Investigate using OpenSSL (again)

[michaelrsweet]

By popular request, will reconsider removal of OpenSSL in CUPS 1.x for CUPS 3.0.

[DemiMarie]

Mozilla’s NSS is another alternative, BTW.

[michaelrsweet]

@DemiMarie Perhaps, however if the point is to minimize the number of TLS libraries needed for a minimal install, using OpenSSL is a no-brainer...

[DemiMarie]

Amazon’s s2n would actually be the one I prefer for server-side use, BTW.

[michaelrsweet]

@DemiMarie Hadn't heard of s2n, but looking at it I see a few issues:

• They don't want people to look at this as a replacement for OpenSSL.
• It seems to still depend on OpenSSL's libcrypto for the low-level crypto functions (it just implements the TLS layer).
• It doesn't implement TLS 1.3.

[DemiMarie]

@DemiMarie Hadn't heard of s2n, but looking at it I see a few issues:

• They don't want people to look at this as a replacement for OpenSSL.
• It seems to still depend on OpenSSL's libcrypto for the low-level crypto functions (it just implements the TLS layer).

The reason I suggested s2n is that it has less attack surface in the TLS layer. OpenSSL’s crypto code has a good track record.

• It doesn't implement TLS 1.3.

Git master does at least. Not sure if that has made it into a release.

[mikhailnov]

Are there any reasons why currently used gnutls is worse than OpenSSL?

[mikhailnov]

As a distro package maintainer, I would ask to avoid using libraries with potentially unstable API and ABI, it will be a pain to maintain (do not know how stable s2n is, but usually such libraries do not maintain backwards compatibility properly and may even forget to bump sonmae when breaking ABI).

[DemiMarie]

As a distro package maintainer, I would ask to avoid using libraries with potentially unstable API and ABI, it will be a pain to maintain (do not know how stable s2n is, but usually such libraries do not maintain backwards compatibility properly and may even forget to bump sonmae when breaking ABI).

Why do you state this?

[q66]

would be nice, I would very much like to include CUPS in the main repository of my distribution (since a variety of things needs it or at very least libcups) but I would like to avoid having to pull gnutls in there (it's in another section of the repository); I already have openssl in main, so having this would be great

[michaelrsweet]

This is now implemented (PR #362) for CUPS 2.4.2!

[nanonyme]

So is this specifically now OpenSSL1 and not OpenSSL3?

[michaelrsweet]

@nanonyme You can use OpenSSL 1.x or 3.x.