Change libraries XBPS depends on #323
Comments
ericonr
changed the title
ericonr
changed the title
|
I vote BearSSL, as well as dropping libarchive. Both have deeper than desirable bootstrapping chains in the chroot- set. |
|
I also support BearSSL. |
|
Not sure what happened there, I lost the tab, most of my message, and the ticket closed. It wasn't important. |
|
Would moving to separate backends for @sgn Since |
|
It makes for a bigger bootstrapping/dependency chain, but another option includes using https://skarnet.org/software/s6-networking together with BearSSL. Some of the code, like for cert directories, will have to be present in XBPS, and I don't think depending on another library for some of it would be too bad (I might not have thought of all the potential issues). Otherwise, it has some interesting code we can duplicate for interacting with things like certs. |
|
If we don't have bsdtar in the base chroot, we will have to touch quite a few templates again to either add bsdtar to hostdepends or switch (back) to tar and add that, and fix the common/ scripts which handle archives. |
I don't think it needs to be. It's a small dependency that sits above all the other archive libraries, that we'd need anyway if we were to switch to GNU One reason we'd switch from |
|
I'm facing this problem in #324: earlephilhower/bearssl-esp8266@0c27e41 BearSSL apparently can't natively decode an RSA key as stored in a PEM file. Using a program like below: #include <stdio.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <bearssl.h>
void dummy(void *dest_ctx, const void *src, size_t len)
{
br_x509_decoder_context *dest = dest_ctx;
br_x509_decoder_push(dest, src, len);
}
int main(int argc, char **argv)
{
if (argc < 2) {
fputs("too few arguments", stderr);
return 1;
}
int key_file = open(argv[1], O_RDONLY);
if (key_file < 0) {
fprintf(stderr, "error opening %s: %m\n", argv[1]);
return 1;
}
unsigned char *buffer = mmap(NULL, 800, PROT_READ, MAP_PRIVATE, key_file, 0);
if(buffer == NULL) {
fputs("mmap error", stderr);
return 1;
}
close(key_file);
br_pem_decoder_context pem;
br_x509_decoder_context x509;
br_pem_decoder_init(&pem);
br_x509_decoder_init(&x509, 0, 0);
br_pem_decoder_setdest(&pem, dummy, &x509);
size_t len = 800;
while (len > 0) {
size_t pushed = br_pem_decoder_push(&pem, buffer, len);
printf("pushed %lu bytes\n", pushed);
buffer += pushed;
len -= pushed;
switch(br_pem_decoder_event(&pem)) {
const char *name;
case 0:
break;
case BR_PEM_BEGIN_OBJ:
name = br_pem_decoder_name(&pem);
puts(name);
break;
case BR_PEM_ERROR:
fputs("br_pem_error!", stderr);
break;
case BR_PEM_END_OBJ:
if (len != 0) {
fputs("didn't finish file", stderr);
} else {
fputs("finished file!", stderr);
}
break;
}
}
fprintf(stderr, "err code: %d\n", br_x509_decoder_last_error(&x509));
}on the following key, which is what LibreSSL decodes for us in the yields an error code of |
|
Also, BearSSL apparently doesn't do TSL 1.3, according to the front page. |
I don't support moving to BearSSL. It might be better code, it might be a better API, but when it comes to an SSL library, it's more important that it's hard to break, this leaves two primary options:
|
|
I have to agree with @ArsenArsen here. XBPS, being a critical system component, should not rely on a relatively little-known and beta-quality (according to its front page) TLS/crypto library. |
It only really needs GNU Make and a C99 toolchain to get a functional library. Python and Perl are required for generating and running tests, but it is fairly straightforward to disable them. See here: void-linux/void-packages#25033 |
|
We are planning on using xbps on a system we are working on, and I was looking into compatibility between Open- and LibreSSL in various software packages, and OpenSSL (unsurprisingly) requires a lot less patching, so I looked into whether xbps compiles with OpenSSL 1.1.1g, and bfad1af ( I am not sure whether the benefits of OpenBSDs rigorous development process outweigh the downsides of it not being OpenSSL itself anymore. EDIT: reconfigured and rebuilt xbps on master to run the tests, got these results: |
Moving XBPS off of LibreSSL (or even OpenSSL, depending on the resolution here) is an interesting change, for reasons of API simplicity, bootstrapping, and others. Some potential options are BearSSL and mbedtls. Custom signing and verification code might need to be added as well.
Moving off of libarchive has also been brought up, but I don't believe there have been specific suggestions for libraries. We would probably need at least xz and zstd support. As a bonus, we could find a threaded compression and decompression library.
The text was updated successfully, but these errors were encountered: