Re: [gentoo-dev] [RFC] LibreSSL, introduce virtual/openssl

[hasufell]

Anthony G. Basile:
> On 01/23/15 00:56, Michał Górny wrote:
>> Dnia 2015-01-23, o godz. 01:51:24
>> hasufell <hasufell@g.o> napisał(a):
>>
>>> Regarding the last libav discussion I think we should also go with a
>>> "libressl" USE flag instead of creating a virtual that makes handling
>>> SUBSLOTs impossible.
>> If libressl and openssl would have matching ABIs, that wouldn't be
>> necessary and you could what virtual/libudev does, i.e. explicit
>> subslot deps.
>>
> *if*  I'm not sure they will even though that's the plan.  If you look
> in the libressl overlay, you'll see lots of patches to make big ticket
> items like apache play nice with libressl.  These patches involve things
> like
>
> +#ifndef HAVE_SSL_CTX_USE_CERTIFICATE_CHAIN
>        int SSL_CTX_use_certificate_chain(SSL_CTX *, char *, int,
> pem_password_cb *);
> +#else
> +    int _SSL_CTX_use_certificate_chain(SSL_CTX *, char *, int,
> pem_password_cb *);
> +#endif
>
> which points to the differences in functions are being exported by the
> two.   This makes me lean towards a USE flag which can also be tied to
> applying patches rather than a virtual which is better suited for simple
> drop in substitutions.
>

The problem I see now is that people will have a hard time to actually
switch, because unlike gnutls we cannot have openssl and libressl be
installed at the same time.

For people to be able to switch we'd have to add libressl USE flags
everywhere, even if we don't know if it builds.