Add libreSSL to oe-core?
Should oe-core add libressl as an alternative to openssl and other OE SSL/TLS implementations?
We had a request from a customer to add LibreSSL so I was wondering about the plans of the Yocto community and indeed of the larger Linux distro community.
Libressl claims (aims?) to be a more stable, secure TLS implementation then OpenSSL. It was initially only for OpenBSD but it supports a variety of platforms now:
http://www.libressl.org/releases.html
The CVE history enthusiastically summarized on Wikipedia:
https://en.wikipedia.org/wiki/LibreSSL
does indicate that libressl has been vulnerable to fewer CVEs than openssl so far. I quickly reviewed:
https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations
but perhaps someone on the list has more direct experience, knowledge and/or opinions of implementations of TLS? Note that the libressl devs has stated that they have no interest in FIPS 140-2 certification:
http://marc.info/?l=openbsd-misc&m=139819485423701&w=2
so that could be a problem for some users.
Other than Arch, and openSUSE Factory build, it seems that no major linux distro has added libressl:
http://pkgs.org/search/libressl
An OE libressl recipe is not current indexed:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=libressl
If I search more broadly:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=ssl
I see that the OE community does have recipes for:
gnutls, nss, polarssl (now mbed TLS) and wolfssl.
So what do you think of libressl?
Signature · 2 lines
# Randy MacLeod. SMTS, Linux, Wind River Direct: 613.963.1350 | 350 Terry Fox Drive, Suite 200, Ottawa, ON, Canada, K2K 2W5
Quoted 31 lines · Randy MacLeod
Should oe-core add libressl as an alternative to openssl and other OE SSL/TLS implementations?
We had a request from a customer to add LibreSSL so I was wondering about the plans of the Yocto community and indeed of the larger Linux distro community.
Libressl claims (aims?) to be a more stable, secure TLS implementation then OpenSSL. It was initially only for OpenBSD but it supports a variety of platforms now:
http://www.libressl.org/releases.html
The CVE history enthusiastically summarized on Wikipedia:
https://en.wikipedia.org/wiki/LibreSSL
does indicate that libressl has been vulnerable to fewer CVEs than openssl so far. I quickly reviewed:
https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations
but perhaps someone on the list has more direct experience, knowledge and/or opinions of implementations of TLS? Note that the libressl devs has stated that they have no interest in FIPS 140-2 certification:http://marc.info/?l=openbsd-misc&m=139819485423701&w=2so that could be a problem for some users.
Other than Arch, and openSUSE Factory build, it seems that no major linux distro has added libressl:
http://pkgs.org/search/libresslAn OE libressl recipe is not current indexed:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=libressl
Quoted 7 lines
If I search more broadly:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=sslI see that the OE community does have recipes for:
gnutls, nss, polarssl (now mbed TLS) and wolfssl.So what do you think of libressl?
I don't see a pressing reason to accept this into OE-Core right now. The CVE numbers are bound to be lower for something with less exposure and the fact most mainline distros aren't using it is also a mild contraindication.
Certainly a recipe in meta-oe and someone experimenting with it would be great and I've love to see the feedback and results but I'd be cautious here for the core right now.
Obviously it will be interesting to see if anyone else has strong opinions though too.
Cheers,
Richard
Quoted 25 lines · Richard Purdie
Quoted 23 lines · Randy MacLeod
Should oe-core add libressl as an alternative to openssl and other OE SSL/TLS implementations?
We had a request from a customer to add LibreSSL so I was wondering about the plans of the Yocto community and indeed of the larger Linux distro community.
Libressl claims (aims?) to be a more stable, secure TLS implementation then OpenSSL. It was initially only for OpenBSD but it supports a variety of platforms now:
http://www.libressl.org/releases.html
The CVE history enthusiastically summarized on Wikipedia:
https://en.wikipedia.org/wiki/LibreSSL
does indicate that libressl has been vulnerable to fewer CVEs than openssl so far. I quickly reviewed:
https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations
but perhaps someone on the list has more direct experience, knowledge and/or opinions of implementations of TLS? Note that the libressl devs has stated that they have no interest in FIPS 140-2 certification:http://marc.info/?l=openbsd-misc&m=139819485423701&w=2so that could be a problem for some users.
