Require `OpenSSL 1.1.1` as minimum

[xavier2k6]

Drop support of OpenSSL 1.0.x entirely & make OpenSSL 1.1.1 the minimum

• PEP 644 – Require OpenSSL 1.1.1 or newer

• OpenSSL 3.0.0: define OPENSSL_API_COMPAT 1.1.1

• OPENSSL_VERSION_NUMBER 0x1010100fL # OpenSSL 1.1.1

• OPENSSL_API_COMPAT 0x10101000L # OpenSSL 1.1.1

libtorrent/include/libtorrent/ssl.hpp

Line 57 in 15f596e

#if OPENSSL_VERSION_NUMBER < 0x1000000fL

libtorrent/src/ssl.cpp

Lines 175 to 205 in 15f596e

	#if defined TORRENT_USE_OPENSSL
	namespace {
	struct lifecycle
	{
	lifecycle()
	{
	// this is needed for openssl < 1.0 to decrypt keys created by openssl 1.0+
	#if !defined(OPENSSL_API_COMPAT) || (OPENSSL_API_COMPAT < 0x10100000L)
	OpenSSL_add_all_algorithms();
	#else
	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | OPENSSL_INIT_ADD_ALL_DIGESTS, nullptr);
	#endif
	}
	~lifecycle()
	{
	// by openssl changelog at https://www.openssl.org/news/changelog.html
	// Changes between 1.0.2h and 1.1.0 [25 Aug 2016]
	// - Most global cleanup functions are no longer required because they are handled
	// via auto-deinit. Affected function CRYPTO_cleanup_all_ex_data()
	#if !defined(OPENSSL_API_COMPAT) || OPENSSL_API_COMPAT < 0x10100000L
	#ifdef TORRENT_MACOS_DEPRECATED_LIBCRYPTO
	#pragma clang diagnostic push
	#pragma clang diagnostic ignored "-Wdeprecated-declarations"
	#endif
	// openssl requires this to clean up internal structures it allocates
	CRYPTO_cleanup_all_ex_data();
	#ifdef TORRENT_MACOS_DEPRECATED_LIBCRYPTO
	#pragma clang diagnostic pop
	#endif
	#endif

[arvidn]

according to https://endoflife.date/openssl it seems reasonable to even require OpenSSL 3.0 or later. Is that too aggressive?

[xavier2k6]

according to https://endoflife.date/openssl it seems reasonable to even require OpenSSL 3.0 or later. Is that too aggressive?

There was some push back in a previous PR. (IMO - I'd go with OpenSSL 3.0+)

[arvidn]

it turns out the MacOS github actions runner ships with OpenSSL 1.1.1

[arvidn]

#8114

[xavier2k6]

it turns out the MacOS github actions runner ships with OpenSSL 1.1.1

It actually ships with both 1.1.1 & 3.x, we had come across this issue before - I'll see if I can find the relevant ticket.

@userdocs CC for help with regards to relevant ticket & your workflow....

EDIT: Found it!

• [macOS] - openssl 3.5.2 is installed by default but docs only mention 1.1.1w actions/runner-images#12913

[xavier2k6]

AppVeyor Image will have to be bumped for OpenSSL 3.x support too!

https://www.appveyor.com/docs/windows-images-software/#tools

[xavier2k6]

@arvidn I've opened #8117 as an alternative with OpenSSL 3.0.0 as minimum (have left AppVeyor with Python 3.8 for now)