[Pkg-openssl-devel] Planning the removal of c_rehash | mass bug filling

Antonio Terceiro terceiro at debian.org
Fri Apr 6 15:40:59 BST 2018


On Fri, Apr 06, 2018 at 12:22:12AM +0200, Sebastian Andrzej Siewior wrote:
> Hi,
> 
> the openssl package provides the c_rehash script which creates the links
> from XXXXXXXX.Y to the actual certificate in /etc/ssl/certs/. During the
> transition from 0.9.8 to 1.0.0 the hash (for the X part) changed from
> md5 to sha1. Since that transition in Debian the c_rehash script
> provides both symlinks: the old hash (md5) and the new (sha1) one. 
> 
> The c_rehash script is considered by upstream as a fallback script and
> will disappear at some point. The recommended way is to use the "openssl
> rehash" command instead which appeared in 1.1.0.  This command creates
> half that many symlinks (one per certificate instead of two) because it
> uses only the sha1 hash. There is also the -compat option which creates
> both symlinks (and behaves like c_rehash currently does) but as
> explained above it should not be required to use it.
> 
> I am planning to fill bugs against 23 packages which use "c_rehash" to
> use "openssl rehash" instead. Here is the dd-list of packages I
> identified:
[...]
> Antonio Terceiro <terceiro at debian.org>
>    ruby-openssl (U)

this is a false positive. the only ocurrance of "c_rehash" is in example
code and is a reference to a c_rehash.rb file in the same directory of
examples.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-openssl-devel/attachments/20180406/660fc2bf/attachment.sig>


More information about the Pkg-openssl-devel mailing list