<p dir="ltr"><br>
On May 5, 2015 12:52 PM, "Richard Purdie" <<a href="mailto:richard.purdie@linuxfoundation.org">richard.purdie@linuxfoundation.org</a>> wrote:<br>
><br>
> On Mon, 2015-05-04 at 14:45 -0400, Randy MacLeod wrote:<br>
> > Should oe-core add libressl as an alternative to openssl and other<br>
> > OE SSL/TLS implementations?<br>
> ><br>
> > We had a request from a customer to add LibreSSL so I was wondering<br>
> > about the plans of the Yocto community and indeed of the larger Linux<br>
> > distro community.<br>
> ><br>
> > Libressl claims (aims?) to be a more stable, secure TLS implementation<br>
> > then OpenSSL. It was initially only for OpenBSD but it supports a<br>
> > variety of platforms now:<br>
> > <a href="http://www.libressl.org/releases.html">http://www.libressl.org/releases.html</a><br>
> > The CVE history enthusiastically summarized on Wikipedia:<br>
> > <a href="https://en.wikipedia.org/wiki/LibreSSL">https://en.wikipedia.org/wiki/LibreSSL</a><br>
> > does indicate that libressl has been vulnerable to fewer CVEs than<br>
> > openssl so far. I quickly reviewed:<br>
> > <a href="https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations">https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations</a><br>
> > but perhaps someone on the list has more direct experience, knowledge<br>
> > and/or opinions of implementations of TLS? Note that the libressl devs<br>
> > has stated that they have no interest in FIPS 140-2 certification:<br>
> > <a href="http://marc.info/?l=openbsd-misc&m=139819485423701&w=2">http://marc.info/?l=openbsd-misc&m=139819485423701&w=2</a><br>
> > so that could be a problem for some users.<br>
> ><br>
> ><br>
> > Other than Arch, and openSUSE Factory build, it seems that no<br>
> > major linux distro has added libressl:<br>
> > <a href="http://pkgs.org/search/libressl">http://pkgs.org/search/libressl</a><br>
> ><br>
> > An OE libressl recipe is not current indexed:<br>
> ><br>
> > <a href="http://layers.openembedded.org/layerindex/branch/master/recipes/?q=libressl">http://layers.openembedded.org/layerindex/branch/master/recipes/?q=libressl</a><br>
> ><br>
> > If I search more broadly:<br>
> > <a href="http://layers.openembedded.org/layerindex/branch/master/recipes/?q=ssl">http://layers.openembedded.org/layerindex/branch/master/recipes/?q=ssl</a><br>
> ><br>
> > I see that the OE community does have recipes for:<br>
> > gnutls, nss, polarssl (now mbed TLS) and wolfssl.<br>
> ><br>
> > So what do you think of libressl?<br>
><br>
> I don't see a pressing reason to accept this into OE-Core right now. </p>
<p dir="ltr">Me neither</p>
<p dir="ltr">The<br>
> CVE numbers are bound to be lower for something with less exposure and<br>
> the fact most mainline distros aren't using it is also a mild<br>
> contraindication.<br>
><br>
> Certainly a recipe in meta-oe and someone experimenting with it would be<br>
> great and I've love to see the feedback and results but I'd be cautious<br>
> here for the core right now.<br>
><br>
> Obviously it will be interesting to see if anyone else has strong<br>
> opinions though too.<br>
><br>
> Cheers,<br>
><br>
> Richard<br>
><br>
> --<br>
> _______________________________________________<br>
> Openembedded-core mailing list<br>
> <a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a><br>
> <a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</p>