Re: [gentoo-dev] [RFC] Discontinuing LibreSSL support?

[John Helmert III]

On Tue, Dec 29, 2020 at 02:57:12PM +0100, m1027 wrote:
> > > On 29 Dec 2020, at 09:13, Marcel Schilling
> > > <marcel.schilling@××××××××××.de> wrote:
> > >
> > > I just want to comment that I switched to LibreSSL on several
> > > Gentoo systems years ago and never had any major issues.  I run
> > > both desktop and server systems with LibreSSL, based on X and
> > > Wayland. The only issues I ran into is a slight lag of the
> > > overlay behind the main tree so once in a while I had to mask a
> > > new version of some package for a week or so.
>
> Let me just come back on the different views here:
>
> @marcel: Exactly the same here. Smoothly running libressl on dozens
> of systems here, from embedded to ryzen servers, even on Gnome
> desktops. At least from the libressl *user's* perspective.
>
> sam:
>
> > TL;DR: [...libressl patches are...] just crippling functionality.
>
> @sam: From the perspective of libressl maintainers I have had a hard
> time reading this thread ;-) to learn that even security is supposed
> to be an issue with libressl today!? Aren't these crippling patches
> sometimes even helpful (see some apache patches) to crop unreliable
> extra features? I might be wrong here. Actually I'd prefer something
> 'boring' and stable on ssl over new features...
>
> Well, I cannot judge on the security issues in depth. From a short
> internet scan I don't see recent libressl issues but e.g. this one
> on openssl, https://www.openssl.org/news/vulnerabilities.html, only
> three weeks ago.

That particular vulnerability (CVE-2020-1971) affects both libressl and openssl, and
Gentoo has bugs for both.

https://bugs.gentoo.org/759079
https://bugs.gentoo.org/759175

The openssl bug has been fixed, but the libressl bug remains open,
despite both being opened within two days of each (and now existing
for several weeks).