Upgrade openssl dependency

[chaoticsmol]

Currently, Hyper's Cargo.toml specifies using Rust-OpenSSL version 0.7.x. At the time of this writing, the latest release is version 0.8.2, which includes a number of bug fixes that, in some applications has resolved some functional failings.

I'd like to ask for Hyper to adopt these changes and upgrade to the latest version.

[kwaegel]

Upgrading may also fix a build issue on Widows, as I mentioned in the linked bug for rust-rosetta: rust-rosetta/rust-rosetta#566 .

Unfortunately, cookie v0.3.0 also depends on rust-openssl v0.7, so fixing the build issue would require an upgrade in that crate as well. Such a change is already in master, but isn't part of a release yet.

[Thomasdezeeuw]

cookie v0.3.1 now depends on v0.8. Is their anything else that is blocking an update to v0.8?

[seanmonstar]

Bumping to openssl 0.8 is a breaking change, so that'd require bumping hyper as well. openssl is also addinv support for opensslv1.1, which will likely bump it to 0.9. I've been hoping hyper 0.10 would be async hyper.

My plan has been this:

• hyper v0.10: Be "async" hyper. Utilize tokio-tls.
• reqwest: Be the convenient, higher level Client crate. This will release very soon, and depend on rust-native-tls. Everyone using hyper for a client should be able to easily switch the reqwest, getting better TLS support immediately, and a (as much as possible) not-breaking API, even as hyper v0.10 comes out with its async Client.

[Thomasdezeeuw]

@seanmonstar that sounds great, looking forward to it. I would offer help, but I started learning Rust last week and I'm not sure I would be any help.

[chaoticsmol]

Is there anything I could do to help speed this process along? My project at work has actually had to drop a couple of features because of the OpenSSL version mismatch between a few of our dependencies, and I'd like to be able to help resolve that if possible.

[seanmonstar]

@zsck which do you need? I'm assuming that the majority of people who need HTTPS are using a Client (since so many terminate TLS with nginx for a Server). In that case, there are issues filed on the reqwest repo. It's also largely dependent on rust-native-tls being published to crates.io, instead of being a git dependency.

[chaoticsmol]

In my case, I need the library to just be using OpenSSL 0.8. The problem is that Hyper's requirement for 0.7 conflicts with some of my other dependencies which now use 0.8. Cargo picks up on the fact that I'm using the Hyper Client and resolves the dependencies to using 0.7 everywhere, which breaks another one of my dependencies which needs 0.8.

[seanmonstar]

@zsck I understand. As i mentioned, openssl will be getting another breaking change (likely to 0.9) very very shortly (see sfackler/rust-openssl#466). When it does, native-tls will be published, and I can publish reqwest.