libcurl: Allow selection of TLS package libcurl will use

PATCH Superseded Trent Piepho 3 participants 6 messages Nov 8, 2018 – Nov 12, 2018

Share & tools

Trent Piepho

author

2018-11-08 22:25 UTC #0 lore raw

PATCH v2 1/1 libcurl: Allow selection of TLS package libcurl will use

Instead of defaulting to OpenSSL, allow selection of package to use through a choice in libcurl's config. The default will be to select the first enabled TLS provider in the same preference order as is used now, i.e. no change from current behavior.

Some of the alternative libraries have advantages over OpenSSL in certain areas.

For example, gnutls has vastly superior PKCS11 support. One can use client TLS private keys by supplying a PKCS11 URI instead of a private key file name. The TLS server cert trust store can be a PKCS11 URI, e.g. configure libcurl with a ca-bundle of "pkcs11:model=p11-kit-trust". Now server certs can be stored in a software and/or hardware HSM(s). This doesn't work with OpenSSL.

However, some software only supports OpenSSL for TLS or other crypto functions. So it might be necessary to enable OpenSSL for that reason.

Signed-off-by Trent Piepho <[email protected]>

---
Changes since v1:
Removed unneeded defaults.
Removed no TLS choice, replaced with comment

 package/libcurl/Config.in  | 25 +++++++++++++++++++++++++
 package/libcurl/libcurl.mk | 15 ++++++++-------
 2 files changed, 33 insertions(+), 7 deletions(-)

package/libcurl/Config.in +25 -0

index 21c2ee2b7f..6309e5bfc0 100644
@@ -19,4 +19,29 @@ config BR2_PACKAGE_LIBCURL_VERBOSE
 	help
 	  Enable verbose text strings
 
+choice
+	prompt "SSL/TLS library to use"
+
+config BR2_PACKAGE_LIBCURL_OPENSSL
+	bool "OpenSSL"
+	depends on BR2_PACKAGE_OPENSSL
+
+config BR2_PACKAGE_LIBCURL_GNUTLS
+	bool "GnuTLS"
+	depends on BR2_PACKAGE_GNUTLS
+
+config BR2_PACKAGE_LIBCURL_LIBNSS
+	bool "NSS"
+	depends on BR2_PACKAGE_LIBNSS
+
+config BR2_PACKAGE_LIBCURL_MBEDTLS
+	bool "mbed TLS"
+	depends on BR2_PACKAGE_MBEDTLS
+
+endchoice
+
+comment "A TLS library is needed for SSL/TLS support"
+       depends on !BR2_PACKAGE_OPENSSL && !BR2_PACKAGE_GNUTLS && \
+                  !BR2_PACKAGE_LIBNSS && !BR2_PACKAGE_MBEDTLS
+
 endif

package/libcurl/libcurl.mk +8 -7

index c3da8aa3e5..ac368fbb53 100644
@@ -35,7 +35,7 @@ endif
 
 LIBCURL_CONFIG_SCRIPTS = curl-config
 
-ifeq ($(BR2_PACKAGE_OPENSSL),y)
+ifeq ($(BR2_PACKAGE_LIBCURL_OPENSSL),y)
 LIBCURL_DEPENDENCIES += openssl
 # configure adds the cross openssl dir to LD_LIBRARY_PATH which screws up
 # native stuff during the rest of configure when target == host.

