Change:
OpenSSL 1.1.1 (we call it ) will reach end of life on 11 Sep 2023. This means we should either mark it insecure or ideally completely remove it before the 23.11 release. The default was already switched in , so most thing should use now. For applications that support the OpenSSL 3 API, but need old and broken cryptography, there's also , which will be supported, because it's just but with the legacy crypto provider enabled. This is a tracking issue to reference and coordinate this work. cc
[x] xidel [x] xbps [ ] wraith: upstream seems kind of dead [x] tengine: [x] shticker-book-unwritten: [x] eidolon: [x] umurmur: [x] haskellPackages.hopenssl: fixed upstream , waiting for the release to be in nixpkgs [x] apk-tools: [ ] github-desktop: we package a fork (from a ), because the upstream does not support linux? maybe just build from source and use our electron? [x] gmnisrv: [x] hash_extender:
Rust () [x] cargo-bisect-rustc [x] cliscord [x] shticker-book-unwritten [x] devserver: dropped in favor of miniserve [x] dot-http: dropped in favor of hurl [x] coinlive: 0.2.1 -0.2.2 [x] dogdns: dropped, abandoned by upstream [x] tunnelto: 0.1.18 -unstable-2022-09-25 [x] git-subset: dropped in favor of git-filter-repo [x] git-trim: 0.4.2 -0.4.4 [x] imag: dropped, upstream gone [x] firmware-manager: 0.1.2 -unstable-2022-12-09 [x] finalfrontier: 0.9.4 -unstable-2022-01-06 Rust (outdated ) [ ] cargo-dephell [ ] rustup-toolchain-install-master [ ] hydra-cli [ ] movine [ ] break-time [ ] fractal [x] meli [ ] synapse-bt [ ] rucredstash [ ] tensorman [ ] spotify-tui [ ] taizen [ ] git-backup [ ] git-series [ ] cfdyndns [ ] espanso need version update, upstream changed to [ ] chit [x] journaldriver need version update, upstream moved to [ ] habitat need version update [ ] paperoni
Apparently this exists, which might come in handy
[x] [x] python3Packages.bitcoinlib: [x] python3Packages.cryptography [x] python3Packages.etebase: [x] python3Packages.m2crypto:
[x] sslsplit:
Related: , which is blocked by removal of .NET 3.1 ()
Not sure if I'm just doing this wrong, but , as-written in , performs an override on to apply the patch. As such setting for , fails due to infinite recursion. Should we instead have as a package definition output to enable this use case, or am I approaching this in the wrong manner (should I be trying to overlay, define my own, write some kind of option into the Nixpkgs config system)?
This should work with an overlay, I think. Are you sure you want to enable the legacy provider for everything that you're building though?
An overlay should work, yes, but I'd think so should ... else why have the option and not requiring only overlays? I mean, I think so? The only time I've run into this is due to SSL Decryption via MitM certificates, such as those used in corporate firewalls to inspect all encrypted traffic. I'm assuming "Legacy renegotiation" probably covers more use cases than that, but AFAIK, there isn't a more granular way to configure this in OpenSSL for how these MitM proxies are implemented... Do I want to do this? No. Do I need to? Probably...
Heads up! We are planning to mark as EOL before the 23.05 branch-off. This affects the following packages. Feel free to ping this issue for an expedited review/merge process. apeClex ape appflowy arcanist archiveopteryx avalonia-ilspy aws-workspaces azure-static-sites-client break-time cargo-dephell cfdyndns chit cinny-desktop cqrlog dogdns erlang23 wontfix; espanso freeradius git-backup github-desktop gitlab-ee gitlab git-series gvm-libs habitat hadoop3_3. hadoop3, hadoop heroic home-assistant-component- wontfix hydra-cli ioquake3
kore kotatogram-desktop kotatogram-desktop-with-webkit lutris mariadb104 no support upstream, will fix if upstream provides it, otherwise use or newer mastodon meli minigalaxy movine mrustc-bootstrap mumble, murmur mysql80 n98-magerun nzbget odp-dpdk p4 pamp11 paperoni pcsc-safenet percona-xtrabackup8_0 percona-xtrabackup perl534Packages.NetZooKeeper perl536Packages.NetZooKeeper php80 php80Extensions.openssl php80Extensions.openssl-legacy php80Packages.composer php80Packages.deployer php80Packages.grumphp php80Packages.phpstan php81Extensions.openssl-legacy php82Extensions.openssl-legacy pig playonlinux powershell protontricks wontfix wontfix wontfix wontfix python-matter-server wontfix
rng-tools ruby30 rucredstash runescape rustup-toolchain-install-master sgx-psw sgx-sdk sgx-ssl shairport-sync spark34 spark3 spark spotify-tui steamcmd steam steam-run steam-tui sublime4-dev sublime4 swiProlog swiPrologWithGui synapse-bt tarmac tensorman tqsl tremor-rs unityhub viber wkhtmltopdf-bin wraith xivlauncher zammad zkfuse zookeeper_mt
