There is a patch to boost that should get into both CentOS and RHEL 7.
I already sent an e-mail to the person who last modified the rpm spec file but I have no idea if he will even see the e-mail.
The small patch -
https://github.com/boostorg/asio/pull/23/files
The problem it fixes -
boost assumes that the TLS supports SSLv3 which the OpenSSL currently in RHEL / CentOS 7 does.
However SSLv3 is incredibly old and is no longer considered to be secure and should not be used, so some alternative TLS implementations do not even include support for it.
LibreSSL is one such example, and some distributions (e.g. Debian) have removed SSLv3 support from the OpenSSL library they ship.
Given how old and insecure SSLv3 is and given the incredibly long support cycle of RHEL 7 it would not surprise me at all if removal of SSLv3 from the OpenSSL library in RHEL 7 is going to happen at some point in the next few years.
As such getting this patch into boost will be necessary.
The patch does not have any impact on boost when using TLS libraries that do support SSLv3 so it will not do any harm to get it into the packaging now.
Getting it into the packaging now means boost is ready when the change is made, and it also makes life a lot easier for people like me who have to use an alternate TLS implementation because we need the EC stuff that RHEL removed from OpenSSL due to potential patent reasons that the lawyers were afraid of.
I'm hoping someone on this list with some influence understands the issue. Filing a bug report with CentOS I suppose is also an option, but given that the patch doesn't solve a problem with any *current* CentOS packages, I doubt that would result in the bug trickling up to RHEL and they are the ones that have to apply the patch for it to make it into CentOS.
Thank you for your time
On Wed, Jan 13, 2016 at 05:39:48AM -0800, Alice Wonder wrote:
There is a patch to boost that should get into both CentOS and RHEL 7.
I already sent an e-mail to the person who last modified the rpm spec file but I have no idea if he will even see the e-mail.
Did you submit anything to bugzilla.redhat.com? What's the BZ ID number?
On 01/13/2016 05:45 AM, Jonathan Billings wrote:
On Wed, Jan 13, 2016 at 05:39:48AM -0800, Alice Wonder wrote:
There is a patch to boost that should get into both CentOS and RHEL 7.
I already sent an e-mail to the person who last modified the rpm spec file but I have no idea if he will even see the e-mail.
Did you submit anything to bugzilla.redhat.com? What's the BZ ID number?
No I didn't, I was under the impression one had to have an RHEL license to do that.
I suppose I should have tried, I'll try now.
On Wed, Jan 13, 2016 at 06:15:58AM -0800, Alice Wonder wrote:
No I didn't, I was under the impression one had to have an RHEL license to do that.
I suppose I should have tried, I'll try now.
No, you don't have to, although opening a support request with Red Hat regarding the ticket (once you've created it) can help.
More importantly, its less difficult for the request to be "lost" by an individual if there's a ticket assigned to the package maintainer. Who knows if the email you sent went to the right person and whether it wasn't just deleted because there's no RHBZ?
On 01/13/2016 06:28 AM, Jonathan Billings wrote:
On Wed, Jan 13, 2016 at 06:15:58AM -0800, Alice Wonder wrote:
No I didn't, I was under the impression one had to have an RHEL license to do that.
I suppose I should have tried, I'll try now.
No, you don't have to, although opening a support request with Red Hat regarding the ticket (once you've created it) can help.
More importantly, its less difficult for the request to be "lost" by an individual if there's a ticket assigned to the package maintainer. Who knows if the email you sent went to the right person and whether it wasn't just deleted because there's no RHBZ?
Thank you, it's done -
-
Alice Wonder -
Jonathan Billings