4 ms·

This is great. A good example of why this is great, is openssl. Because ports/packages build with the base openssl, a security team supporting a release usually

This is great. A good example of why this is great, is openssl. Because ports/packages build with the base openssl, a security team supporting a release usually has to maintain an abi compatible version in base. If ports/packages simply used their a packaged of openssl, it would make it much easier for ports/packages to update in lockstep, as well as the base system to update on its own schedule (update to newer version and simply update any outdated api usages in base as well -- and for example to use libressl instead). I think BSD's exporting so many libraries as part of the base install made much more sense in the time with small hard drives, but maybe not as much today.

xenophonf 11y ago
The following isn't exactly right: Because ports/packages build with the base openssl, a security team supporting a release usually has to maintain an api compatible version in base. Forcing ports to compile against the security/openssl port instead of the base version is pretty easy. You add the following knob to /etc/make.conf, to the port's Makefile, or to the make(1) command line: WITH_OPENSSL_PORT=yes The reason the security team has to maintain an API/ABI-compatible release of OpenSSL is because FreeBSD releases make that guarantee for all base system libraries---and the reason OpenSSL is in the base system in the first place is because other things in base like OpenSSH and Heimdal require it. This guarantee lets me build packages on FreeBSD 10.0 that work fine on FreeBSD 10.2 (and, generally, vice versa).
- stock_toaster 11y ago
  > Forcing ports to compile against the security/openssl port > instead of the base version is pretty easy. Yes. I do this currently, and it works great. But not everyone does, so the security team has to keep abi compatibility. > The reason the security team has to maintain an API/ABI-compatible release > of OpenSSL is because FreeBSD releases make that guarantee for all base > system libraries---and the reason OpenSSL is in the base system in the > first place is because other things in base like OpenSSH and Heimdal > require it. Head scratching That was...kind of my whole point. Anyway, openssl is planned to become private, so I just need to wait a bit (maybe Allan will get it into FreeBSD-11? see[1]). [1]: https://wiki.freebsd.org/OpenSSL/Base https://wiki.freebsd.org/OpenSSL/Base

xenophonf 11y ago

The following isn't exactly right: Because ports/packages build with the base openssl, a security team supporting a release usually has to maintain an api compatible version in base. Forcing ports to compile against the security/openssl port instead of the base version is pretty easy. You add the following knob to /etc/make.conf, to the port's Makefile, or to the make(1) command line: WITH_OPENSSL_PORT=yes The reason the security team has to maintain an API/ABI-compatible release of OpenSSL is because FreeBSD releases make that guarantee for all base system libraries---and the reason OpenSSL is in the base system in the first place is because other things in base like OpenSSH and Heimdal require it. This guarantee lets me build packages on FreeBSD 10.0 that work fine on FreeBSD 10.2 (and, generally, vice versa).

stock_toaster 11y ago
> Forcing ports to compile against the security/openssl port > instead of the base version is pretty easy. Yes. I do this currently, and it works great. But not everyone does, so the security team has to keep abi compatibility. > The reason the security team has to maintain an API/ABI-compatible release > of OpenSSL is because FreeBSD releases make that guarantee for all base > system libraries---and the reason OpenSSL is in the base system in the > first place is because other things in base like OpenSSH and Heimdal > require it. Head scratching That was...kind of my whole point. Anyway, openssl is planned to become private, so I just need to wait a bit (maybe Allan will get it into FreeBSD-11? see[1]). [1]: https://wiki.freebsd.org/OpenSSL/Base https://wiki.freebsd.org/OpenSSL/Base