I did >>> find some discussion on it in the Pull Requests section but there seems to >>> be some disagreement between various of the squid contributors which seems >>> to be blocking anything being accepted. It is also not clear if that pull >>> request would fix the error that I found in my build with squid-6.14 >>> >>> squid has not been updated to the 7.x branch in IPFire because there were a >>> lot of significant changes in it which would require some re-write of our >>> web proxy code. >>> >>> It is probably worth noting that squid-6.14 stopped getting any security >>> support in July 2025. >>> >>> There also seems to be questions about squid-8.x and if it will have even >>> more major changes to options. >>> >>> squid typically is having a two year cycle on their major branch changes >>> and so the expectation is that squid-7.x will go EOL somewhere around July >>> 2027 with squid-8.x having beta status in Feb 2027 and stable declaration >>> in July 2027 when 7.x is EOL'd >>> >>> I will try and see if any other packages we run have any linkage to nettle. >>> >>> Regards, >>> >>> Adolf. >>> >> > >
