From owner-freebsd-security@FreeBSD.ORG Fri Oct 13 16:21:20 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7CE7D16A500 for ; Fri, 13 Oct 2006 16:21:20 +0000 (UTC) (envelope-from marquis@roble.com) Received: from mx5.roble.com (mx5.roble.com [206.40.34.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3F3B343D46 for ; Fri, 13 Oct 2006 16:21:20 +0000 (GMT) (envelope-from marquis@roble.com) Date: Fri, 13 Oct 2006 09:21:19 -0700 (PDT) From: Roger Marquis To: freebsd-security@freebsd.org In-Reply-To: <20061013120059.8232C16A5F6@hub.freebsd.org> Message-ID: <20061013090533.C51590@ubfganzr> References: <20061013120059.8232C16A5F6@hub.freebsd.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: Re: I cannot upgrade openssl-stablr X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Oct 2006 16:21:20 -0000 Dirk Meyer wrote: >> Try adding OPENSSL_OVERWRITE_BASE=yes into your /etc/make.conf >> file, and try again. You can also define that variable at build >> time, but having it in make.conf keeps it there for future >> reference. > > OPENSSL_OVERWRITE_BASE=yes sould be used with extreme caution! I disagree, never having had a problem with OPENSSL_OVERWRITE_BASE. > This might break your base application in cases like this, when > the base uses a diffrent api as the ports does. That would be a version mis-match, not really related to overwriting the base port. Indeed if you install openssl without OPENSSL_OVERWRITE_BASE you will have two different versions on your your system, which is much more of a sysadmin headache than an easily diagnosed version mismatch. For the same reason I recommend OPENSSH_OVERWRITE_BASE, NO_MAILWRAPPER, NO_SENDMAIL, NO_OPENSSH, NO_OPENSSL, NO_BIND, and PORT_REPLACES_BASE_BIND8 or PORT_REPLACES_BASE_BIND9 as well. OPENSSL_OVERWRITE_BASE should be the default, but consider adding WITH_OPENSSL_097 to prevent automatic incompatible version upgrades. Most of the sites I consult with have stuck with the 0.9.7 branch for compatibility reasons. Is it still the case that 'make *world' cannot parse OPENSSL_OVERWRITE_BASE and requires NO_OPENSSL instead? -- Roger Marquis Roble Systems Consulting http://www.roble.com/