[gentoo-user] complete switch from openssl to libressl on gentoo

[gentoo-user] complete switch from openssl to libressl on gentoo

[Tamer Higazi]

Dear everybody,

I got my Gentoo system running compiled with openssl.
I'd like to rebuild my entire system based on libreSSL.

What best practices do you advise ?


Thanks.


best, Tamer

Re: [gentoo-user] complete switch from openssl to libressl on gentoo

[Dale]

Tamer Higazi wrote:
> Dear everybody,
>
> I got my Gentoo system running compiled with openssl.
> I'd like to rebuild my entire system based on libreSSL.
>
> What best practices do you advise ?
>
>
> Thanks.
>
>
> best, Tamer
>
>
>


If all you're doing is changing a USE flag, emerge -Na world should do
it.  If you think it needed, emerge -DNa world.  The -D, deep, may catch
a few more packages but I've never tested it.  If you want to go to the
extreme, emerge -ea world will recompile everything, changed USE flag or
not.  It won't miss a thing.  The first one should work in most cases.
If you run into trouble, maybe add the -D. 

The -N is this from man emerge:

--newuse, -N
Tells emerge to include installed packages where USE flags have changed
since compilation. This option also implies the --selective  option.  
USE  flag  changes include:

A USE flag was added to a package.  A USE flag was removed from a
package.  A USE flag was turned on for a package.  A USE flag was turned
off for a package.

Hope that helps. 

Dale

:-)  :-) 

Re: [gentoo-user] complete switch from openssl to libressl on gentoo

[Michael]

On Friday, 17 April 2020 17:52:26 BST Dale wrote:
> Tamer Higazi wrote:
> > Dear everybody,
> > 
> > I got my Gentoo system running compiled with openssl.
> > I'd like to rebuild my entire system based on libreSSL.
> > 
> > What best practices do you advise ?
> > 
> > 
> > Thanks.
> > 
> > 
> > best, Tamer
> 
> If all you're doing is changing a USE flag, emerge -Na world should do
> it.  If you think it needed, emerge -DNa world.  The -D, deep, may catch
> a few more packages but I've never tested it.  If you want to go to the
> extreme, emerge -ea world will recompile everything, changed USE flag or
> not.  It won't miss a thing.  The first one should work in most cases.
> If you run into trouble, maybe add the -D. 
> 
> The -N is this from man emerge:
> 
> --newuse, -N
> Tells emerge to include installed packages where USE flags have changed
> since compilation. This option also implies the --selective  option.  
> USE  flag  changes include:
> 
> A USE flag was added to a package.  A USE flag was removed from a
> package.  A USE flag was turned on for a package.  A USE flag was turned
> off for a package.
> 
> Hope that helps. 
> 
> Dale
> 
> :-)  :-) 

You should also check any portage config files for openssl USE flags and 
remove them:

grep ssl -r /etc/portage/

should do it.

However, is there a good reason for opting for libressl instead of the 
ubiquitous openssl?

Re: [gentoo-user] complete switch from openssl to libressl on gentoo

[Francesco Turco]

> However, is there a good reason for opting for libressl instead of the 
> ubiquitous openssl?

I haven't tried libressl yet, but the main reason I'm interested in trying it is due to the fact it doesn't have a "bindist" USE flag. In fact some packages require openssl to be built with the "-bindist" USE flag, but I don't like that. By switching to libressl I hope to work around that problem.

-- 
https://fturco.net/

Re: [gentoo-user] complete switch from openssl to libressl on gentoo

[Mike Gilbert]

On Fri, Apr 17, 2020 at 1:50 PM Francesco Turco <mail@fturco.net> wrote:
>
> > However, is there a good reason for opting for libressl instead of the
> > ubiquitous openssl?
>
> I haven't tried libressl yet, but the main reason I'm interested in trying it is due to the fact it doesn't have a "bindist" USE flag. In fact some packages require openssl to be built with the "-bindist" USE flag, but I don't like that. By switching to libressl I hope to work around that problem.

That is a terrible reason for switching. libressl likely has the same
issue with patents, it just doesn't bother to give you the choice of
opting out.