Test against the LibreSSL fork of OpenSSL?

[public]

http://www.libressl.org/

http://opensslrampage.org/

[Ayrx]

Probably a little bit premature to be even thinking about it given that the fork only happened a few days ago and no indication on how compatible it will be with the upstream OpenSSL imo.

[public]

Waiting until it's at least in an actual OpenBSD elease makes sense. I was
mostly opening this as a placeholder :-)

[koobs]

Adding end user reported build failure of py-cryptography on FreeBSD, with LibreSSL from ports, in case it helps get the ball rolling

http://dpaste.com/23R20GY.txt

[alex]

So, first thing I spot is that all the TLS compression stuff is removed.

On Sat Dec 20 2014 at 3:43:17 AM Kubilay Kocak [email protected]
wrote:

Adding end user reported build failure of py-cryptography on FreeBSD, with
LibreSSL from ports, in case it helps get the ball rolling

http://dpaste.com/23R20GY.txt

—
Reply to this email directly or view it on GitHub
#928 (comment).

[reaperhulk]

With the assistance of @Sp1l we've gotten libre building and running tests. To support this properly I think we're ultimately going to need to fork the openssl backend. This has advantages (we can remove a huge amount of feature detection for old versions of OpenSSL) and disadvantages (there will be significant code duplication). The two major changes are:

• No CMS support. It's disabled by default.
• No dynamic engine support. This means we can't use the osrandom engine. Fortunately Libre has replaced the OpenSSL CSPRNG with https://github.com/libressl-portable/openbsd/blob/254bf1008ab19bfdb5cab99373b39c8002bbcab1/src/lib/libssl/src/crypto/rand/rand_lib.c#L86 (and it reseeds on fork automatically provided the child PID is different). It appears that portable LibreSSL will rely on the underlying OS's arc4random implementation, so if the OS still uses RC4 that's unfortunate.

[Sp1l]

Just submitted https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=196827 to FreeBSD ports.
2. Removes EGD (Perl Entropy Gathering Daemon) support. This hasn't been needed on FreeBSD since FreeBSD 4.2
3. Disable compression conditionally using OPENSSL_NO_COMP
4. Check features, not version for x509_vfy
Seems to be working fine for me! Thanks to https://github.com/gentoo/libressl/tree/master/dev-python/cryptography

[reaperhulk]

We do this now.