And the following maintainerless packages, mostly about ruby30. <details<summaryPackage list</summary<pre- 3llo bip libmysqlconnectorcpp libp11 mumbleoverlay mysql-workbench pakcs quake3demo rubyPackages30.actioncable rubyPackages30.actionmailbox rubyPackages30.actionmailer rubyPackages30.actionpack rubyPackages30.actiontext rubyPackages30.actionview rubyPackages30.activejob rubyPackages30.activemodel rubyPackages30.activerecord rubyPackages30.activestorage rubyPackages30.activesupport rubyPackages30.addressable rubyPackages30.algoliasearch rubyPackages30.awesomeprint rubyPackages30.backport rubyPackages30.benchmark rubyPackages30.builder rubyPackages30.camping rubyPackages30.certified rubyPackages30.CFPropertyList rubyPackages30.charlockholmes rubyPackages30.cld3 rubyPackages30.cocoapods rubyPackages30.cocoapods-acknowledgements rubyPackages30.cocoapods-art rubyPackages30.cocoapods-browser rubyPackages30.cocoapods-clean rubyPackages30.cocoapods-cleanbuildphasesscripts rubyPackages30.cocoapods-core rubyPackages30.cocoapods-coverage rubyPackages30.cocoapods-deintegrate rubyPackages30.cocoapods-dependencies rubyPackages30.cocoapods-deploy rubyPackages30.cocoapods-disable-podfile-validations rubyPackages30.cocoapods-downloader rubyPackages30.cocoapods-expert-difficulty rubyPackages30.cocoapods-fix-react-native rubyPackages30.cocoapods-generate rubyPackages30.cocoapods-giturlrewriter rubyPackages30.cocoapods-keys rubyPackages30.cocoapods-open rubyPackages30.cocoapods-plugins rubyPackages30.cocoapods-search rubyPackages30.cocoapods-testing rubyPackages30.cocoapods-trunk rubyPackages30.cocoapods-try rubyPackages30.cocoapods-try-release-fix rubyPackages30.cocoapods-update-if-you-dare rubyPackages30.cocoapods-whitelist rubyPackages30.cocoapods-wholemodule rubyPackages30.coderay rubyPackages30.colorator rubyPackages30.colored2 rubyPackages30.commonmarker rubyPackages30.concurrent-ruby rubyPackages30.connectionpool rubyPackages30.daemons rubyPackages30.dataobjects rubyPackages30.dnsruby rubyPackages30.domainname rubyPackages30.dosqlite3 rubyPackages30.e2mmap rubyPackages30.eventmachine rubyPackages30.faraday rubyPackages30.faraday-nethttp rubyPackages30.formatador rubyPackages30.forwardable-extended rubyPackages30.fourflusher rubyPackages30.fuzzymatch rubyPackages30.gdkpixbuf2 rubyPackages30.ghinspector rubyPackages30.gio2 rubyPackages30.glib2 rubyPackages30.globalid rubyPackages30.gobject-introspection rubyPackages30.gtk2 rubyPackages30.highline rubyPackages30.hitimes rubyPackages30.hpricot rubyPackages30.htmlbeautifier rubyPackages30.httpclient rubyPackages30.i18n rubyPackages30.indieweb-endpoints rubyPackages30.jarowinkler rubyPackages30.jbuilder rubyPackages30.jmespath rubyPackages30.jsonpure rubyPackages30.kramdown rubyPackages30.kramdown-parser-gfm rubyPackages30.kramdown-rfc2629 rubyPackages30.markaby rubyPackages30.mercenary rubyPackages30.methodsource rubyPackages30.minimagick rubyPackages30.minimime rubyPackages30.miniportile2 rubyPackages30.minitest rubyPackages30.molinillo rubyPackages30.msgpack rubyPackages30.multijson rubyPackages30.mustermann rubyPackages30.mysql2 rubyPackages30.nanaimo rubyPackages30.ncursesw rubyPackages30.nio4r rubyPackages30.nokogiri rubyPackages30.octokit rubyPackages30.openssl rubyPackages30.optimist rubyPackages30.pandocomatic rubyPackages30.parallel rubyPackages30.pathutil rubyPackages30.pcaprub rubyPackages30.polyglot rubyPackages30.prettier rubyPackages30.prettierprint rubyPackages30.publicsuffix rubyPackages30.railties rubyPackages30.rainbow rubyPackages30.rchardet rubyPackages30.re2 rubyPackages30.redcarpet rubyPackages30.regexpparser rubyPackages30.reversemarkdown rubyPackages30.rmagick rubyPackages30.rpam2 rubyPackages30.rubocop rubyPackages30.rubocop-ast rubyPackages30.rubocop-performance rubyPackages30.ruby2keywords rubyPackages30.rubyzip rubyPackages30.safeyaml rubyPackages30.sequelpg rubyPackages30.simplecov rubyPackages30.simplecov-html rubyPackages30.simplecovjsonformatter rubyPackages30.simpleidn rubyPackages30.sinatra rubyPackages30.slather rubyPackages30.solargraph rubyPackages30.sqlite3 rubyPackages30.stringinflection rubyPackages30.syntaxtree rubyPackages30.syntaxtree-haml rubyPackages30.syntaxtree-rbs rubyPackages30.terminal-table rubyPackages30.timeout rubyPackages30.tinytds rubyPackages30.treetop rubyPackages30.typhoeus rubyPackages30.uglifier rubyPackages30.unicode-displaywidth rubyPackages30.uuid4r rubyPackages30.webmention rubyPackages30.websocket-driver rubyPackages30.websocket-extensions rubyPackages30.xcodeproj rubyPackages30.xctasks rubyPackages30.zeitwerk rubyPackages30.zookeeper rubyPackages31.openssl rubyPackages32.openssl rubyPackages.openssl taizen </pre</details
What should I do if the upstream developer of my package has no spare time to add openssl 3 support to his project? I use the package, so I don't want to mark it as broken/remove yet I have no openssl knowledge to help port it to openssl 3.
