Why not to replace LibreSSL with OpenSSL?

[andzai1995]

OpenSSL is using in Void Linux now. Approximately a month ago new version of OpenSSL released. Why not to try to use 3.0 version or at least 1.1.1l? If we can use OpenSSL, why we don't use it?

There are all patches required for build with musl - https://github.com/void-linux/void-packages/tree/master/srcpkgs/openssl

[dslm4515]

In general, I chose LibreSSL over OpenSSL even when VOID Linux had patches for OpenSSL. I made my decision when the heartbleed bug was discovered in OpenSSL.

But doing a quick search, looks like libreSSL is lagging behind OpenSSL in development.

[takusuman]

I think it's good to keep it at the most as an alternative.
LibreSSL rocks!

[dslm4515]

I think the general idea is that....
o If one values security over portability, go for LibreSSL
o If one values portability over security, go for OpenSSL

Plus I like how LibreSSL was forked from OpenSSL and a lot of code was removed and coded from scratch

[takusuman]

I think it's also important to don't let the "LibreSSL on Linux" idea die.
Related article: https://lwn.net/Articles/841664/

I think we should maintain LibreSSL alive on Linux, since people always need to have an alternative.

[dslm4515]

I think we should maintain LibreSSL alive on Linux, since people always need to have an alternative.

YES. The core motivation/inspiration for MLFS is to find alternatives.

I decided on LibreSSL very early on but already forgot why. Thanks for reminding me.

[dslm4515]

Alpine Linux supported LibreSSL as its primary TLS library for a while, but switched back to OpenSSL with the 3.9.0 release in January 2019.

Must explain why sometimes patches and build methods no longer work from Alpine Linux... Primarily rustc and Qt5