[Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Buildroot] [PATCH 1/1] package/python3: drop libressl support

[James Hilliard]

Libressl is no longer supported as of python 3.10.

See: https://peps.python.org/pep-0644/#libressl

Fixes:
 - http://autobuild.buildroot.net/results/a16/a160cfdc9dfc036c4dc41af1c796f8838d91c573

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 package/python3/Config.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package/python3/Config.in b/package/python3/Config.in
index 61470c2944..761c38c850 100644
--- a/package/python3/Config.in
+++ b/package/python3/Config.in
@@ -89,7 +89,8 @@ config BR2_PACKAGE_PYTHON3_READLINE
 config BR2_PACKAGE_PYTHON3_SSL
 	bool "ssl"
 	select BR2_PACKAGE_OPENSSL
-	select BR2_PACKAGE_LIBOPENSSL_ENABLE_BLAKE2 if BR2_PACKAGE_LIBOPENSSL
+	select BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL
+	select BR2_PACKAGE_LIBOPENSSL_ENABLE_BLAKE2
 	help
 	  _ssl module for Python3 (required for https in urllib etc).
 
-- 
2.25.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Thomas Petazzoni via buildroot]

Hello James,

On Tue, 26 Apr 2022 21:50:39 -0600
James Hilliard <james.hilliard1@gmail.com> wrote:

> Libressl is no longer supported as of python 3.10.
> 
> See: https://peps.python.org/pep-0644/#libressl
> 
> Fixes:
>  - http://autobuild.buildroot.net/results/a16/a160cfdc9dfc036c4dc41af1c796f8838d91c573
> 
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Thanks for your patch. I think it raises one question: is libressl
still relevant? Should we still support it?

My understanding was that it is not really a successful fork, and in
the end, openssl has mostly caught up and remains the de-facto standard
implementation. See https://lwn.net/Articles/841664/.

I don't have a very well-informed opinion, but perhaps we should think
about this?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[James Hilliard]

On Wed, Apr 27, 2022 at 2:31 AM Thomas Petazzoni
<thomas.petazzoni@bootlin.com> wrote:
>
> Hello James,
>
> On Tue, 26 Apr 2022 21:50:39 -0600
> James Hilliard <james.hilliard1@gmail.com> wrote:
>
> > Libressl is no longer supported as of python 3.10.
> >
> > See: https://peps.python.org/pep-0644/#libressl
> >
> > Fixes:
> >  - http://autobuild.buildroot.net/results/a16/a160cfdc9dfc036c4dc41af1c796f8838d91c573
> >
> > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
>
> Thanks for your patch. I think it raises one question: is libressl
> still relevant? Should we still support it?

Well it's still actively maintained at least.

>
> My understanding was that it is not really a successful fork, and in
> the end, openssl has mostly caught up and remains the de-facto standard
> implementation. See https://lwn.net/Articles/841664/.

We do support a number of other rather uncommon ssl implementations
in general, and at least it's easy enough to disable for unsupported
configurations.

>
> I don't have a very well-informed opinion, but perhaps we should think
> about this?

Yeah, not really sure, it may be useful to keep around, I think it has an
alternative updated API to openssl's updated API that may be desirable
for some use cases, although probably not the most commonly used.

>
> Thomas
> --
> Thomas Petazzoni, co-owner and CEO, Bootlin
> Embedded Linux and Kernel engineering and training
> https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Arnout Vandecappelle]

On 27/04/2022 10:42, James Hilliard wrote:
> On Wed, Apr 27, 2022 at 2:31 AM Thomas Petazzoni
> <thomas.petazzoni@bootlin.com> wrote:
>>
>> Hello James,
>>
>> On Tue, 26 Apr 2022 21:50:39 -0600
>> James Hilliard <james.hilliard1@gmail.com> wrote:
>>
>>> Libressl is no longer supported as of python 3.10.
>>>
>>> See: https://peps.python.org/pep-0644/#libressl
>>>
>>> Fixes:
>>>   - http://autobuild.buildroot.net/results/a16/a160cfdc9dfc036c4dc41af1c796f8838d91c573
>>>
>>> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
>>
>> Thanks for your patch. I think it raises one question: is libressl
>> still relevant? Should we still support it?
> 
> Well it's still actively maintained at least.
> 
>>
>> My understanding was that it is not really a successful fork, and in
>> the end, openssl has mostly caught up and remains the de-facto standard
>> implementation. See https://lwn.net/Articles/841664/.
> 
> We do support a number of other rather uncommon ssl implementations
> in general, and at least it's easy enough to disable for unsupported
> configurations.
> 
>>
>> I don't have a very well-informed opinion, but perhaps we should think
>> about this?
> 
> Yeah, not really sure, it may be useful to keep around, I think it has an
> alternative updated API to openssl's updated API that may be desirable
> for some use cases, although probably not the most commonly used.

  At that point, however, having libressl as a virtual package alternative for 
openssl becomes less and less realistic. Virtual packages should only be used if 
the alternatives can be considered drop-in replacements with compatible API. A 
few exceptions are acceptable, but it's becoming too much.