@@ -44,15 +44,16 @@ LIBCURL_DEPENDENCIES += openssl
 LIBCURL_CONF_ENV += LD_LIBRARY_PATH=$(if $(LD_LIBRARY_PATH),$(LD_LIBRARY_PATH):)/lib:/usr/lib
 LIBCURL_CONF_OPTS += --with-ssl=$(STAGING_DIR)/usr \
 	--with-ca-path=/etc/ssl/certs
-else ifeq ($(BR2_PACKAGE_GNUTLS),y)
-LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_GNUTLS),y)
+LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr --without-ssl
 LIBCURL_DEPENDENCIES += gnutls
-else ifeq ($(BR2_PACKAGE_LIBNSS),y)
-LIBCURL_CONF_OPTS += --with-nss=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_LIBNSS),y)
+LIBCURL_CONF_OPTS += --with-nss=$(STAGING_DIR)/usr --without-ssl --without-gnutls
 LIBCURL_CONF_ENV += CPPFLAGS="$(TARGET_CPPFLAGS) `$(PKG_CONFIG_HOST_BINARY) nspr nss --cflags`"
 LIBCURL_DEPENDENCIES += libnss
-else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
-LIBCURL_CONF_OPTS += --with-mbedtls=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_MBEDTLS),y)
+LIBCURL_CONF_OPTS += --with-mbedtls=$(STAGING_DIR)/usr \
+	--without-ssl --without-gnutls --without-nss
 LIBCURL_DEPENDENCIES += mbedtls
 else
 LIBCURL_CONF_OPTS += --without-ssl --without-gnutls \

Signature · 1 line

2.14.4

Arnout Vandecappelle

2018-11-09 21:56 UTC #1 lore raw

PATCH v2 1/1 libcurl: Allow selection of TLS package libcurl will use

Hi Trent,

Quoted 15 lines · Trent Piepho

Instead of defaulting to OpenSSL, allow selection of package to use through a choice in libcurl's config. The default will be to select the first enabled TLS provider in the same preference order as is used now, i.e. no change from current behavior.
Some of the alternative libraries have advantages over OpenSSL in certain areas.
For example, gnutls has vastly superior PKCS11 support. One can use client TLS private keys by supplying a PKCS11 URI instead of a private key file name. The TLS server cert trust store can be a PKCS11 URI, e.g. configure libcurl with a ca-bundle of "pkcs11:model=p11-kit-trust". Now server certs can be stored in a software and/or hardware HSM(s). This doesn't work with OpenSSL.

Quoted 2 lines

However, some software only supports OpenSSL for TLS or other crypto functions. So it might be necessary to enable OpenSSL for that reason.

As Peter already said: excellent explanation, thanks!

Quoted 16 lines

Signed-off-by Trent Piepho <[email protected]>
---
Changes since v1:
Removed unneeded defaults.
Removed no TLS choice, replaced with comment
 package/libcurl/Config.in  | 25 +++++++++++++++++++++++++
 package/libcurl/libcurl.mk | 15 ++++++++-------
 2 files changed, 33 insertions(+), 7 deletions(-)
package/libcurl/Config.in +0 -0
index 21c2ee2b7f..6309e5bfc0 100644

package/libcurl/Config.in config BR2_PACKAGE_LIBCURL_VERBOSE · line 27

Quoted 9 lines

package/libcurl/Config.in +6 -0

@@ -19,4 +19,29 @@ config BR2_PACKAGE_LIBCURL_VERBOSE
 	help
 	  Enable verbose text strings
 
+choice
+	prompt "SSL/TLS library to use"
+
+config BR2_PACKAGE_LIBCURL_OPENSSL
+	bool "OpenSSL"
+	depends on BR2_PACKAGE_OPENSSL

I don't really like this depends. I would rather revert it into a select. So:

choice
prompt "SSL/TLS library to use"

config BR2_PACKAGE_LIBCURL_OPENSSL
bool "openssl"
select BR2_PACKAGE_OPENSSL

...

config BR2_PACKAGE_LIBCURL_NONE
bool "disable TLS"

endchoice

Note that that means that libcurl will by default select openssl, which was not
the case before. However, I think it makes complete sense to default to enabling TLS support in libcurl. Peter, what do you think? This would obviously have to be mentioned in the release notes because the behaviour of existing configs would change.

