Closed jkeenan closed 2 years ago
noxxi
commented
2 years ago Unfortunately LibreSSL is a kind of moving target with varying support for TLS 1.3 and different API support in different versions of LibreSSL. This makes it very hard to support IO::Socket::SSL and Net::SSLeay on LibreSSL. The OpenBSD ports for Net::SSLeay and IO::Socket::SSL thus come with their own patches - which sometimes skip tests and sometimes enforce TLS 1.2. Please use therefore the versions from ports instead.
jkeenan
commented
2 years ago Unfortunately LibreSSL is a kind of moving target with varying support for TLS 1.3 and different API support in different versions of LibreSSL. This makes it very hard to support IO::Socket::SSL and Net::SSLeay on LibreSSL. The OpenBSD ports for Net::SSLeay and IO::Socket::SSL thus come with their own patches - which sometimes skip tests and sometimes enforce TLS 1.2. Please use therefore the versions from ports instead.
@noxxi, the problem with the approach you suggest is that it does not appear to account for the fact that when your objective is to report test results to www.cpantesters.org, you need to install Task::CPAN::Reporter, which includes both IO::Socket::SSL and Net::SSLeay in its chain of dependencies.
It so happens that I already have the OpenBSD ports of these libraries in the Vagrantfile via which I provision my OpenBSD virtual machine:
# Packages which provide CPAN libraries which facilitate jkeenan's
# programming (including smoke-testing core distribution):
sudo pkg_add -u \
p5-Capture-Tiny \
p5-common-sense \
p5-Data-Dump \
p5-Devel-Cover \
p5-HTTP-Daemon \
p5-HTTP-Message \
p5-IO-Socket-SSL \
p5-JSON \
p5-JSON-XS \
p5-List-Compare \
p5-Net-SSLeay \
...This works fine when I'm running an application that makes use of the "system" perl. But much of my own work entails building a specific version of perl (often the HEAD of the blead branch), then installing libraries against that perl and sending CPANtesters reports about those libraries. Yesterday, for example, I wanted to install the latest version of DB_File against blead and, in doing so, generate a report for CPANtesters. I therefore had to install Task::CPAN::Reporter against that blead perl, but I couldn't get past the IO::Socket::SSL test failures (at least not without a force install, which I have not yet attempted). (I was somehow able to get Net::SSLeay installed.)
Can you suggest a workaround?
Thank you very much. Jim Keenan
noxxi
commented
2 years ago Can you suggest a workaround?
Again, I have problems supporting LibreSSL as a quickly moving target. So the workaround is to use a more stable target, i.e. OpenSSL. It is not perfect either but has much better supported both from Net::SSLeay and IO::Socket::SSL. I suggest to stay with OpenSSL 1.1.1 as the more stable version for now though.
jkeenan
commented
2 years ago I should add that, using a combination of OpenBSD packages and CPAN libraries in the Vagrantfile, I have been able to install Task::CPAN::Reporter against the system perl. I can therefore generate CPANtesters reports against that perl, which on OpenBSD-6.9 happens to be 5.32.1. Example from just now:
CPAN::Reporter: Test result is 'pass', All tests successful.
CPAN::Reporter: preparing a CPAN Testers report for Devel-Chitin-0.18
CPAN::Reporter: sending test report with 'pass' via Metabase
BRUMMETT/Devel-Chitin-0.18.tar.gz
/usr/bin/make test -- OKThe problem is that I cannot do an install of the reporting setup against any other perl that's locally installed. (The module cited above, for example, is broken in blead.)
Today, in the course of trying to install Task::CPAN::Reporter on OpenBSD-6.9 against Perl 5 blead, IO::Socket::SSL repeatedly failed its tests (using both
cpanandcpanmas installers.)These results appear similar to what's being reported to CPANtesters.
Can you investigate?