update FAQ

[openssl.git] / FAQ

diff --git a/FAQ b/FAQ
index 620eb03c3fa41b479be01451912439be082725f2..e13332d049d00ab89afbc50ee866d51c23e3fbc8 100644 (file)
--- a/FAQ
+++ b/FAQ
@@ -10,6 +10,7 @@ OpenSSL  -  Frequently Asked Questions
 * Why aren't tools like 'autoconf' and 'libtool' used?
 * What is an 'engine' version?
 * How do I check the authenticity of the OpenSSL distribution?
 * Why aren't tools like 'autoconf' and 'libtool' used?
 * What is an 'engine' version?
 * How do I check the authenticity of the OpenSSL distribution?

+* How does the versioning scheme work?

 
 [LEGAL] Legal questions
 
 
 [LEGAL] Legal questions
 


@@ -82,7 +83,7 @@ OpenSSL  -  Frequently Asked Questions
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.

-OpenSSL 1.0.0 was released on Mar 29th, 2010.
+OpenSSL 1.0.1a was released on Apr 19th, 2012.

 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:


@@ -173,6 +174,19 @@ just do:
 
    pgp TARBALL.asc
 
 
    pgp TARBALL.asc
 

+* How does the versioning scheme work?
+
+After the release of OpenSSL 1.0.0 the versioning scheme changed. Letter 
+releases (e.g. 1.0.1a) can only contain bug and security fixes and no
+new features. Minor releases change the last number (e.g. 1.0.2) and 
+can contain new features that retain binary compatibility. Changes to
+the middle number are considered major releases and neither source nor
+binary compatibility is guaranteed.
+
+Therefore the answer to the common question "when will feature X be
+backported to OpenSSL 1.0.0/0.9.8?" is "never" but it could appear
+in the next minor release.
+

 [LEGAL] =======================================================================
 
 * Do I need patent licenses to use OpenSSL?
 [LEGAL] =======================================================================
 
 * Do I need patent licenses to use OpenSSL?


@@ -724,7 +738,7 @@ list.
 * I'm SURE I've found a bug, how do I report it?
 
 Bug reports with no security implications should be sent to the request
 * I'm SURE I've found a bug, how do I report it?
 
 Bug reports with no security implications should be sent to the request

-tracker. This can be done my mailing the report to <rt@openssl.org> (or its
+tracker. This can be done by mailing the report to <rt@openssl.org> (or its

 alias <openssl-bugs@openssl.org>), please note that messages sent to the
 request tracker also appear in the public openssl-dev mailing list.
 
 alias <openssl-bugs@openssl.org>), please note that messages sent to the
 request tracker also appear in the public openssl-dev mailing list.
 


@@ -752,27 +766,6 @@ openssl-security@openssl.org if you don't get a prompt reply at least
 acknowledging receipt then resend or mail it directly to one of the
 more active team members (e.g. Steve).
 
 acknowledging receipt then resend or mail it directly to one of the
 more active team members (e.g. Steve).
 

-
-[PROG] ========================================================================
-
-* Is OpenSSL thread-safe?
-* I've compiled a program under Windows and it crashes: why?
-* How do I read or write a DER encoded buffer using the ASN1 functions?
-* OpenSSL uses DER but I need BER format: does OpenSSL support BER?
-* I've tried using <M_some_evil_pkcs12_macro> and I get errors why?
-* I've called <some function> and it fails, why?
-* I just get a load of numbers for the error output, what do they mean?
-* Why do I get errors about unknown algorithms?
-* Why can't the OpenSSH configure script detect OpenSSL?
-* Can I use OpenSSL's SSL library with non-blocking I/O?
-* Why doesn't my server application receive a client certificate?
-* Why does compilation fail due to an undefined symbol NID_uniqueIdentifier?
-* I think I've detected a memory leak, is this a bug?
-* Why does Valgrind complain about the use of uninitialized data?
-* Why doesn't a memory BIO work when a file does?
-* Where are the declarations and implementations of d2i_X509() etc?
-
-

 [PROG] ========================================================================
 
 * Is OpenSSL thread-safe?
 [PROG] ========================================================================
 
 * Is OpenSSL thread-safe?


@@ -786,7 +779,7 @@ file.
 Multi-threaded applications must provide two callback functions to
 OpenSSL by calling CRYPTO_set_locking_callback() and
 CRYPTO_set_id_callback(), for all versions of OpenSSL up to and
 Multi-threaded applications must provide two callback functions to
 OpenSSL by calling CRYPTO_set_locking_callback() and
 CRYPTO_set_id_callback(), for all versions of OpenSSL up to and

-including 0.9.8[abc...]. As of version 0.9.9, CRYPTO_set_id_callback()
+including 0.9.8[abc...]. As of version 1.0.0, CRYPTO_set_id_callback()

 and associated APIs are deprecated by CRYPTO_THREADID_set_callback()
 and friends. This is described in the threads(3) manpage.
 
 and associated APIs are deprecated by CRYPTO_THREADID_set_callback()
 and friends. This is described in the threads(3) manpage.