We’re no longer using our old ftp, rsync, and git links for distributing OpenSSL. These were great in their day, but it’s time to move on to something better and safer. ftp://ftp.openssl.org and rsync://rsync.openssl.org are not available anymore. As of June 1, 2024, we’re also going to shut down https://ftp.openssl.org and git://git.openssl.org/openssl.git mirrors.
GitHub is becoming the main distributor of the OpenSSL releases.
You must log in or register to comment.
Good idea, giving Microsoft control over every single open source project. I mean, what could go wrong, right?
Yes, what would possibly go wrong ? And OpenSSL is only a small and unimportant project and hardly anyone depends on it, right ? Right ? I can dig that they want to get rid of some of their own services but completely giving up on their own git repository ? Let’s hope they do mirror the source code on Codeberg or sourcehut.
That’s a pretty bad idea. I highly recommend this awesome write-up by Software Freedom Conservancy: Give Up GitHub!
Considering the absolutely devastating performance hits 3.x brings (and the apparent design failures that make it extremely difficult if not impossible to reclaim it) I wonder if openssl’s days are numbered. WolfSSL seems to be favorable to the HAProxy team. Hopefully that can get some traction.
Good that you mention WolfSSL and that HAProxy team seems to like it. Years ago some Linux distributions made the switch to LibreSSL, but unfortunately that all (?) seems to have failed.
I think a lot of people here read the headine and think OpenSSL is moving everything to github and giving up everything else. It is not. They only moved the means of distributing the release tarball to github and stopped supporting the ftp and rsync. Do not confuse distribution and contribution/development.
These were great in their day, but it’s time to move on to something better and safer.
How is it “safer” when contributing to the codebase or filing and discussing issues will now require creating an account and giving up personal information to one of the most privacy-invasive tech companies in the world? 😳
You are mistaking contributing and distributing.
Edit to clarify: The blog is strictly speaking about the means of distributing the release tarball. Distributing the release tarball has nothing to do with how contribution is accepted or how issue is handled. What they say on the blog is also very clear IMHO and for a good reason. Maintaining infrastructure takes work. Works that if you didn’t do it right can be an attack vector. Do you guys remember xz? Do you read how the vulnerabilities came to be? Maintaining a single source of truth for the release tarball can help mitigate that. If one malicious actor can control even one of the distribution channels of the release tarball we get xz 2 electric boogaloo.
