freebsd stable - Jul 2015 - WITHOUT_OPENSSL and make delete-old

Hi, I use the ports version of OpenSSL for everything and don't require 
the base version. As a result I thought I would remove it by adding 
WITHOUT_OPENSSL into /etc/src.conf and running make delete-old in 
/usr/src. However this seems to only want to delete things related to 
kerberos and gssapi, which is understandable as they depend on OpenSSL.  
However it doesn't seem to touch any OpenSSL files at all. Is this a bug 
or have I missed something?


-- 
Matt

On Mon, Jul 13, 2015 at 7:03 AM, Matt Smith <fbsd at xtaz.co.uk> wrote:
> Hi, I use the ports version of OpenSSL for everything and don't require
> the base version. As a result I thought I would remove it by adding
> WITHOUT_OPENSSL into /etc/src.conf and running make delete-old in /usr/src.
> However this seems to only want to delete things related to kerberos and
> gssapi, which is understandable as they depend on OpenSSL.  However it
> doesn't seem to touch any OpenSSL files at all. Is this a bug or have I
> missed something?
>
>
> --
> Matt
Yes. Several critical base system components require the base OpenSL. So, I
seem to recall that while WITHOUT_OPENSSL will skip the optional SSL stuff,
I am pretty sure that some of the OpenSSL always are built and are
considered too critical to rely on a port being installed... like logging
in, adding users, etc.
-- 
Kevin Oberman, Network Engineer, Retired
E-mail: rkoberman at gmail.com
PGP Fingerprint: D03FB98AFA78E3B78C1694B318AB39EF1B055683

On 14/07/2015 12:03 AM, Matt Smith wrote:
> Hi, I use the ports version of OpenSSL for everything and don't
> require the base version. As a result I thought I would remove it by
> adding WITHOUT_OPENSSL into /etc/src.conf and running make delete-old
> in /usr/src. However this seems to only want to delete things related
> to kerberos and gssapi, which is understandable as they depend on
> OpenSSL.  However it doesn't seem to touch any OpenSSL files at all.
> Is this a bug or have I missed something?
>
>
Matt, I've been down that road.  And for a few years, I installed
openssl port over openssl base.  But things have changed a lot, geli
uses openssl headers, libarchive (hence tar, cpio) and libarchive need
openssl; and of course kerberos, openssh).  Also, if you remove gssapi
then you won't be build gssd (used for kernel/NFS gssapi). 

The way I "get around" this issue is to build a base system that uses
base openssl to build the necessary "base" components, using
WITHOUT_[KERBEROS,OPENSSH].  Using this base system, I build a couple of
jails, which are used to build the ports.  For these jails I remove any
remnants of base openssl.  Then I'm able to build everything and install
onto the production servers only what they need.  (Pay attention to
where base openssl places libcom_err.*, it sometimes slips through. I
have a PR for this; and a build script removes it).

What you loose?  The FreeBSD version of openssl is tweaked by very
knowledgeable members (both Dag-Erling Smorgrav and John-Mark Gurney et
al), so you may want to examine their changes.

There is/was talk about making base openssl - "private" which I
believe
will accomplish the same result: base openssl for the base system, and
port openssl for port building.  I don't have details or timeline for
these changes.

Why did I bother? Historically - I installed heimdal 1.0.1 while base
heimdal was at 0.6.3. And for my use case: no nfs, needed additional
ciphers (at the time) and a slightly different attack surface; my build
system works.  :)

I hope I've save you some time.
Regards, Dewayne.

-- 
For the talkers: ?The superior man acts before he speaks, and afterwards speaks
according to his action.?
For everyone else: ?Life is really simple, but we insist on making it
complicated.?