RE: [gentoo-security] Do I need to rebuild things after upgradingssl?

[Joel Osburn]

Quoting Piotr Kalinowski:
>The point is that apps are linked against libcrypt.so.0.9.6 for
instance.
>So when you replace it with *.so.0.9.7, the linker cannot find 0.9.6
>version. Dynamic linking makes it unnecessary for you to recompile
>everything after upgrading from 0.9.7 to 0.9.7d, because even though
the
>file version changes, it's name (or at least a name of symbolic link
and
>binary interface) doesn't change and the linker can find it, load it
and
>app can use it.

Right.  So therefore the revdep-rebuild command is only useful (as
relates to the openssl update) if one updates from openssl-0.9.6x to the
0.9.7x series.  And as I recall, the ebuild tells you as much.

The question I was trying to ask, though, is how to tell what is
*statically* compiled with a given library, openssl in this case.  Those
will need to be recompiled *every* time there is an upgrade to the
library, if you want the newer version to be used.  And in the case of
security related upgrades, you do :).  An example is that people who use
apache-1.x with mod_ssl.  Mod_ssl needs to be recompiled to use the
newer openssl.  What else does?

-Joel Osburn


--
gentoo-security@g.o mailing list