Regards,
Arnout

Quoted 57 lines

package/libcurl/Config.in +19 -0

+
+config BR2_PACKAGE_LIBCURL_GNUTLS
+	bool "GnuTLS"
+	depends on BR2_PACKAGE_GNUTLS
+
+config BR2_PACKAGE_LIBCURL_LIBNSS
+	bool "NSS"
+	depends on BR2_PACKAGE_LIBNSS
+
+config BR2_PACKAGE_LIBCURL_MBEDTLS
+	bool "mbed TLS"
+	depends on BR2_PACKAGE_MBEDTLS
+
+endchoice
+
+comment "A TLS library is needed for SSL/TLS support"
+       depends on !BR2_PACKAGE_OPENSSL && !BR2_PACKAGE_GNUTLS && \
+                  !BR2_PACKAGE_LIBNSS && !BR2_PACKAGE_MBEDTLS
+
 endif

package/libcurl/libcurl.mk +8 -7

index c3da8aa3e5..ac368fbb53 100644
@@ -35,7 +35,7 @@ endif
 
 LIBCURL_CONFIG_SCRIPTS = curl-config
 
-ifeq ($(BR2_PACKAGE_OPENSSL),y)
+ifeq ($(BR2_PACKAGE_LIBCURL_OPENSSL),y)
 LIBCURL_DEPENDENCIES += openssl
 # configure adds the cross openssl dir to LD_LIBRARY_PATH which screws up
 # native stuff during the rest of configure when target == host.

@@ -44,15 +44,16 @@ LIBCURL_DEPENDENCIES += openssl
 LIBCURL_CONF_ENV += LD_LIBRARY_PATH=$(if $(LD_LIBRARY_PATH),$(LD_LIBRARY_PATH):)/lib:/usr/lib
 LIBCURL_CONF_OPTS += --with-ssl=$(STAGING_DIR)/usr \
 	--with-ca-path=/etc/ssl/certs
-else ifeq ($(BR2_PACKAGE_GNUTLS),y)
-LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_GNUTLS),y)
+LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr --without-ssl
 LIBCURL_DEPENDENCIES += gnutls
-else ifeq ($(BR2_PACKAGE_LIBNSS),y)
-LIBCURL_CONF_OPTS += --with-nss=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_LIBNSS),y)
+LIBCURL_CONF_OPTS += --with-nss=$(STAGING_DIR)/usr --without-ssl --without-gnutls
 LIBCURL_CONF_ENV += CPPFLAGS="$(TARGET_CPPFLAGS) `$(PKG_CONFIG_HOST_BINARY) nspr nss --cflags`"
 LIBCURL_DEPENDENCIES += libnss
-else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
-LIBCURL_CONF_OPTS += --with-mbedtls=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_MBEDTLS),y)
+LIBCURL_CONF_OPTS += --with-mbedtls=$(STAGING_DIR)/usr \
+	--without-ssl --without-gnutls --without-nss
 LIBCURL_DEPENDENCIES += mbedtls
 else
 LIBCURL_CONF_OPTS += --without-ssl --without-gnutls \

Peter Korsgaard

2018-11-09 22:40 UTC #2 lore raw

PATCH v2 1/1 libcurl: Allow selection of TLS package libcurl will use

Quoted 1 line

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Arnout" == Arnout Vandecappelle <[email protected]> writes:

Hi,

Quoted 21 lines

package/libcurl/Config.in config BR2_PACKAGE_LIBCURL_VERBOSE · line 27
Quoted 6 lines
package/libcurl/Config.in +6 -0
+choice
+	prompt "SSL/TLS library to use"
+
+config BR2_PACKAGE_LIBCURL_OPENSSL
+	bool "OpenSSL"
+	depends on BR2_PACKAGE_OPENSSL
I don't really like this depends. I would rather revert it into a select. So:
choice
prompt "SSL/TLS library to use"
config BR2_PACKAGE_LIBCURL_OPENSSL
bool "openssl"
select BR2_PACKAGE_OPENSSL
...
config BR2_PACKAGE_LIBCURL_NONE
bool "disable TLS"

Quoted 7 lines

endchoice
Note that that means that libcurl will by default select openssl, which was not
the case before. However, I think it makes complete sense to default to enabling TLS support in libcurl. Peter, what do you think? This would obviously have to be mentioned in the release notes because the behaviour of existing configs would change.

