botan
botan copied to clipboard
randombit
Botan 3.x.x release
Hi,
Recently we started work with Botan 3.0.0-alpha0. We upgraded entire platform with new Botan version, but then it was questioned by the Customer, why the alpha version is used. Unfortunately we cannot roll-back to the latest Botan 2.18.x release, as we are working on the TLS 1.3 support and we have to stick to the latest version (to upstream the TLS 1.3 implementation). Therefore the question: Is it possible to officially release the Botan 3.0.0? Or when can we expect the official release? It seems that content-wise it might be already worth to release it. When it comes to stability we cannot complain as well / all kind of tests that we had with 2.x.x releases are now passing, so Botan 3.0.0-alpha0 seems to be in a good shape already. This is quite important topic, as we might be blocked with using Botan if there won’t be any official release of 3.0.0 version...
TBH the main blocker is TLS 1.3 support since while there are many features that could be included in the first release, TLS 1.3 support is the most likely to cause some level of API incompatibility which would require a SemVer bump. I do not want to commit us to maintaining current API forever until we have 1.3 support settled.
Would your customer be OK with issuing a new version from master as say 2.99.0 that you could use as an interim version?
Thank you for quick response @randombit. We'll discuss it with the Customer and get back to you.
@randombit: we are just starting the TLS 1.3 implementation, as the refactoring phase is almost done. The point is that we won't implement the protocol fully (i.e. 0-RTT, resumption with PSK). However, the interfaces shall be more or less stable after delivering/reviewing the code with community. Would it be then possible to release the 'partial' support of TLS 1.3 with official Botan version? I suppose that missing features could be then added incrementally at some point, without breaking the compatibility or with minor changes.
