3 ms·

You did a git clone and then a build without issue? Because the repo on arch patches the issue with the statically linked openssl library: https://aur.archlin

by bpfrh 7y ago

You did a git clone and then a build without issue? Because the repo on arch patches the issue with the statically linked openssl library: https://aur.archlinux.org/cgit/aur.git/plain/openssl-linking.patch?h=signal https://aur.archlinux.org/cgit/aur.git/plain/openssl-linking... So if you just install signal from the aur, then you use the patched version.

godelski 7y ago
Sorry, let me rephrase that. The AUR has a working patch so it clearly isn't impossible. You can probably follow the same procedure. So I just wouldn't say that it is impossible to install it on non-Ubuntu distros, just not trivial. But this seriously doesn't look complex. Also, wasn't Signal pushed into the main repos recently?
- jedbrown 7y ago
  It's in community and uses this 2-line patch: https://git.archlinux.org/svntogit/community.git/tree/trunk/openssl-linking.patch?h=packages/signal-desktop https://git.archlinux.org/svntogit/community.git/tree/trunk/...
- bpfrh 7y ago
  Of course you can replace the dependency, but do you know if it is 100% compatible? My point was that as long as the maintainers don't give us the reason for the static link or the custom dependency, we can assume we can replace it, but we don't know. Could be that it works, but it uses an insecure cipher, could be that there is a silent corruption. Nothing is impossible, just means you have to reedit and patch each time and know you running untested things for a secure application.