Either that or add a:

 depends on BR2_PACKAGE_OPENSSL || BR2_PACKAGE_GNUTLS || \
          BR2_PACKAGE_LIBNSS || BR2_PACKAGE_MBEDTLS

To the choice option and drop the _LIBCURL_NONE variant. With that we have the same behaviour as before, except that you _CAN_ select the TLS provider in case multiple providers are available.

Signature · 1 line

Bye, Peter Korsgaard

Trent Piepho

author

2018-11-09 22:53 UTC #3 lore raw

PATCH v2 1/1 libcurl: Allow selection of TLS package libcurl will use

Quoted 22 lines · Peter Korsgaard

Quoted 21 lines
package/libcurl/Config.in config BR2_PACKAGE_LIBCURL_VERBOSE · line 27
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Arnout" == Arnout Vandecappelle <[email protected]> writes:
package/libcurl/Config.in +6 -0
+choice
+	prompt "SSL/TLS library to use"
+
+config BR2_PACKAGE_LIBCURL_OPENSSL
+	bool "OpenSSL"
+	depends on BR2_PACKAGE_OPENSSL
I don't really like this depends. I would rather revert it into a select. So:
choice
prompt "SSL/TLS library to use"
config BR2_PACKAGE_LIBCURL_OPENSSL
bool "openssl"
select BR2_PACKAGE_OPENSSL
...
config BR2_PACKAGE_LIBCURL_NONE
bool "disable TLS"

Quoted 7 lines

Quoted 7 lines
endchoice
Note that that means that libcurl will by default select openssl, which was not
the case before. However, I think it makes complete sense to default to enabling TLS support in libcurl. Peter, what do you think? This would obviously have to be mentioned in the release notes because the behaviour of existing configs would change.

Don't most optional features in buildroot get auto-enabled when the package they need is enabled? Which in effect means the feature is turned on, not by a setting under the user, but by turning on the dependency. I know I've seen this pattern many many times in buildroot.

Is this pattern of turning on the dependency via an option under the user of the dependency used elsewhere? Or would it be a new pattern unique to libcurl?

Quoted 8 lines

Either that or add a:
 depends on BR2_PACKAGE_OPENSSL || BR2_PACKAGE_GNUTLS || \
          BR2_PACKAGE_LIBNSS || BR2_PACKAGE_MBEDTLS
To the choice option and drop the _LIBCURL_NONE variant. With that we have the same behaviour as before, except that you _CAN_ select the TLS provider in case multiple providers are available.

I did drop the NONE variant. Do you mean in Arnout's alternate example? It doesn't provide entirely the same behavior. Example:

openssl off, gnutls on

Current: libcurl uses gnutls
My patch: libcurl uses gnutls
Arnout's proposal: libcurl enables openssl and uses it. Need to change config to select gnutls and turn off openssl.
Peter's modification: Same as Arnout's

I believe your modification only produces the same behavior in the case where all four tls libs are off. As soon as one turns on, then libcurl will select openssl.

Peter Korsgaard

2018-11-09 23:15 UTC #4 lore raw

PATCH v2 1/1 libcurl: Allow selection of TLS package libcurl will use

Quoted 1 line

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Trent" == Trent Piepho <[email protected]> writes:

Hi,

Quoted 12 lines

Quoted 5 lines
Quoted 5 lines
Note that that means that libcurl will by default select openssl, which was not
the case before. However, I think it makes complete sense to default to enabling TLS support in libcurl. Peter, what do you think? This would obviously have to be mentioned in the release notes because the behaviour of existing configs would change.
Don't most optional features in buildroot get auto-enabled when the package they need is enabled? Which in effect means the feature is turned on, not by a setting under the user, but by turning on the dependency. I know I've seen this pattern many many times in buildroot.

Quoted 3 lines

Is this pattern of turning on the dependency via an option under the user of the dependency used elsewhere? Or would it be a new pattern unique to libcurl?

