Bug#754513: Questions from upstream
Hi Brent,
Thank you very much for your input here.
On 21/07/14 13:10, Brent Cook wrote:
> Also, please do not replace arc4random in libressl. We'll have to figure
> out what to do about the circular dependency with openssh
OK, let's see what the OpenSSH Portable team comes up with...
Having embedded copies of arc4random.c in different packages though
(libressl, openssh, libevent, libbsd) is not great. It would be nice to
someday package it into a re-usable library for all of Debian to use,
and for ensuring it always stays up-to-date with upstream.
(The one in LibreSSL Portable is currently the most up-to-date; I
realise other/older versions of it are unsafe for some use cases).
> replacing
> with the version from libbsd is really not the way to go at the moment
Agreed, there are serious problems with the arc4random in libbsd at the
moment (I'm looking at our options to fix this). But if we could
someday split out arc4random, then libbsd would seem like a good place
to put it.
Regards,
--
Steven Chamberlain
steven@pyro.eu.org
Reply to: