trunk/5375a55a5fa0d7509eeb34fc413d59fb28e0e43f: [CD] [BE] Remove ancient OpenSSL 1.1.1k build (#179513)
The PyTorch team, with help from Claude AI, phases out a 3-year-old security vulnerability in its build system.
The PyTorch machine learning framework has taken a significant step to modernize its security foundation. In a recent code commit (trunk/5375a55), the development team, with a notable co-authorship credit to Anthropic's Claude AI, removed the build script for OpenSSL 1.1.1k. This outdated cryptographic library had been a persistent component because PyTorch's GLOO_TLS distributed training transport was incompatible with newer versions. However, OpenSSL 1.1.1k reached its official end-of-life (EOL) in September 2023, meaning it no longer receives critical security patches, posing a latent vulnerability for any system relying on it.
This change has a direct operational impact: the GLOO_TLS transport feature will no longer be included in pre-built PyTorch binaries. The team removed all related checks, as the old OpenSSL build was fundamentally unusable on modern Linux systems that ship with `libssl.3`, while the plugin searched for older `libssl.so.1` libraries. For users who specifically require the GLOO_TLS transport for secure, TLS-based communication in distributed training scenarios, the feature remains buildable from source. The commit, part of a larger stack of dependencies (#179507, #179508), represents a necessary cleanup to ensure the widely-used AI framework isn't shipping with known security liabilities, forcing a move towards more modern and maintained cryptographic standards.
- PyTorch removed build support for OpenSSL 1.1.1k, which reached end-of-life (EOL) in September 2023, closing a security gap.
- The change, co-authored by Claude AI, eliminates the GLOO_TLS transport from shipped binaries due to incompatibility with modern `libssl.3` systems.
- Users requiring GLOO_TLS for secure distributed training must now build it from source, as the feature is no longer included in pre-built packages.
Why It Matters
This proactively removes a 3-year-old security vulnerability from a core AI framework used by millions, protecting model training infrastructure.