<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>The patch was there before me, so I have no clue. But I am all for removing it.</div>
<div> </div>
<div>O.</div>
<div> </div>
<div>On Mon, Apr 27, 2015, at 19:30, Lior Kaplan wrote:<br></div>
<blockquote type="cite"><div dir="ltr"><div>We should probably understand first the motivation for the original patch.<br></div>
<div> </div>
<div>At the moment (without any digging into the VCS), I would prefer the dynamic linking for security reasons.<br></div>
<div>With the patch, we need to binNMU on each security upload, while without it we only need to binNMU if a header is changed.<br></div>
<div> </div>
<div>Kaplan<br></div>
</div>
<div><div> </div>
<div><div>On Mon, Apr 27, 2015 at 8:22 PM, Declercq Laurent <span dir="ltr"><<a href="mailto:l.declercq@nuxwin.com">l.declercq@nuxwin.com</a>></span> wrote:<br></div>
<blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204, 204, 204);border-left-style:solid;padding-left:1ex;"><div><span>Le 26/04/2015 14:07, Lior Kaplan a écrit :</span><br></div>
<div> </div>
<blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204, 204, 204);border-left-style:solid;padding-left:1ex;"><span>
It seems we can remove the patch, as since 2011 -lcrypto is indeed added later in acinclude.m4.<br> <br>
See upstream commit a286fa3523b230fded3204d8b09381675f70d85c<br> <br>
Kaplan</span></blockquote><div> </div>
<div><span></span>
Re;<br></div>
<div> </div>
<div>
According to my previous mails, I've made some tests and I've refreshed the patch to force usage of the static openssl archive.<br></div>
<div> </div>
<div>
First, I give you some info about my environment:<br></div>
<div> </div>
<div>
##############################################################################<br></div>
<div>
root@jessie:/usr/local/src/phpswitcher/php-5.6.8# lsb_release -a<br></div>
<div>
No LSB modules are available.<br></div>
<div>
Distributor ID: Debian<br></div>
<div>
Description: Debian GNU/Linux 8.0 (jessie)<br></div>
<div>
Release: 8.0<br></div>
<div>
Codename: jessie<br></div>
<div> </div>
<div>
root@jessie:/usr/local/src/phpswitcher/php-5.6.8# dpkg-architecture<br></div>
<div>
DEB_BUILD_ARCH=amd64<br></div>
<div>
DEB_BUILD_ARCH_BITS=64<br></div>
<div>
DEB_BUILD_ARCH_CPU=amd64<br></div>
<div>
DEB_BUILD_ARCH_ENDIAN=little<br></div>
<div>
DEB_BUILD_ARCH_OS=linux<br></div>
<div>
DEB_BUILD_GNU_CPU=x86_64<br></div>
<div>
DEB_BUILD_GNU_SYSTEM=linux-gnu<br></div>
<div>
DEB_BUILD_GNU_TYPE=x86_64-linux-gnu<br></div>
<div>
DEB_BUILD_MULTIARCH=x86_64-linux-gnu<br></div>
<div>
DEB_HOST_ARCH=amd64<br></div>
<div>
DEB_HOST_ARCH_BITS=64<br></div>
<div>
DEB_HOST_ARCH_CPU=amd64<br></div>
<div>
DEB_HOST_ARCH_ENDIAN=little<br></div>
<div>
DEB_HOST_ARCH_OS=linux<br></div>
<div>
DEB_HOST_GNU_CPU=x86_64<br></div>
<div>
DEB_HOST_GNU_SYSTEM=linux-gnu<br></div>
<div>
DEB_HOST_GNU_TYPE=x86_64-linux-gnu<br></div>
<div>
DEB_HOST_MULTIARCH=x86_64-linux-gnu<br></div>
<div>
DEB_TARGET_ARCH=amd64<br></div>
<div>
DEB_TARGET_ARCH_BITS=64<br></div>
<div>
DEB_TARGET_ARCH_CPU=amd64<br></div>
<div>
DEB_TARGET_ARCH_ENDIAN=little<br></div>
<div>
DEB_TARGET_ARCH_OS=linux<br></div>
<div>
DEB_TARGET_GNU_CPU=x86_64<br></div>
<div>
DEB_TARGET_GNU_SYSTEM=linux-gnu<br></div>
<div>
DEB_TARGET_GNU_TYPE=x86_64-linux-gnu<br></div>
<div>
DEB_TARGET_MULTIARCH=x86_64-linux-gnu<br></div>
<div> </div>
<div>
root@jessie:/usr/local/src/phpswitcher/php-5.6.8# dpkg-buildflags<br></div>
<div>
CFLAGS=-g -O2 -fstack-protector-strong -Wformat -Werror=format-security<br></div>
<div>
CPPFLAGS=-D_FORTIFY_SOURCE=2<br></div>
<div>
