Subject: bug#24674: closed (Re: bug#24674: Dropbear bundled libraries)

From: [email-masked] (GNU bug Tracking System)
Date: Sat, 19 Dec 2020 06:41:01 +0000

Your bug report

#24674: Dropbear bundled libraries

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
24674: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=24674
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#24674: Dropbear bundled libraries
From: Leo Famulari <[email-masked]>
To: zimoun <[email-masked]>
Cc: [email-masked]
Date: Sat, 19 Dec 2020 01:40:46 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

On Fri, Dec 18, 2020 at 04:29:37PM -0500, Leo Famulari wrote:
> TODO:
> 1) Package libtomcrypt 1.18.2
> 2) Try building Dropbear with libtommath and libtomcrypt Guix packages

Packaging libtomcrypt is easy, but building Dropbear without using the
bundled libtom libraries is still not that simple. I tried building
Dropbear with "--disable-bundled-libtom" but the build scripts don't
automatically find the shared libraries.

My primary motivation for filing this bug was the risk of serious bugs
in the old copies of the libtom libraries.

Since Dropbear has upgraded their copies, makes enough modifications
that they think it's worth forking, and because using the external
libraries is complicated, I'm closing this bug as-is. But I'm also
leaving the comment in the Dropbear package definition.

Subject: Dropbear bundled libraries
From: Leo Famulari <[email-masked]>
To: [email-masked]
Date: Wed, 12 Oct 2016 11:15:03 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Our Dropbear package bundles the libraries libtommath and libtomcrypt
[0], and their bundled changelogs imply that they date from 2006.

The Dropbear CHANGES [1] file shows that some attempt has been made to
cherry-pick some bug fixes. It also looks like Dropbear has made their
own changes to the bundled libraries.

Apparently it is possible to build against non-bundled libraries [2].
Both libraries have had new releases in the last ten years [3].

It appears that Debian does use the bundled libraries [4].

In July, I asked Matt Johnston, the Dropbear author, how far the bundled
copies had diverged from upstream and if it was safe to unbundle them,
but I didn't get a response.

[0]
https://github.com/libtom
https://github.com/mkj/dropbear/tree/master/libtomcrypt
https://github.com/mkj/dropbear/tree/master/libtommath

[1]
https://github.com/mkj/dropbear/blob/master/CHANGES#L481

[2]
https://github.com/mkj/dropbear/blob/master/CHANGES#L532
"- Attempt to build against system libtomcrypt/libtommath if available.
This can be disabled with ./configure --enable-bundled-libtom"

[3]
https://github.com/libtom/libtomcrypt/releases
https://github.com/libtom/libtommath/releases

[4]
https://packages.debian.org/sid/dropbear