<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">For what it’s worth, OpenSSL is also being relicensed to Apache 2.0, so backporting their fixes may not be an option either. <div><a href="https://license.openssl.org/">https://license.openssl.org/</a></div><div><br></div><div>Please be careful with your language: I’m sure you know that recipe maintenance is a tedious, thankless task. Having it belittled doesn’t help.<br><br><div id="AppleMailSignature" dir="ltr">Alex</div><div dir="ltr"><br>On 19 Mar 2019, at 14.55, Martin Jansa <<a href="mailto:martin.jansa@gmail.com">martin.jansa@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><span>On Tue, Mar 19, 2019 at 12:35:59PM +0100, Alexander Kanavin wrote:</span><br><blockquote type="cite"><span>Just to remind once more, all upstream support for OpenSSL 1.0.2 ceases in 9 months, so shipping products with it may not be the best idea.</span><br></blockquote><span></span><br><span>Just to remind once more, shipping products isn't as easy as building</span><br><span>the few recipes included in oe-core.</span><br><span></span><br><span>For example:</span><br><span>Believe it or not, some projects need to use old Qt 5.6 due to license</span><br><span>change in newer version and 5.6 doesn't support openssl 1.1,</span><br><span>backporting the necessary changes would violate the license as well.</span><br><span>Providing clean room re-implementation is also difficult, because there</span><br><span>aren't many other options how to implement this than how it was done in</span><br><span>newer qt already, see:</span><br><span></span><br><span><a href="https://bugreports.qt.io/browse/QTBUG-71623">https://bugreports.qt.io/browse/QTBUG-71623</a></span><br><span><a href="https://development.qt-project.narkive.com/RW4wxYXY/openssl-1-1-x-support-on-qt-5-6-5-9">https://development.qt-project.narkive.com/RW4wxYXY/openssl-1-1-x-support-on-qt-5-6-5-9</a></span><br><span></span><br><span>Yes, it's not the best idea, but even backporting security fixes to old</span><br><span>openssl might be cheaper than buying commercial qt license...</span><br><span></span><br><span>Cheeers,</span><br></div></blockquote></div></body></html>