We use automatic dependencies for most packages, but there are a few with explicit sub options to pull in the optional dependencies.

Quoted 20 lines

Quoted 8 lines
Either that or add a:
depends on BR2_PACKAGE_OPENSSL || BR2_PACKAGE_GNUTLS || \
BR2_PACKAGE_LIBNSS || BR2_PACKAGE_MBEDTLS
To the choice option and drop the _LIBCURL_NONE variant. With that we have the same behaviour as before, except that you _CAN_ select the TLS provider in case multiple providers are available.
I did drop the NONE variant. Do you mean in Arnout's alternate example? It doesn't provide entirely the same behavior. Example:
openssl off, gnutls on
Current: libcurl uses gnutls
My patch: libcurl uses gnutls
Arnout's proposal: libcurl enables openssl and uses it. Need to change config to select gnutls and turn off openssl.
Peter's modification: Same as Arnout's

Quoted 3 lines

I believe your modification only produces the same behavior in the case where all four tls libs are off. As soon as one turns on, then libcurl will select openssl.

Correct, so I think it makes sense to use 'depends on' for the individual sub options like you had. With that, the default behaviour should be like it was before.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

2018-11-12 21:20 UTC #5 lore raw

PATCH v2 1/1 libcurl: Allow selection of TLS package libcurl will use

In reply to Trent Piepho

Quoted 35 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Trent" == Trent Piepho <[email protected]> writes:
Instead of defaulting to OpenSSL, allow selection of package to use through a choice in libcurl's config. The default will be to select the first enabled TLS provider in the same preference order as is used now, i.e. no change from current behavior.
Some of the alternative libraries have advantages over OpenSSL in certain areas.
For example, gnutls has vastly superior PKCS11 support. One can use client TLS private keys by supplying a PKCS11 URI instead of a private key file name. The TLS server cert trust store can be a PKCS11 URI, e.g. configure libcurl with a ca-bundle of "pkcs11:model=p11-kit-trust". Now server certs can be stored in a software and/or hardware HSM(s). This doesn't work with OpenSSL.
However, some software only supports OpenSSL for TLS or other crypto functions. So it might be necessary to enable OpenSSL for that reason.
Signed-off-by Trent Piepho <[email protected]>
---
Changes since v1:
Removed unneeded defaults.
Removed no TLS choice, replaced with comment
 package/libcurl/Config.in  | 25 +++++++++++++++++++++++++
 package/libcurl/libcurl.mk | 15 ++++++++-------
 2 files changed, 33 insertions(+), 7 deletions(-)
package/libcurl/Config.in +0 -0
index 21c2ee2b7f..6309e5bfc0 100644

package/libcurl/Config.in config BR2_PACKAGE_LIBCURL_VERBOSE · line 23

Quoted 5 lines

package/libcurl/Config.in +2 -0

@@ -19,4 +19,29 @@ config BR2_PACKAGE_LIBCURL_VERBOSE
 	help
 	  Enable verbose text strings
 
+choice
+	prompt "SSL/TLS library to use"

This choice should be hidden if none of the dependencies are available. As we also need (the inverse of) the same for the comment below I have added a blind BR2_PACKAGE_LIBCURL_TLS_SUPPORT option when depends on openssl/gnutls/libnss/mbedtls and used it here and for the comment.

Quoted 38 lines

package/libcurl/Config.in +23 -0

+
+config BR2_PACKAGE_LIBCURL_OPENSSL
+	bool "OpenSSL"
+	depends on BR2_PACKAGE_OPENSSL
+
+config BR2_PACKAGE_LIBCURL_GNUTLS
+	bool "GnuTLS"
+	depends on BR2_PACKAGE_GNUTLS
+
+config BR2_PACKAGE_LIBCURL_LIBNSS
+	bool "NSS"
+	depends on BR2_PACKAGE_LIBNSS
+
+config BR2_PACKAGE_LIBCURL_MBEDTLS
+	bool "mbed TLS"
+	depends on BR2_PACKAGE_MBEDTLS
+
+endchoice
+
+comment "A TLS library is needed for SSL/TLS support"
+       depends on !BR2_PACKAGE_OPENSSL && !BR2_PACKAGE_GNUTLS && \
+                  !BR2_PACKAGE_LIBNSS && !BR2_PACKAGE_MBEDTLS
+
 endif

