OpenSSL STATUS Last modified at
- ______________ $Date: 1999/01/02 16:28:51 $
+ ______________ $Date: 2000/11/19 14:11:03 $
DEVELOPMENT STATE
- o OpenSSL 0.9.2: Under development.
- o OpenSSL 0.9.1c: Released on December 23th, 1998
+ o OpenSSL 0.9.7: Under development...
+ o OpenSSL 0.9.6: Released on September 24th, 2000
+ o OpenSSL 0.9.5a: Released on April 1st, 2000
+ o OpenSSL 0.9.5: Released on February 28th, 2000
+ o OpenSSL 0.9.4: Released on August 09th, 1999
+ o OpenSSL 0.9.3a: Released on May 29th, 1999
+ o OpenSSL 0.9.3: Released on May 25th, 1999
+ o OpenSSL 0.9.2b: Released on March 22th, 1999
+ o OpenSSL 0.9.1c: Released on December 23th, 1998
RELEASE SHOWSTOPPERS
AVAILABLE PATCHES
+ o CA.pl patch (Damien Miller)
+
IN PROGRESS
- o Ben is folding in his patches
+ o Steve is currently working on (in no particular order):
+ ASN1 code redesign, butchery, replacement.
+ EVP cipher enhancement.
+ /* Proper (or at least usable) certificate chain verification. */
+ Private key, certificate and CRL API and implementation.
+ Developing and bugfixing PKCS#7 (S/MIME code).
+ Various X509 issues: character sets, certificate request extensions.
+ o Geoff and Richard are currently working on:
+ ENGINE (the new code that gives hardware support among others).
+ o Richard is currently working on:
+ UTIL (a new set of library functions to support some higher level
+ functionality that is currently missing).
+ Shared library support for VMS.
+ OCSP
+ Kerberos 5 authentication
+ Constification
NEEDS PATCH
+ o non-blocking socket on AIX
+ o $(PERL) in */Makefile.ssl
+ o "Sign the certificate?" - "n" creates empty certificate file
+
OPEN ISSUES
o The Makefile hierarchy and build mechanism is still not a round thing:
itself. Then we can avoid a lot of those platform checks
which are currently in Configure.
- 2. The massive symlinking of Makefile.ssl -> Makefile:
- First the `make -f Makefile.ssl links' command is nasty, second the
- whole process is slow and third it seems to be done without real
- need. And forth, the dependecies are currently missing. And fifth,
- it's complicated to always go to the top-level in order to get the
- local variables overriden.
- Suggestion: Rename Makefile.ssl to Makefile.in, add
- dependencies to Makefile.in and change the build process
- to _generate_ Makefile out of Makefile.in by
- substituting variables like CC, etc. This solves the
- above problems.
-
- 3. The xxx.org -> xxx.h generation:
- It's not obvious for which file xxx.org is the source.
- Suggestion: Rename xxx.org to xxx.h.in (Autoconf style), this way
- one sees that xxx.h.in is the input for xxx.h
-
- o The installation under "make install" produces a very
- installation layout: $prefix/certs and $prefix/private dirs. That's
- not nice. Ralf suggests to move the two certs and private dirs either
- to $prefix/etc/, $prefix/lib/ or $prefix/share. Alternatively
- we could also not install the certs at all.
-
- Status: Ralf +1 for both not installing the certs at all and
- moving it to $prefix/etc/. +0 for $prefix/lib/
- and $prefix/share.
- Paul: why is it not nice?
- Ralf: because it messes up the install dir when
- $prefix is not a dedicated area like /usr/local/ssl.
- When we move them to a standard subdir like
- etc/ lib/ or share/ we don't mess up things
- when $prefix is /usr or /usr/local, etc.
- Additionally it makes package vendors life
- easier....
-
o Support for Shared Libraries has to be added at least
for the major Unix platforms. The details we can rip from the stuff
Ralf has done for the Apache src/Configure script. Ben wants the
compiler PIC and linker DSO flags from Apache
into the OpenSSL Configure script.
+ Ulf: +1 for using GNU autoconf and libtool (but not automake,
+ which apparently is not flexible enough to generate
+ libcrypto)
+
+
o The perl/ stuff needs a major overhaul. Currently it's
totally obsolete. Either we clean it up and enhance it to be up-to-date
with the C code or we also could replace it with the really nice
to date.
Paul +1
- o Ralf has ported Stephen's pkcs12 program to OpenSSL (the
- ASN.1 stuff Eric recently changed :-( ), but needs some help from
- Stephen at two source locations. Stephen itself also has ported his
- internal pkcs12 0.53 version to OpenSSL, but thinks we still shouldn't
- incorporate it into OpenSSL because it needs more cleanups. Ralf still
- thinks pkcs12 should be incorporated better now than later because it's
- nasty to not have it in the core - one always has to install it
- manually and a lot of people use it. So, should we incorporate it?
- BTW, we have to be carefully because of the pkcs12 license: There are
- some things which don't match the OpenSSL license, so Stephen has to
- change it for us when we want to incorporate the code.
-
- Status: Ralf +1, Stephen -0
+ WISHES
+
+ o
projects / openssl.git / blobdiff