CXXFLAGS=-g -O2 -fstack-protector-strong -Wformat -Werror=format-security<br></div>
<div>
FCFLAGS=-g -O2 -fstack-protector-strong<br></div>
<div>
FFLAGS=-g -O2 -fstack-protector-strong<br></div>
<div>
GCJFLAGS=-g -O2 -fstack-protector-strong<br></div>
<div>
LDFLAGS=-Wl,-z,relro<br></div>
<div>
OBJCFLAGS=-g -O2 -fstack-protector-strong -Wformat -Werror=format-security<br></div>
<div>
OBJCXXFLAGS=-g -O2 -fstack-protector-strong -Wformat -Werror=format-security<br></div>
<div>
##############################################################################<br></div>
<div> </div>
<div>
Now comes the result with your current patch applied:<br></div>
<div> </div>
<div>
##############################################################################<br></div>
<div>
root@jessie:/var/www/imscp/gui/plugins/PhpSwitcher/PhpCompiler# ldd /usr/bin/php<br></div>
<div>
linux-vdso.so.1 (0x00007ffdfd7fb000)<br></div>
<div>
libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007fa7a7f02000)<br></div>
<div>
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fa7a7ce7000)<br></div>
<div>
libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007fa7a7acf000)<br></div>
<div>
libonig.so.2 => /usr/lib/x86_64-linux-gnu/libonig.so.2 (0x00007fa7a7865000)<br></div>
<div>
libcrypto.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0 (0x00007fa7a746a000)<br></div>
<div>
libssl.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007fa7a7209000)<br></div>
<div> <a href="http://libdb-5.3.so">libdb-5.3.so</a> => /usr/lib/x86_64-linux-gnu/<a href="http://libdb-5.3.so">libdb-5.3.so</a> (0x00007fa7a6e48000)<br></div>
<div>
libqdbm.so.14 => /usr/lib/libqdbm.so.14 (0x00007fa7a6bfb000)<br></div>
<div>
libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007fa7a69ea000)<br></div>
<div>
libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fa7a677c000)<br></div>
<div>
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fa7a6574000)<br></div>
<div>
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fa7a6272000)<br></div>
<div>
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fa7a606e000)<br></div>
<div>
libnsl.so.1 => /lib/x86_64-linux-gnu/libnsl.so.1 (0x00007fa7a5e56000)<br></div>
<div>
libxml2.so.2 => /usr/lib/x86_64-linux-gnu/libxml2.so.2 (0x00007fa7a5aee000)<br></div>
<div>
libgssapi_krb5.so.2 => /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007fa7a58a4000)<br></div>
<div>
libkrb5.so.3 => /usr/lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007fa7a55d0000)<br></div>
<div>
libk5crypto.so.3 => /usr/lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007fa7a539e000)<br></div>
<div>
libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007fa7a519a000)<br></div>
<div>
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fa7a4df1000)<br></div>
<div>
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fa7a4bd3000)<br></div>
<div>
/lib64/ld-linux-x86-64.so.2 (0x00007fa7a8145000)<br></div>
<div>
liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007fa7a49b0000)<br></div>
<div>
libkrb5support.so.0 => /usr/lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007fa7a47a3000)<br></div>
<div>
libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007fa7a459f000)<br></div>
<div>
##############################################################################<br></div>
<div> </div>
<div>
As you can see here openssl is still dynamically linked which is bad in regard of the expected result.<br></div>
<div> </div>
<div>
Now, with my refreshed patch (applied on PHP 5.6.8 (upstream)):<br></div>
<div> </div>
<div>
##############################################################################<br></div>
<div>
