Skip to content

Commit 09dd6bb

Browse files
committed
DOC: update INSTALL with the range of gcc compilers and openssl versions
Gcc 4.7 to 15 are tested. OpenSSL was tested up to 3.6. QUIC support requires OpenSSL >= 3.5.2.
1 parent 22fd296 commit 09dd6bb

File tree

1 file changed

+11
-7
lines changed

1 file changed

+11
-7
lines changed

INSTALL

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ HAProxy requires a working GCC or Clang toolchain and GNU make :
111111
may want to retry with "gmake" which is the name commonly used for GNU make
112112
on BSD systems.
113113

114-
- GCC >= 4.7 (up to 14 tested). Older versions are no longer supported due to
114+
- GCC >= 4.7 (up to 15 tested). Older versions are no longer supported due to
115115
the latest mt_list update which only uses c11-like atomics. Newer versions
116116
may sometimes break due to compiler regressions or behaviour changes. The
117117
version shipped with your operating system is very likely to work with no
@@ -237,7 +237,7 @@ to forcefully enable it using "USE_LIBCRYPT=1".
237237
-----------------
238238
For SSL/TLS, it is necessary to use a cryptography library. HAProxy currently
239239
supports the OpenSSL library, and is known to build and work with branches
240-
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 3.0 to 3.5. It is recommended to use
240+
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 3.0 to 3.6. It is recommended to use
241241
at least OpenSSL 1.1.1 to have support for all SSL keywords and configuration
242242
in HAProxy. OpenSSL follows a long-term support cycle similar to HAProxy's,
243243
and each of the branches above receives its own fixes, without forcing you to
@@ -259,11 +259,15 @@ reported to work as well. While there are some efforts from the community to
259259
ensure they work well, OpenSSL remains the primary target and this means that
260260
in case of conflicting choices, OpenSSL support will be favored over other
261261
options. Note that QUIC is not fully supported when haproxy is built with
262-
OpenSSL < 3.5 version. In this case, QUICTLS is the preferred alternative.
263-
As of writing this, the QuicTLS project follows OpenSSL very closely and provides
264-
update simultaneously, but being a volunteer-driven project, its long-term future
265-
does not look certain enough to convince operating systems to package it, so it
266-
needs to be build locally. See the section about QUIC in this document.
262+
OpenSSL < 3.5.2 version. In this case, QUICTLS or AWS-LC are the preferred
263+
alternatives. As of writing this, the QuicTLS project follows OpenSSL very
264+
closely and provides update simultaneously, but being a volunteer-driven
265+
project, its long-term future does not look certain enough to convince
266+
operating systems to package it, so it needs to be build locally. Recent
267+
versions of AWS-LC (>= 1.22 and the FIPS branches) are pretty complete and
268+
generally more performant than other OpenSSL derivatives, but may behave
269+
slightly differently, particularly when dealing with outdated setups. See
270+
the section about QUIC in this document.
267271

268272
A fifth option is wolfSSL (https://github.com/wolfSSL/wolfssl). It is the only
269273
supported alternative stack not based on OpenSSL, yet which implements almost

0 commit comments

Comments
 (0)