Do we still need the upgrade to OpenSSL 1.0.2 in the Dockerfile about openjdk-runtime HOT 9 CLOSED

History of the addition of the openssl 1.0.2 artifact can be found at ...

• https://github.com/grpc/grpc-java/blob/master/SECURITY.md#tls-with-openssl
• GoogleCloudPlatform/appengine-java-vm-runtime#115
• GoogleCloudPlatform/appengine-java-vm-runtime#143

from openjdk-runtime.

@dlorenc This sounds like it would be beneficial to all runtimes. Do you think it should be pulled into the base image?

from openjdk-runtime.

Also, it looks like the libssl1.0.2 line is redundant because the current version of OpenSSL is 1.1.0c and it comes with libssl1.1.

@lesv FYI

from openjdk-runtime.

You might wish to reach out to Eric J. or Louis R. of the gRPC teams about this. (That's why it's there).

from openjdk-runtime.

For Java, we now use BoringSSL, (ie OpenSSL is no longer used) Typically.

from openjdk-runtime.

Thanks, Les. It sounds like it's no longer needed, but I would like to get a confirmation from the gRPC team. Do you have Eric's and Louis's github handles?

from openjdk-runtime.

They aren't project members so I couldn't use them. I think both are close to their ldaps.

from openjdk-runtime.

Confirmed that this is no longer needed because BoringSSL is now bundled with the gRPC/client libs.

from openjdk-runtime.

What about those folks using older grpc releases on this openjdk-runtime image?

from openjdk-runtime.