A corresponding discussion is how to make Spack upgrade certain libraries automatically, if e.g. the previous version has a severe security issue.

See my suggestion in #414. I don't really like that this package breaks every time a new release comes out.

I don't like that it breaks either, but it's better than just offering a known-bad version of openssl as well. I think that if it gets a 404, maybe openssl's package class could intercept that, bump the letter and output a message to post an issue here, the mailing list, or, better, how to open a PR with the change here.

Also, we're downloading openssl over http which is…not really bad, but definitely not good either.

Can you check if the changes in #414 mitigate the URL issue ?

@alalazo: I actually agree with @mathstuf here -- I think this is annoying but the reason the openssl folks do this is to prevent people from deploying bad openssl versions. If the package actively tries to install old versions, and it doesn't warn about it, then I think Spack's doing the wrong thing, security-wise.

I like the idea of bumping the version and seeing if a newer tarball is present. The logic in spack checksum could be used to see what is currently available if a download fails, and you could prompt the user to download and checksum the newer version.

If you want to do the #414 thing, then I think the code should at least warn the user that they're getting an old version of OpenSSL that likely has known security holes. If they say yes to that, then I guess there is not much to be done, although I think we run the risk of conditioning users to robotically consent. It would be nice to avoid that and to do something both convenient and secure.

@tgamblin : I have no strong opinions on OpenSSL installation (I just tried to implement one of the comment suggestion which seemed to me a good default). What would you prefer me to do with that package in #414? Revert it to the current state or add logic to warn / prompt user if they ask for an old release?

@alalazo: I think reverting #414 to current state and submitting the OpenSSL stuff separately would be good. Logic to warn if OpenSSL is discovered to be old would be good enough for me.