package/libcurl/libcurl.mk +1 -1

index c3da8aa3e5..ac368fbb53 100644
@@ -35,7 +35,7 @@ endif
 
 LIBCURL_CONFIG_SCRIPTS = curl-config
 
-ifeq ($(BR2_PACKAGE_OPENSSL),y)
+ifeq ($(BR2_PACKAGE_LIBCURL_OPENSSL),y)
 LIBCURL_DEPENDENCIES += openssl
 # configure adds the cross openssl dir to LD_LIBRARY_PATH which screws up
 # native stuff during the rest of configure when target == host.

package/libcurl/libcurl.mk LIBCURL_DEPENDENCIES += openssl · line 46

Quoted 3 lines

package/libcurl/libcurl.mk +0 -0

@@ -44,15 +44,16 @@ LIBCURL_DEPENDENCIES += openssl
 LIBCURL_CONF_ENV += LD_LIBRARY_PATH=$(if $(LD_LIBRARY_PATH),$(LD_LIBRARY_PATH):)/lib:/usr/lib
 LIBCURL_CONF_OPTS += --with-ssl=$(STAGING_DIR)/usr \
 	--with-ca-path=/etc/ssl/certs

I think it is cleaner to handle each option on its own instead of ifeg .. else ifeq .. else ifeq now that Config.in ensures only one of them is available. That way we also ensure we pass all the correct --without options so the configure script doesn't decide to use another TLS provider than what is selected.

E.G.:

ifeq ($(BR2_PACKAGE_LIBCURL_FOO))
LIBCURL_CONF_OPTS += --with-foo
LIBCURL_DEPENDENCIES += foo
else
LIBCURL_CONF_OPTS += --without-foo
endif

ifeq ($(BR2_PACKAGE_LIBCURL_BAR))
LIBCURL_CONF_OPTS += --with-bar
LIBCURL_DEPENDENCIES += bar
else
LIBCURL_CONF_OPTS += --without-bar
endif

Quoted 9 lines

package/libcurl/libcurl.mk +4 -4

-else ifeq ($(BR2_PACKAGE_GNUTLS),y)
-LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_GNUTLS),y)
+LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr --without-ssl
 LIBCURL_DEPENDENCIES += gnutls
-else ifeq ($(BR2_PACKAGE_LIBNSS),y)
-LIBCURL_CONF_OPTS += --with-nss=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_LIBNSS),y)
+LIBCURL_CONF_OPTS += --with-nss=$(STAGING_DIR)/usr --without-ssl --without-gnutls

package/libcurl/libcurl.mk LIBCURL_DEPENDENCIES += openssl · line 59

Quoted 10 lines

package/libcurl/libcurl.mk +3 -2

 LIBCURL_CONF_ENV += CPPFLAGS="$(TARGET_CPPFLAGS) `$(PKG_CONFIG_HOST_BINARY) nspr nss --cflags`"
 LIBCURL_DEPENDENCIES += libnss
-else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
-LIBCURL_CONF_OPTS += --with-mbedtls=$(STAGING_DIR)/usr
+else ifeq ($(BR2_PACKAGE_LIBCURL_MBEDTLS),y)
+LIBCURL_CONF_OPTS += --with-mbedtls=$(STAGING_DIR)/usr \
+	--without-ssl --without-gnutls --without-nss
 LIBCURL_DEPENDENCIES += mbedtls
 else
 LIBCURL_CONF_OPTS += --without-ssl --without-gnutls \

There was still a place where BR2_PACKAGE_OPENSSL was checked (for the .pc fixup) instead of BR2_PACKAGE_LIBCURL_OPENSSL.

Committed to next with these fixes, thanks.

Signature · 1 line

Bye, Peter Korsgaard