That is certainly a tough spot. We're leaving behind packages every once in a while in the EOL treadmill. For now, you can certainly rely on . If you can't fix it and the upstream won't, then we'll have to remove the package at some point down the road. We'll keep available throughout the 23.05 release cycle, but we cannot guarantee security support, and will therefore remove it from nixpkgs/master come September.
I'm reasonably sure that xivlauncher is only affected by this because steam-run depends on openssl11. It would probably be possible to craft a stripped-down version of the steam-run environment specifically for xivlauncher, but if steam-run is going to be updated to remove the openssl11 dependency then I won't bother trying, so: what's the plan for steam-run?
For erlang_23 we will not support openssl 3. I think we will accept that state of affair for 23.05, as we will drop erlang 23 during the summer, after 26 is released.
PR for cfdyndns:
Hadoop does not support openssl 3 yet. Skein, dask-yarn and spark are all downstream of that. A quick scan of the jira suggests that openssl 3 support is not being worked on yet either. I've asked for access to the jira to open an issue. There is a good chance it won't get fixed by September.
As aws-workspaces is a pre-built binary distributed by Amazon and it is built against Ubuntu 20.04, 'focal', we do not have too much control over what libraries it is built against. OpenSSL 3 might work, but I am skeptical since Ubuntu Focal is still shipping version 1.1. I imagine that Amazon will release a newer version compiled against Ubuntu 22.04 LTS ('jammy') in the future, which ships with OpenSSL 3. Until then, there's not much we can do to switch it without possibly breaking things for users. Thanks for the EOL notice, I will keep an eye out for a newer release of WorkSpaces and update it if one ships from Amazon to a version built against 22.04.
Regarding cinny-desktop, I don't think I can do anything on my side. It seems this issue will be met by all Tauri based apps according to
I am rebuilding my machine, still on 22.11, and I get the EOL error for OpenSSL 1.1.1t. How can I check which package is blocking the rebuild?
You could instantiate your system configuration and search for openssl11 in it, e.g. using nix-tree. cd /etc/nixos NIXPKGSALLOWINSECURE=1 nix-instantiate --strict "<nixpkgs/nixos" -A system nix-tree --derivation <drv path
Another alternative, if you have the experimental feature is to do which can catch less hits if OpenSSL is manipulated strangely: Example on my "live" system:
(Note: all these comments assume having run and running each or command with the flag.) What's the equivalent of these commands on a flake-based system? I tried something like ( is the name of my nixos configuration hostname) but this fails with the error message: What's up with that? How do I troubleshoot this? EDIT: by sheer trial and error, I seem to have narrowed the offending openssl derivation path on my system to be . So the following command seems to work: As well as manually forcing the system to build, via something like or, doing the most unsafe thing, i.e., overriding the deprecation by adding to the system configuration, rebuilding (), and then doing (In fact, this is how I located the relevant openssl path in the first place-- by doing nix why-depends /run/current-system ...` command for each folder I found. This seems to work, but it's really quite suboptimal, and I have to imagine that there's a more correct/smart/less annoying way to go about figuring this out than brute trial-and-error.
Working version should be: Separately, this still fails for me because outputs

Discussion:
else ./use-etc-ssl-certs.patch) ]; withDocs = true; <ins> extraMeta = { knownVulnerabilities = [ "OpenSSL 1.1 is reaching its end of life on 2023/09/11 and cannot be supported through the NixOS 23.05 release cycle. https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/" ]; }; </ins> }; openssl_3 = common {