[edk2-devel] Reg: OpenSSL_3.5.0 & MbedTls_3.6.3 upgrade

[edk2-devel] Reg: OpenSSL_3.5.0 & MbedTls_3.6.3 upgrade

[Prarthana Sagar V via groups.io]

[-- Attachment #1: Type: text/plain, Size: 1133 bytes --]

Hello,

We would like to know EDK2's plan on updating Openssl version to 3.5.0 (As Openssl_3.4.x series will have its EOL by OCT,2026 ) and  MbedTls version to 3.6.3 (As it includes some CVE vulnerability fixes).

Thanks
Prarthana

-The information contained in this message may be confidential and proprietary to American Megatrends (AMI). This communication is intended to be read only by the individual or entity to whom it is addressed or by their designee. If the reader of this message is not the intended recipient, you are on notice that any distribution of this message, in any form, is strictly prohibited. Please promptly notify the sender by reply e-mail or by telephone at 770-246-8600, and then delete or destroy all copies of the transmission.


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#121332): https://edk2.groups.io/g/devel/message/121332
Mute This Topic: https://groups.io/mt/113066244/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-



[-- Attachment #2: Type: text/html, Size: 3074 bytes --]

Re: [edk2-devel] Reg: OpenSSL_3.5.0 & MbedTls_3.6.3 upgrade

[Gerd Hoffmann via groups.io]

On Sun, May 11, 2025 at 11:36:39PM -0700, Prarthana Sagar V via groups.io wrote:
> Hello,
> 
> We would like to know EDK2's plan on updating Openssl version to 3.5.0 (As Openssl_3.4.x series will have its EOL by OCT,2026 )

For openssl-3.5.x I have a draft PR:
https://github.com/tianocore/edk2/pull/10946

edk2 does not build with 3.5.0, I got fixes merged in openssl, now
waiting for the 3.5.1 release (with the fixes included) for the actual
upgrade.

3.5 is a LTS release, openssl plans to do a LTS release every two years
going forward (see https://openssl-library.org/roadmap/index.html), so I
expect from now on we'll go jump from one LTS release to the next.

take care,
  Gerd



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#121334): https://edk2.groups.io/g/devel/message/121334
Mute This Topic: https://groups.io/mt/113066244/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel] Reg: OpenSSL_3.5.0 & MbedTls_3.6.3 upgrade

[Ard Biesheuvel via groups.io]

On Mon, 12 May 2025 at 10:45, Gerd Hoffmann via groups.io
<kraxel=redhat.com@groups.io> wrote:
>
> On Sun, May 11, 2025 at 11:36:39PM -0700, Prarthana Sagar V via groups.io wrote:
> > Hello,
> >
> > We would like to know EDK2's plan on updating Openssl version to 3.5.0 (As Openssl_3.4.x series will have its EOL by OCT,2026 )
>
> For openssl-3.5.x I have a draft PR:
> https://github.com/tianocore/edk2/pull/10946
>
> edk2 does not build with 3.5.0, I got fixes merged in openssl, now
> waiting for the 3.5.1 release (with the fixes included) for the actual
> upgrade.
>
> 3.5 is a LTS release, openssl plans to do a LTS release every two years
> going forward (see https://openssl-library.org/roadmap/index.html), so I
> expect from now on we'll go jump from one LTS release to the next.
>

Thanks for taking care of that.

When I looked into MbedTLS a couple of months ago, it looked like
upgrading was going to be difficult because upstream removed some
pieces (or made them internal to the library) that we rely on in the
integration. So that will need a substantial effort and alignment with
upstream.


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#121335): https://edk2.groups.io/g/devel/message/121335
Mute This Topic: https://groups.io/mt/113066244/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-