Re: Is support for 10.8 dropped?

From: Igor Korot <ikorot01@gmail.com>
To: "brian m. carlson" <sandals@crustytoothpaste.net>,
	Perry Hutchison <perryh@pluto.rain.com>,
	Igor Korot <ikorot01@gmail.com>, git <git@vger.kernel.org>,
	sunshine@sunshineco.us
Subject: Re: Is support for 10.8 dropped?
Date: Mon, 23 Apr 2018 11:39:50 -0500	[thread overview]
Message-ID: <CA+FnnTxD1JbeNFt1K4OU7JMWvyXpRiYLmZJSiqm=DqmSca3_LQ@mail.gmail.com> (raw)
In-Reply-To: <20180422174902.GJ14631@genre.crustytoothpaste.net>

Hi, Brian,

On Sun, Apr 22, 2018 at 12:49 PM, brian m. carlson
<sandals@crustytoothpaste.net> wrote:
> On Sun, Apr 22, 2018 at 12:10:20AM -0700, Perry Hutchison wrote:
>> Eric Sunshine <sunshine@sunshineco.us> wrote:
>> > On Sun, Apr 22, 2018 at 1:15 AM, Igor Korot <ikorot01@gmail.com> wrote:
>> > > MyMac:git-2.17.0 igorkorot$ cat config.mak
>> > > NO_GETTEXT=Yes
>> > > NO_OPENSSL=Yes
>> > >
>> > > MyMac:dbhandler igorkorot$ /Users/igorkorot/git-2.17.0/git pull
>> > > fatal: unable to access
>> > > 'https://github.com/oneeyeman1/dbhandler.git/': error:1407742E:SSL
>> > > routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
>> > > MyMac:dbhandler igorkorot$
>> >
>> > Try re-building with OpenSSL enabled (remove NO_OPENSSL from
>> > config.make). You may need to build/install OpenSSL yourself to get
>> > this to work.
>>
>> Explanation:  "tlsv1 alert protocol version" means that the server
>> requires its clients to use a newer version of TLS than what was
>> used in the local build of git.
>
> I think the issue here is that you're using a crypto library which may
> only support TLS 1.0 on 10.8[0].  GitHub requires TLS 1.2 as of
> recently.  So this isn't really a problem with Git, so much as it's an
> incompatibility between the version of the crypto library you're using
> and GitHub.
>
> I expect that due to the PCI DSS rules prohibiting new deployment of TLS
> 1.0, you'll continue to run into this issue more and more unless you
> upgrade to an OS or crypto library that supports TLS 1.2.  As of June
> 30, TLS 1.0 will be pretty much dead on the Internet.

Yes, openSSL on OSX 10.8 is old. I will t to update it tonight.
But as a developer I'm trying to stay with whatever OS provides.
Because upgrading will actually means that I will have to recompile an re-test
everything I made, since I will be working on a brand new system.

This is however is an unfortunate event when I will have to upgrade...

Than you.

>
> [0] I surmised this from https://www.ssllabs.com/ssltest/clients.html,
> but I don't use macOS so can't speak for certain.
> --
> brian m. carlson: Houston, Texas, US
> OpenPGP: https://keybase.io/bk2204