Re: avoiding base openssl when building ports

2015-06-01 Thread Benjamin Kaduk
On Sun, 31 May 2015, Don Lewis wrote: > The big culprit turned out to be ftp/curl. Even though > WITH_OPENSSL_PORT=yes caused it to add the openssl port as a build and > run dependency, it was silently getting linked to openssl from base. The > cause of that problem is that the default GSSAPI_BAS

Re: avoiding base openssl when building ports

2015-06-01 Thread Kimmo Paasiala
On Mon, Jun 1, 2015 at 7:17 PM, Benjamin Kaduk wrote: > On Sun, 31 May 2015, Don Lewis wrote: > >> The big culprit turned out to be ftp/curl. Even though >> WITH_OPENSSL_PORT=yes caused it to add the openssl port as a build and >> run dependency, it was silently getting linked to openssl from bas

Re: avoiding base openssl when building ports

2015-06-01 Thread Roger Marquis
Kimmo Paasiala: Rumour is that something like that is going to happen with all of the problematic libraries by making them private. If someone with inside knowledge could confirm these rumours? ;) Curious why this is a rumor? Open source operating systems should be developed transparently, sho

Re: avoiding base openssl when building ports

2015-06-01 Thread Benjamin Kaduk
On Mon, 1 Jun 2015, Roger Marquis wrote: > Kimmo Paasiala: > > Rumour is that something like that is going to happen with all of the > > problematic libraries by making them private. If someone with inside > > knowledge could confirm these rumours? ;) > > Curious why this is a rumor? Open source

Re: avoiding base openssl when building ports

2015-06-01 Thread Julian Elischer
On 6/2/15 12:25 AM, Kimmo Paasiala wrote: On Mon, Jun 1, 2015 at 7:17 PM, Benjamin Kaduk wrote: On Sun, 31 May 2015, Don Lewis wrote: The big culprit turned out to be ftp/curl. Even though WITH_OPENSSL_PORT=yes caused it to add the openssl port as a build and run dependency, it was silently

scope of private libraries

2015-06-01 Thread Benjamin Kaduk
(was Re: avoiding base openssl when building ports) On Mon, 1 Jun 2015, Kimmo Paasiala wrote: > This leads to another question. Where is the line going to be drawn > which libraries in the base system should be private? There are > certainly some of them that have to be public like libc and the >

Re: scope of private libraries

2015-06-01 Thread Franco Fichtner
> On 01 Jun 2015, at 18:42, Benjamin Kaduk wrote: > > (was Re: avoiding base openssl when building ports) > > On Mon, 1 Jun 2015, Kimmo Paasiala wrote: > >> This leads to another question. Where is the line going to be drawn >> which libraries in the base system should be private? There are >>

Re: scope of private libraries

2015-06-01 Thread Benjamin Kaduk
On Mon, 1 Jun 2015, Franco Fichtner wrote: > As a side note, does pkgng really have to depend on base > OpenSSL; does it have to depend on a full-blown SSL library? Yes. -Ben (From IRC:) efnet / #bsddev / bjk 13:17 () In particular, Franco asked "does pkg really need to depend on o

Re: avoiding base openssl when building ports

2015-06-01 Thread Walt Ford via freebsd-security
On Tue, Jun 02, 2015 at 12:44:46AM +0800, Julian Elischer wrote: > I'd like to take a bunch of libraries out of base, But That is not the > same as making them "ports". > I've said before that I thik we need something half way between. using > the ports/pkg mechanism, You could just call them su

Re: base/release/10.1.0/contrib/file vulnerabilities?

2015-06-01 Thread Sevan / Venture37
On 28 April 2015 at 20:48, Mark Felder wrote: > > > On Mon, Apr 27, 2015, at 03:34, Piotr Kubaj wrote: >> Hi, >> >> I wrote about this vulnerability in January: >> https://lists.freebsd.org/pipermail/freebsd-security/2015-January/008115.html >> >> There were only patches for stable. >> > > There i