Date: Mon, 11 Jul 2016 22:56:00 +0300 From: Slawa Olhovchenkov <slw@zxy.spb.ru> To: Jung-uk Kim <jkim@FreeBSD.org> Cc: Andrey Chernov <ache@freebsd.org>, Mathieu Arnold <mat@FreeBSD.org>, FreeBSD-current <freebsd-current@FreeBSD.org>, freebsd-security <freebsd-security@freebsd.org> Subject: Re: GOST in OPENSSL_BASE Message-ID: <20160711195600.GQ46309@zxy.spb.ru> In-Reply-To: <f7bb30d6-6c22-4e21-ff8f-a25480ac0278@FreeBSD.org> References: <20160710133019.GD20831@zxy.spb.ru> <f35c1806-c06d-0d46-1c8a-58a56adef9a7@freebsd.org> <a4f0585d-cc99-e44a-7f59-0dd23e3c969f@FreeBSD.org> <20160711184122.GP46309@zxy.spb.ru> <f7bb30d6-6c22-4e21-ff8f-a25480ac0278@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jul 11, 2016 at 03:00:39PM -0400, Jung-uk Kim wrote:
> On 07/11/16 02:41 PM, Slawa Olhovchenkov wrote:
> > On Mon, Jul 11, 2016 at 02:28:45PM -0400, Jung-uk Kim wrote:
> >
> >> On 07/10/16 10:10 AM, Andrey Chernov wrote:
> >>> On 10.07.2016 16:30, Slawa Olhovchenkov wrote:
> >>>> I am surprised lack of support GOST in openssl-base.
> >>>> Can be this enabled before 11.0 released?
> >>>
> >>> AFAIK openssl maintainers says something like they can't support this
> >>> code and it will become rotten shortly with new changes, so they drop it.
> >>
> >> [OpenSSL-maintainer-for-the-base hat on]
> >>
> >> GOST is supported on FreeBSD 10.x and 11.x. We will not drop it on
> >> these branches unless secteam explicitly ask us to do so. However, we
> >> *may* drop it from 12.0 *iff* we import OpenSSL 1.1.0 branch.
> >>
> >> [OpenSSL-maintainer-for-the-base hat off]
> >>
> >> Jung-uk Kim
> >>
> >
> > Thanks!
> >
> > May be need file PR for dns/bind910?
> >
> > # grep -3 BROK /poudriere/ports/default/dns/bind910/Makefile
> > .include <bsd.port.pre.mk>
> >
> > .if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && ${SSL_DEFAULT} == base
> > BROKEN= OpenSSL from the base system does not support GOST, add \
> > DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything \
> > that needs SSL.
> > .endif
>
> FreeBSD 9.3 is still supported but GOST is not available there. It
Thanks for clarifications.
> seems the ports maintainer didn't want to break it on 9.3 (CC added).
> Version check may be needed there.
Thanks!
> Jung-uk Kim
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160711195600.GQ46309>