Migrating Julia 1.10 from MbedTLS to OpenSSL in a 1.10 patch release

Internals & Design
1

Background

Julia 1.10 is currently the Julia LTS series. Julia 1.10 uses the MbedTLS 2.28 release series. MbedTLS 2.28 has accumulated multiple security problems. However, MbedTLS 2.28 is no longer supported by the upstream MbedTLS project and will not receive any further patch releases.

Therefore, we have made the difficult decision to migrate Julia 1.10 from OpenSSL to MbedTLS in a 1.10 patch release.

Plan

There are two upcoming releases of Julia 1.10:

  • Julia 1.10.14. This version will be the last Julia 1.10 release with MbedTLS in the standard library.
  • Julia 1.10.15. This version will migrate the standard library from MbedTLS to OpenSSL.

From Julia 1.10.15 onward, Julia 1.10 will use OpenSSL and will no longer ship MbedTLS in the standard library. This will bring Julia 1.10 to parity with Julia 1.13+, which also uses OpenSSL.

We are aware that performing this migration in a 1.10 patch release may be disruptive to people’s existing manifests. We aren’t making this decision lightly. We’ve chosen this path because we are prioritizing security fixes over the disruption.

If you currently have a Julia 1.10 manifest, the upgrade from Julia 1.10.14 to Julia 1.10.15 may require you to re-resolve your manifest (e.g. Pkg.resolve()) in order to get things working.

The main reason that this may require re-resolving manifests is that we need to add two new stdlibs (OpenSSL_jll and Zstd_jll) and remove one stdlib (MbedTLS_jll). We also need to modify the dependency graphs for stdlibs that currently depend on MbedTLS_jll.

Alternatives we considered

We considered multiple alternatives, including:

  1. Keeping Julia 1.10 on MbedTLS 2.28.

    • Pros:
      • Wouldn’t require re-resolving existing Julia 1.10 manifests.
    • Cons:
      • At this point, MbedTLS 2.28 has accumulated too many security problems for us to be able to justify keep using it.
      • Additionally, MbedTLS 2.28 is no longer supported by the upstream MbedTLS project.

  2. Keep Julia 1.10 on MbedTLS, but upgrade from MbedTLS 2.28 to MbedTLS 4.1 (which, at time of writing, is the MbedTLS LTS release series).

    • Cons:
      • The upstream MbedTLS project announced that they will stop maintaining the TLS and X.509 libraries in 2027. Therefore, even if we were to upgrade to MbedTLS 4.1 now, we will need to migrate away from MbedTLS in 2027.
      • MbedTLS 4.1 is a new major version and is incompatible with MbedTLS 2.28. The upgrade from MbedTLS 2.28 to MbedTLS 4.1 would probably still be disruptive to users.
      • Upgrading from MbedTLS 2.28 to MbedTLS 4.1 would require significant technical work. No other Julia version uses MbedTLS 4.1, so this work would all need to be done from scratch.
      • Additionally, this would signicantly increase our ongoing maintenance requirements, because we would need to keep maintaining two setups (MbedTLS 4.1 for Julia 1.10 and OpenSSL for Julia 1.13+).
      • No major Julia packages currently support MbedTLS v4, so there would be a lot of work for packages to migrate.

  3. Keeping the default Julia 1.10 on MbedTLS 2.28, but publish a new “variant” of Julia 1.10 that uses OpenSSL. Users would need to opt-in in order to use the OpenSSL variant of 1.10.

    • Pros:
      • By default, wouldn’t require re-resolving existing Julia 1.10 manifests.
    • Cons:
      • We want the Julia LTS to be secure by default. We don’t want Julia LTS users to need to opt-in to a separate variant in order to get security fixes.

  4. Choosing a new LTS version.

    • Pros:
      • Less technical work for us, because all Julia versions >= 1.13 use OpenSSL (not MbedTLS).
    • Cons:
      • We would like to keep 1.10 as the LTS for now.
      • No good candidate has yet emerged for a new LTS.

Ultimately, we believe that the pros/cons of our chosen plan outweight the pros/cons of the alternatives.

Other Julia versions

  • Julia 1.11 uses MbedTLS. Julia 1.11 is no longer officially supported. Users of Julia 1.11 should either upgrade to the latest stable release of Julia or downgrade to Julia LTS.
  • Julia 1.12 uses OpenSSL. However, Julia 1.12 is no longer officially supported. Users of Julia 1.12 should either upgrade to the latest stable release of Julia or downgrade to Julia LTS.
  • Julia versions >= 1.13 use OpenSSL.
2

Probably the other way around