4 ms·

The following isn't exactly right: Because ports/packages build with the base openssl, a security team supporting a release usually has to maintain an ap

The following isn't exactly right: Because ports/packages build with the base openssl, a security team supporting a release usually has to maintain an api compatible version in base. Forcing ports to compile against the security/openssl port instead of the base version is pretty easy. You add the following knob to /etc/make.conf, to the port's Makefile, or to the make(1) command line: WITH_OPENSSL_PORT=yes The reason the security team has to maintain an API/ABI-compatible release of OpenSSL is because FreeBSD releases make that guarantee for all base system libraries---and the reason OpenSSL is in the base system in the first place is because other things in base like OpenSSH and Heimdal require it. This guarantee lets me build packages on FreeBSD 10.0 that work fine on FreeBSD 10.2 (and, generally, vice versa).

stock_toaster 11y ago
> Forcing ports to compile against the security/openssl port > instead of the base version is pretty easy. Yes. I do this currently, and it works great. But not everyone does, so the security team has to keep abi compatibility. > The reason the security team has to maintain an API/ABI-compatible release > of OpenSSL is because FreeBSD releases make that guarantee for all base > system libraries---and the reason OpenSSL is in the base system in the > first place is because other things in base like OpenSSH and Heimdal > require it. Head scratching That was...kind of my whole point. Anyway, openssl is planned to become private, so I just need to wait a bit (maybe Allan will get it into FreeBSD-11? see[1]). [1]: https://wiki.freebsd.org/OpenSSL/Base https://wiki.freebsd.org/OpenSSL/Base