SP release before March 2020?

[Cantor, Scott]

The SP update won't make that deadline, but the critical bug fix for the race condition in the new cookie session code really should get into that release if possible, and that's just a patch to xmltooling I already committed, so I'll see what I can do about at least tagging that library update, even if I don't package it myself yet.

The next big source of uncertainty is OpenSSL 3.0.0, which isn't due until Q4 at the earliest.

It would be tremendously unfortunate if Debian decides to force everybody to move to that prematurely like they did with OpenSSL 1.1 last time, and I can promise I won't take it well if they do, so anything we can do to communicate that would be a good thing. I do not expect the move to 3.0.0 to be smooth and it's quite possible it won't even be viable if they break the low level APIs I have to use to get control of the TLS layer in libcurl.

-- Scott