1.15 security updates

Afox

Hello, will 1.15 still be receiving security updates because some people can´t or don´t want to upgrade to a higher PHP version than 7.4 and therefore can´t upgrade to the latest version of osticket. For example Debian is still on 7.4 and if you want to stay in the secure lane meaning getting fixes from their security team you are stuck with it until the next major version comes out (what will take some time as no release date has been set yet).

KevinTheJedi

Afox

We dropped support for 1.15.x as PHP dropped support for 7.x long ago and will drop it completely by the end of the year. Also, not going to support 3 versions at a time. If your OS only has PHP 7.x then you should look into moving away from it as PHP is almost on 8.2 and it’s time to upgrade.

Cheers.

Afox

Sorry to say that but Debian is not just any OS. It is pretty sure found on many LAMP servers and maybe I am not the one who should think about moving away from it but you should rethink what PHP versions your software is supporting.

RBGE

Afox Not quite, it is very close (as in 2 weeks away!) to being completely end of life: https://www.php.net/supported-versions.php

If you can't manually add PHP 8.x to Debian (much in the way you'd use a third party repo in Ubuntu), then maybe consider something that doesn't leave you running vulnerable software versions. Other software providers, including osTicket, need to keep up-to-date too, and that means supporting current third-party packages.

Afox

The Debian security team will keep their PHP 7.4 version safe until Debian 11 is EOL.

RBGE

Afox While that may be ideal for people running legacy systems that require PHP 7.x, the fact is it still goes officially EOL in 2 weeks, and osTicket is not a legacy system. Most software will not support EOL versions of third-party packages, even if one specific distro is maintaining them separately. Much in the same way that since osTicket is open source, you and anyone else are welcome to take the fixes from later versions and integrate them into the 1.15.x code if you wish, but that still doesn't make the 1.15.x branch current.

Also, osTicket has always only supported the two most recent versions. Even if PHP 7.x was current, only 1.16.x and 1.17.x of osTicket are maintained. I myself had to skip the 1.16.x branch while I was getting ready to upgrade (in my case, it was the fact that the php-imap extension was deprecated in Fedora), but fortunately for me 1.17.x has allowed an upgrade of my system without breaking anything.

If you need to get PHP 8 on Debian 11, have a look at places like https://wiki.crowncloud.net/?How_to_install_PHP_8_on_Debian_11 - note that I'm not a Debian user, so can't vouch for the effectiveness of this page!

Afox

I know that it is possible to add a third party repo with PHP 8.x to Debian 11 but from security perspective this can´t be the best solution as those versions are not covered officially by their security team. And I am not willing to take this risk.

Again, Debian is not just any OS and if osticket sticks to its 2 version policy then one of those should still support PHP 7.4.

RBGE

Afox I'm afraid it is just another OS... and PHP 7.4.x is still rapidly approaching EOL, regardless of who adds fixes to it. While the PHP 8 repo may not be covered 'officially' by the Debian security team, it is maintained by one of them (see https://tracker.debian.org/pkg/php7.4 and look for Ondřej Surý signing the PHP packages you're currently using!), and the actual PHP development team!

Again, you'll find a lot of actively maintained systems stop supporting EOL packages, not just osTicket - that's life, especially given that cyber security is now a primary concern for most organisations. Basically, your options are now:

keep using osTicket 1.15.x until Debian 12 comes out, expected in January 2023, and then upgrade
use the PHP 8 repo linked in my previous message
import the fixes from 1.16.x into 1.15.x yourself (unless you're a developer, this may not be feasible)
move to a different distro (something tells me you really don't want this option 😇 )

First option may be easier, and if it were me I'd use the second, but it's obviously all up to you.

Afox

I don´t feel comfortable running an EOL software in the www. I don´t quite understand why osticket dropped support for PHP 7.4 and instead created two consecutive versions that both require at least PHP 8.0. In my opinion this was/is a mistake and should be fixed.

RBGE

Afox Because it's end of life in two weeks - period. Given the small development team (see https://enhancesoft.com/who-we-are/ ), I'd suspect the limited resources they have are spent maintaining current branches. The fact some people outside of the PHP development team are applying fixes themselves (only critical ones) changes nothing I'm afraid. Bear in mind PHP 8.0 was released in 2020, and 8.2 is due for release very soon - at that stage, 7.4.x will have been superseded by 3 later versions.

This is exactly the same way osTicket 1.15.x would still be EOL if you applied the fixes yourself. As mentioned earlier, the PHP 8 repo is maintained by one of the people maintaining the PHP 7.4 package you're currently using, so it's not a security risk to use this over the current 7.4 packages.

Afox

I stick with my statement. Debian stable is not any OS and osticket should make itself compatible with it.

RBGE

Afox Well, it is open source so by all means feel free..... there may even be other Debian users willing to chip in.

Afox

No, in my opinion it is clearly ostickets turn.

KevinTheJedi

Afox

When you make changes that are specific to PHP 8.x some of those changes are NOT backwards compatible. We will not hack our code to support older versions of PHP, especially EOL versions like PHP 7.x. Your thinking is entirely incorrect here.

Maybe you should try to fork the osticket repo and maintain 1.15.x yourself to see how it goes if you think otherwise.

Also, be glad we now support 2 versions, we used to only support 1 version at a time. 😉

Cheers.

Afox

It´s not me who set two consecutive versions supporting only PHP 8.x without any legacy support. So why should I or any other person fix your mistake?

KevinTheJedi

Afox

You must not have a good grasp of software development if you think dropping PHP 7.x support was a mistake. It’s EOL. Simple as that. It’s not up to us to support unsupported versions of PHP. You are really setting yourself up for more security vulnerabilities and issues than it’s worth.

Cheers.

Afox

It is and was still supported to date and as you released osticket 1.16 there was way to go until EOL. And as said the Debian team will take care of those security aspects. I find it more unsafe to use software not officially supported.

KevinTheJedi

Afox Like PHP 7.x…

Afox

As said Debian has a security team that takes care fo the security aspect. I sent a mail to Ondřej Surý to ask for advice in a situation like this but, again, this doesn´t change the fact that you should maintain one legacy and one most recent branch instead of 2 fairly recent branches.

KevinTheJedi

Afox

I'm not going to argue anymore. You can fork it and maintain it yourself if it's such a big deal to you. Good luck 🙂

Cheers.