Quoted 7 lines
Quoted 7 lines
Other than Arch, and openSUSE Factory build, it seems that no major linux distro has added libressl:
http://pkgs.org/search/libresslAn OE libressl recipe is not current indexed:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=libressl
Quoted 3 lines
Quoted 3 lines
If I search more broadly:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=ssl
Quoted 7 lines
Quoted 5 lines
I see that the OE community does have recipes for:
gnutls, nss, polarssl (now mbed TLS) and wolfssl.So what do you think of libressl?
I don't see a pressing reason to accept this into OE-Core right now.
Me neither
The
Quoted 20 lines
CVE numbers are bound to be lower for something with less exposure and the fact most mainline distros aren't using it is also a mild contraindication.
Certainly a recipe in meta-oe and someone experimenting with it would be great and I've love to see the feedback and results but I'd be cautious here for the core right now.
Obviously it will be interesting to see if anyone else has strong opinions though too.
Cheers,
Richard
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 45 lines · Richard Purdie
Quoted 31 lines · Randy MacLeod
Should oe-core add libressl as an alternative to openssl and other OE SSL/TLS implementations?
We had a request from a customer to add LibreSSL so I was wondering about the plans of the Yocto community and indeed of the larger Linux distro community.
Libressl claims (aims?) to be a more stable, secure TLS implementation then OpenSSL. It was initially only for OpenBSD but it supports a variety of platforms now:
http://www.libressl.org/releases.html
The CVE history enthusiastically summarized on Wikipedia:
https://en.wikipedia.org/wiki/LibreSSL
does indicate that libressl has been vulnerable to fewer CVEs than openssl so far. I quickly reviewed:
https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations
but perhaps someone on the list has more direct experience, knowledge and/or opinions of implementations of TLS? Note that the libressl devs has stated that they have no interest in FIPS 140-2 certification:http://marc.info/?l=openbsd-misc&m=139819485423701&w=2so that could be a problem for some users.
Other than Arch, and openSUSE Factory build, it seems that no major linux distro has added libressl:
http://pkgs.org/search/libresslAn OE libressl recipe is not current indexed:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=libressl
Quoted 7 lines
If I search more broadly:
http://layers.openembedded.org/layerindex/branch/master/recipes/?q=sslI see that the OE community does have recipes for:
gnutls, nss, polarssl (now mbed TLS) and wolfssl.So what do you think of libressl?
I don't see a pressing reason to accept this into OE-Core right now. The CVE numbers are bound to be lower for something with less exposure and the fact most mainline distros aren't using it is also a mild contraindication.
Quoted 6 lines
Certainly a recipe in meta-oe and someone experimenting with it would be great and I've love to see the feedback and results but I'd be cautious here for the core right now.
Obviously it will be interesting to see if anyone else has strong opinions though too.
I share this very same view. Adding this to meta-oe seems more logical for now.
Signature · 3 lines
Otavio Salvador O.S. Systems http://www.ossystems.com.br http://code.ossystems.com.br Mobile: +55 (53) 9981-7854 Mobile: +1 (347) 903-9750
Quoted 3 lines · Otavio Salvador
Quoted 1 line · Richard Purdie
On Mon, 2015-05-04 at 14:45 -0400, Randy MacLeod wrote:
...
Quoted 9 lines
Quoted 6 lines
Certainly a recipe in meta-oe and someone experimenting with it would be great and I've love to see the feedback and results but I'd be cautious here for the core right now.
Obviously it will be interesting to see if anyone else has strong opinions though too.
I share this very same view. Adding this to meta-oe seems more logical for now.
Thanks for the comments. That's my opinion as well so we'll consider adding libressl to meta-oe but given what I've learned so far, it's a low priority.
Signature · 2 lines
# Randy MacLeod. SMTS, Linux, Wind River Direct: 613.963.1350 | 350 Terry Fox Drive, Suite 200, Ottawa, ON, Canada, K2K 2W5