Update openssl to 1.0.2l

Currently running 1.0.2j, which is now an old release.

If we’d like to stick with j for now, we can update the url to be under the source/old/1.0.2 subdirectory.

In the meantime, building without cache will get a 404.

changed title from “Update openssl to 1.0.2l” to Update openssl to 1.0.2l

changed the description

@ibaum Do we need to stick to 1.0.2j for anything specific? Otherwise, we should just try and upgrade.

@marin 1.0.2 is currently the LTS version of openssl. Currently, 1.1.0 is only being supported until August 2018¹.

Besides that, provided all the bundled software builds against 1.1.0, I don't see anything in the changelog which would cause any problems.

1. https://www.openssl.org/policies/releasestrat.html ↩

added For Scheduling Maintenance labels

changed milestone to %9.5

removed For Scheduling label

Ruby 2.3.x is not compatible with openssl 1.1.0 (I specifically remember this because Debian 9 had openssl 1.1.0 as default and Ruby build failed and I had to manually specify the 1.0.x version of openssl). Even though 1.1.0 "may" bring in some performance improvments (and definitely backward compatibility breaking changes with it), 1.0.2 is the LTS version as @ibaum said.

My opinion is to update to 1.0.2j for now and think about 1.1.0 when GitLab moves to Ruby 2.4.

assigned to @balasankarc

Done by https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/1776

closed