openssl_1_1 is going to be marked as insecure/dropped

[jtojnar]

Similar to #78, we might need to backport OpenSSL 3 compatibility patches (if possible).

Upstream issue: NixOS/nixpkgs#210452

[ajs124]

it's marked as insecure now. drop pending, but probably still a few months ahead.

[drupol]

How are we going to tackle this thing in here?

[jtojnar]

In the short term, overriding the meta is probably the easiest.

[drupol]

And marking the package as insecure adding meta.knownVulnerabilities ? If yes, which vulnerability ?

[aanderse]

I'm also interested in resolution to this.

[jtojnar]

And marking the package as insecure adding meta.knownVulnerabilities ? If yes, which vulnerability ?

Nixpkgs does that. So we would need to do the opposite – removing meta.knownVulnerabilities.

[drupol]

Oooh. Ok.

[drupol]

Your eyes here : #237

[jtojnar]

We still need to deal with this once the package is removed. Ideally, we would patch PHP to use OpenSSL 3.