jessie:/usr/local/src/phpswitcher/php-5.6.8# ldd cgi-build/sapi/cli/php<br></div>
<div>
linux-vdso.so.1 (0x00007ffe337f8000)<br></div>
<div>
libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007fd2e7428000)<br></div>
<div>
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fd2e720d000)<br></div>
<div>
libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007fd2e6ff5000)<br></div>
<div>
libonig.so.2 => /usr/lib/x86_64-linux-gnu/libonig.so.2 (0x00007fd2e6d8b000)<br></div>
<div>
libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fd2e6a80000)<br></div>
<div> <a href="http://libdb-5.3.so">libdb-5.3.so</a> => /usr/lib/x86_64-linux-gnu/<a href="http://libdb-5.3.so">libdb-5.3.so</a> (0x00007fd2e66be000)<br></div>
<div>
libqdbm.so.14 => /usr/lib/libqdbm.so.14 (0x00007fd2e6471000)<br></div>
<div>
libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007fd2e6261000)<br></div>
<div>
libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fd2e5ff2000)<br></div>
<div>
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fd2e5dea000)<br></div>
<div>
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fd2e5ae9000)<br></div>
<div>
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fd2e58e4000)<br></div>
<div>
libnsl.so.1 => /lib/x86_64-linux-gnu/libnsl.so.1 (0x00007fd2e56cc000)<br></div>
<div>
libxml2.so.2 => /usr/lib/x86_64-linux-gnu/libxml2.so.2 (0x00007fd2e5365000)<br></div>
<div>
libgssapi_krb5.so.2 => /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007fd2e511a000)<br></div>
<div>
libkrb5.so.3 => /usr/lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007fd2e4e46000)<br></div>
<div>
libk5crypto.so.3 => /usr/lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007fd2e4c15000)<br></div>
<div>
libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007fd2e4a10000)<br></div>
<div>
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fd2e4667000)<br></div>
<div>
/lib64/ld-linux-x86-64.so.2 (0x00007fd2e766b000)<br></div>
<div>
libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fd2e4451000)<br></div>
<div>
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fd2e4233000)<br></div>
<div>
liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007fd2e4010000)<br></div>
<div>
libkrb5support.so.0 => /usr/lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007fd2e3e03000)<br></div>
<div>
libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007fd2e3bff000)<br></div>
<div>
##############################################################################<br></div>
<div> </div>
<div>
As you can see here both libssl.so and libcrypto.so are not longer listed but openssl is here as it is expected (part of php -i output):<br></div>
<div> </div>
<div>
OpenSSL support => enabled<br></div>
<div>
OpenSSL Library Version => OpenSSL 1.0.1k 8 Jan 2015<br></div>
<div>
OpenSSL Header Version => OpenSSL 1.0.1k 8 Jan 2015<br></div>
<div> </div>
<div>
The patch which is attached to this mail has been done against PHP 5.6.8 ( upstream ).<br></div>
<div> </div>
<div>
Should I create a report and submit the patch officially or not?<br></div>
<div> </div>
<div> </div>
<div>
Thank you for your interest.<br></div>
<div><div> </div>
<div> </div>
<div>
-- <br></div>
<div>
Laurent Declercq<br></div>
<div>
iHMS/i-MSCP Project Lead<br></div>
<div> </div>
</div>
</blockquote></div>
<div> </div>
</div>
</blockquote><div> </div>
<div id="sig19760093"><div class="signature">--<br></div>
<div class="signature">Ondřej Surý <ondrej@sury.org><br></div>
<div class="signature">Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server<br></div>
<div class="signature"> </div>
</div>
<div> </div>
</body>
</html>