Skip to content

gh-158010: Avoid recommending out-of-date OpenSSL in configure doc #158266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zware wants to merge 1 commit into
base: main
Choose a base branch
from
+9 −2
Open

gh-158010: Avoid recommending out-of-date OpenSSL in configure doc #158266

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions Doc/using/configure.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,8 +95,7 @@ Dependencies to build optional modules are:
-
- :mod:`curses`
* - `OpenSSL <https://openssl-library.org/>`_
- | 3.0.18 recommended
| (1.1.1 minimum)
- [8]_

@StanFromIreland StanFromIreland Sep 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- [8]_
- 1.1.1 [8]_

I think keeping the bare minimum here would be reasonable?

- :mod:`ssl`, :mod:`hashlib` [6]_
* - `SQLite <https://sqlite.org/>`_
- 3.15.2
Expand Down Expand Up @@ -131,6 +130,14 @@ Dependencies to build optional modules are:
See :option:`--with-builtin-hashlib-hashes` for *forcing* usage of OpenSSL.
.. [7] See :option:`--with-zlib` for choosing the backend for the
:mod:`zlib` module.
.. [8] OpenSSL 1.1.1 is the minimum possible version to build against,
but the latest public release of the series has known vulnerabilities.
For best compatibility and security it is recommended to always use

@hugovk hugovk Sep 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
For best compatibility and security it is recommended to always use
For best compatibility and security it is recommended to use

the latest patch release of a current LTS release series (see the
`OpenSSL Roadmap <https://openssl-library.org/roadmap/index.html>`_),

@hugovk hugovk Sep 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prefer anon links:

Suggested change
`OpenSSL Roadmap <https://openssl-library.org/roadmap/index.html>`_),
`OpenSSL Roadmap <https://openssl-library.org/roadmap/index.html>`__),

or the package provided by your operating system if available. Other
libraries that offer an API compatible with OpenSSL 1.1.1 or later may
also be usable, but are not officially supported.
Comment on lines +133 to +140

@StanFromIreland StanFromIreland Sep 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
.. [8] OpenSSL 1.1.1 is the minimum possible version to build against,
but the latest public release of the series has known vulnerabilities.
For best compatibility and security it is recommended to always use
the latest patch release of a current LTS release series (see the
`OpenSSL Roadmap <https://openssl-library.org/roadmap/index.html>`_),
or the package provided by your operating system if available. Other
libraries that offer an API compatible with OpenSSL 1.1.1 or later may
also be usable, but are not officially supported.
.. [8] OpenSSL 1.1.1 is the minimum possible version to build against,
but that series is end-of-life and no longer receives
security fixes. Use the latest patch release of a currently supported
LTS series (see the `OpenSSL Roadmap
<https://openssl-library.org/roadmap/index.html>`_), or the package
provided by your operating system. Other libraries with an API
compatible with OpenSSL 1.1.1 or later may work, but are not
officially supported.

Some little wording suggestions, feel free to reject as you see fit.


Note that the table does not include all optional modules; in particular,
platform-specific modules like :mod:`winreg` are not listed here.
Expand Down
Loading