[Request for Testing] OPNsense LibreSSL flavour

[franco]

All packages for 15.1.8.3-LibreSSL are up.

[weust]

Thanks!

[franco]

15.1.9_LibreSSL updates and images are up: https://pkg.opnsense.org/snapshots/

Disclaimer: still experimental; yadda, yadda; please also read the 15.1.9 announcement... https://forum.opnsense.org/index.php?topic=306.0


Have fun. Report back.

[weust]

As I said on IRC, update through console went without a problem.

[mitsos]

Been testing the past couple of libressl versions and I can't find anything to be broken. What's the actual holdup for shifting over to it? Any programs that depend on openssl and need patches to work?

[franco]

Demetris,

The FreeBSD ports tree still isn't ready by default (Python 2.7 is missing LibreSSL build support). I have some patches to push upstream as well, and Bernard and others are doing a lot more work behind the scenes. See:

http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild (the interview bits with Bernard Spil)

There is the question of hardware acceleration which isn't in LibreSSL as far as I heard, but I need to check back with LibreSSL devs to be sure or hear their plans.

What we are most likely going to do is release both versions officially in the future as soon as we have automated build infrastructure up and running (building 2 versions in parallel was tricky, building 4 is impossible from this laptop). Donations and help are welcome in that regard. This will most likely materialise for 15.7.

In any case, LibreSSL builds are becoming more frequent with images and timely updates and we want to keep this up.

[chol]

My install of 15.1.9-LibreSSL went seamlessly and the console upgrade to latest 15.1.11.1 went through without any hassle. [amd64, SSD, 3NIC em(4), ath(4)]

So far all seems to run proper. 

[franco]

Maybe one last bump for this thread.

It looks like upgrading from as far back as 15.1.9 works seamlessly, but the snapshots are getting pretty old. Since all of this ran smoothly up until now, there will be official 15.7 images based on LibreSSL. You guys deserve it. <3

For completeness (and because pkgng isn't quite ready yet to move from OpenSSL to LibreSSL as more testing has revealed) here's how to acquire a fresh and current LibreSSL install:

1. Go to the snapshots and install on the target system: https://pkg.opnsense.org/snapshots/15.1.9_LibreSSL/

2. On the console trigger Option 12 to bring your system up to speed.

3. Enjoy.