[3.6] Cherry-picks for the 3.6 branch (future 3.6.2) - 1st batch #111078
Conversation
Co-authored-by: ocean (they/them) <anvilfolk@gmail.com> (cherry picked from commit 287cf32)
lawnjelly
force-pushed
the
3.6.2_cherrypicks_sept_25
branch
from
0b51bde to
447a39c
Compare
|
Regarding mbedtls, I suggested in #108382 (review) that for 3.6.x we might want to take a more minimal approach and not add support for TLSv1.3. I'm fine adding it anyway but it's a new feature which is not usually what we want in a patch release. But maybe it's considered a bugfix too if some websites start requiring TLSv1.3? CC @Faless |
mbedTLS 2.28 is now EOL, and will no longer receive security updates. This commit backports from Godot 4 the changes needed to update to mbedTLS 3.6 (new LTS), including TLSv1.3 support. (cherry picked from commit 0770c9a)
(cherry picked from commit 21d7340)
Backport for 3.x from PR: godotengine#84990 Co-authored-by: brno32 <drozdster@gmail.com> (cherry picked from commit 983b12b)
(cherry picked from commit 3c64599)
…pecific font (cherry picked from commit c7bace1)
(cherry picked from commit 936c86b)
Previously, a link error occurred as we'd be trying to link against a nonexistent framework. AGL was removed in macOS Tahoe since the first beta. (cherry picked from commit b86295c)
(cherry picked from commit e9525ae)
Backports godotengine#97139 without bumping the embedded miniupnpc library. Co-authored-by: Rémi Verschelde <rverschelde@gmail.com> (cherry picked from commit a2a4600)
(cherry picked from commit 9b104b3)
(cherry picked from commit d164a70)
(cherry picked from commit ec5920e)
lawnjelly
force-pushed
the
3.6.2_cherrypicks_sept_25
branch
from
447a39c to
6bc378e
Compare
|
Marking as ready for review as there's no reason we can't do #111069 separately when reviewed. (We're also waiting for a double check that there isn't a 16kb page issue for the APKs but again that can be done separately if changes needed.) |
@akien-mga this is a hard one. Enabling TLSv1.3 did have consequences in the past, notably breaking some websites due to an improper implementation on the mbedTLS side, and some unannounced breaking changes that caused a race condition in our implementation. That said, it seems that as of now the situation is stable (we didn't find new issues in a while), and mbedTLS is clearly moving full steam towards a PSA-only world with mbedTLS 4 on the way, which will require PSA, so that's their focus now (i.e. they are more likely to fix PSA issues in 3.6 that "strange" non-PSA issues, at least that's my feeling). So, I'm really leaning towards keeping the PSA-enabled config, as this will also make maintaining it easier on our side. Again, this is a hard choice, and I also fear doing a "partial" update is riskier, so I would try to keep implementations more or less in sync whenever we can, and we can also more promptly release security updates if needed. |
Sounds good to me. @lawnjelly Can you flip that project setting for 3.6? |
Sure I will take a look (may have to be sunday onward). 👍 |
Have added this as the final commit (just to enable easy checking that I have fixed up the right thing). If that's okay let me know and I can combine with the mbedtls commit if we prefer it like that. From the discussions, I'm guessing we are okay with keeping the default to |
|
Looks great to me. I think a separate commit makes sense so the change is explicit and not hidden in a modified cherry-pick.
Yeah definitely true for 3.7. |
|
Thanks! |
This is primarily to fix the updated google play Android requirements, but there are a few other bug fixes / platform updates.
Let me know if you spot any I missed.