gitian: upgrade OpenSSL to 1.0.1i #4648

Upgrade for https://www.openssl.org/news/secadv_20140806.txt

Automatic sanity-testing: PASSED, see http://jenkins.bluematt.me/pull-tester/p4648_074bcdc27e561514d3e3145f280f2c2a8b9a16f5/ for binaries and test log. This test script verifies pulls every time they are updated. It, however, dies sometimes and fails to test properly. If you are waiting on a test, please check timestamps to verify that the test.log is moving at http://jenkins.bluematt.me/pull-tester/current/ Contact BlueMatt on freenode if something looks broken.

ACK, seems wise to quickly patch OpenSSL these days.

Are any of those issues serious enough that we should release an 0.9.3?

@fanquake You bumped the OS X Qt revision, but not Windows. Was this intentional?

OpenSSL should be updated, but there's nothing in the latest vulnerability updates that seems to call for any kind of emergency client update release. The OpenSSL version bump is worth adopting, but compared to the last couple of releases the severity of these latest disclosures is minimal for clients.

Okay, great.

On Thu, Aug 7, 2014 at 11:49 PM, Dominyk Tiller notifications@github.com wrote:

OpenSSL should be updated, but there's nothing in the latest vulnerability updates that seems to call for any kind of emergency client update release. The OpenSSL version bump is worth adopting, but compared to the last couple of releases the severity of these latest disclosures is minimal for clients.

— Reply to this email directly or view it on GitHub #4648 (comment).

I also think this round of fixes dosn't need an emergency release, from what I've read in the changelog.

We do intend to do a 0.9.3 release in the near future for some minor bugfixes. May be worthwhile to include an openssl version bump too. But I'm not sure. If nothing is broken an upgrade could only break things.

@theuni do you have an opinion here?

If it's agreed that it's no an immediate threat, we may as well just let this come in as part of #4727. Once that's merged, it's just a matter of replacing the version string (and hash) in depends to get the update.

Has been merged into 0.9.3 branch via bba01750226745d6666d587cabe57c321fde0875.

I asked this 15 days ago and didn't get an answer. @fanquake, Was the Qt dependency version in the Windows build intentionally not bumped? I've seen that usually the Qt dependency is bumped when the OpenSSL build is, and the OS X Qt was, in fact, bumped. 0.9.3rc1 just got tagged with this upgrade and no bump, and I want to know if that was intentional or an oversight.

Edit: Never mind, @laanwj answered that it is, indeed, not needed.

Closing in favor of #4767