  We should also start thinking what to do with openssl 3. It has an API that is 
somewhat compatible with openssl 1.1.1, but there are almost no packages that 
can use it without any changes. This could actually be an opportunity to get 
aout of this mess: most packages that are not compatible with libressl are 
probably already compatible with openssl 3. So if we introduce an openssl3 
package, we can migrate the packages that don't like libressl to that, and leave 
the choice between openssl 1.1.1 and libressl for legacy and BSD packages.

  Regards,
  Arnout

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Arnout Vandecappelle]

On 27/04/2022 05:50, James Hilliard wrote:
> Libressl is no longer supported as of python 3.10.
> 
> See: https://peps.python.org/pep-0644/#libressl
> 
> Fixes:
>   - http://autobuild.buildroot.net/results/a16/a160cfdc9dfc036c4dc41af1c796f8838d91c573
> 
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

  Applied to master, thanks.

  Regards,
  Arnout

> ---
>   package/python3/Config.in | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/package/python3/Config.in b/package/python3/Config.in
> index 61470c2944..761c38c850 100644
> --- a/package/python3/Config.in
> +++ b/package/python3/Config.in
> @@ -89,7 +89,8 @@ config BR2_PACKAGE_PYTHON3_READLINE
>   config BR2_PACKAGE_PYTHON3_SSL
>   	bool "ssl"
>   	select BR2_PACKAGE_OPENSSL
> -	select BR2_PACKAGE_LIBOPENSSL_ENABLE_BLAKE2 if BR2_PACKAGE_LIBOPENSSL
> +	select BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL
> +	select BR2_PACKAGE_LIBOPENSSL_ENABLE_BLAKE2
>   	help
>   	  _ssl module for Python3 (required for https in urllib etc).
>   
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Peter Korsgaard]

>>>>> "Arnout" == Arnout Vandecappelle <arnout@mind.be> writes:

Hi,

 >>> I don't have a very well-informed opinion, but perhaps we should think
 >>> about this?
 >> Yeah, not really sure, it may be useful to keep around, I think it
 >> has an
 >> alternative updated API to openssl's updated API that may be desirable
 >> for some use cases, although probably not the most commonly used.

 >  At that point, however, having libressl as a virtual package
 >  alternative for openssl becomes less and less realistic. Virtual
 > packages should only be used if the alternatives can be considered
 > drop-in replacements with compatible API. A few exceptions are
 > acceptable, but it's becoming too much.

 >  We should also start thinking what to do with openssl 3. It has an
 >  API that is somewhat compatible with openssl 1.1.1, but there are
 > almost no packages that can use it without any changes. This could
 > actually be an opportunity to get aout of this mess: most packages
 > that are not compatible with libressl are probably already compatible
 > with openssl 3. So if we introduce an openssl3 package, we can migrate
 > the packages that don't like libressl to that, and leave the choice
 > between openssl 1.1.1 and libressl for legacy and BSD packages.

That indeed sounds like a way forward. Do we expect most applications to
(already have) move to the v3.x API or do we rather expect to have to
keep around openssl 1.1.1 / libressl for a long time?

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Arnout Vandecappelle]

On 27/04/2022 22:09, Peter Korsgaard wrote:
>>>>>> "Arnout" == Arnout Vandecappelle <arnout@mind.be> writes:
> 
> Hi,
> 
>   >>> I don't have a very well-informed opinion, but perhaps we should think
>   >>> about this?
>   >> Yeah, not really sure, it may be useful to keep around, I think it
>   >> has an
>   >> alternative updated API to openssl's updated API that may be desirable
>   >> for some use cases, although probably not the most commonly used.
> 
>   >  At that point, however, having libressl as a virtual package
>   >  alternative for openssl becomes less and less realistic. Virtual
>   > packages should only be used if the alternatives can be considered
>   > drop-in replacements with compatible API. A few exceptions are
>   > acceptable, but it's becoming too much.
> 
>   >  We should also start thinking what to do with openssl 3. It has an
>   >  API that is somewhat compatible with openssl 1.1.1, but there are
>   > almost no packages that can use it without any changes. This could
>   > actually be an opportunity to get aout of this mess: most packages
>   > that are not compatible with libressl are probably already compatible
>   > with openssl 3. So if we introduce an openssl3 package, we can migrate
>   > the packages that don't like libressl to that, and leave the choice
>   > between openssl 1.1.1 and libressl for legacy and BSD packages.
> 
> That indeed sounds like a way forward. Do we expect most applications to
> (already have) move to the v3.x API or do we rather expect to have to
> keep around openssl 1.1.1 / libressl for a long time?

  Fedora 36 has openssl3 as default and openssl1.1 as compat. So I expect that 
the flagship packages will support openssl3 by now, and it will take years for 
all almost-unmaintained packages to get updated.

  Unfortunately I know of no easy way of querying reverse dependencies, so it's 
hard to evaluate how many packages currently still need openssl1.1.

  Regards,
  Arnout

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/python3: drop libressl support

[Peter Korsgaard]

>>>>> "James" == James Hilliard <james.hilliard1@gmail.com> writes:

 > Libressl is no longer supported as of python 3.10.
 > See: https://peps.python.org/pep-0644/#libressl

 > Fixes:
 >  - http://autobuild.buildroot.net/results/a16/a160cfdc9dfc036c4dc41af1c796f8838d91c573

 > Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Committed to 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot