Deprecate and eventually get rid of support of NSS as a crypto backend

[alexey-tikhonov]

Master branch should eventually drop support of libnss as a crypto backend.

Steps would be:
(I)

1. switch default to OpenSSL
2. warn about deprecation in the case NSS is selected during configuration
3. announce deprecation in the release notes of next upstream release

(II) finally remove support of libnss in (next+1) upstream release

[alexey-tikhonov]

Take a note, despite GH saying "linked a pull request that will close this issue", that's not the case - #1042 should not close this ticket.

[pbrezina]

• master
  • 8b2c4ad - config: switch to OpenSSL as default crypto backend

[alexey-tikhonov]

I will re-assign this ticket on @pbrezina awhile for "announce deprecation in the release notes of next upstream release" item.

[alexey-tikhonov]

I will re-assign this ticket on @pbrezina awhile for "announce deprecation in the release notes of next upstream release" item.

This item is done: https://sssd.github.io/docs/users/relnotes/notes_2_3_0.html

[alexey-tikhonov]

Took ticket back to do (II)

[alexey-tikhonov]

Hi @scabrero,

could you please clarify what is the difference between:

• https://build.opensuse.org/package/view_file/network:ldap/sssd/sssd.spec?expand=1
• https://build.opensuse.org/package/view_file/openSUSE:Factory/sssd/sssd.spec?expand=1
• https://build.opensuse.org/package/view_file/openSUSE:Leap:15.2/sssd/sssd.spec?expand=1
  ?

What I actually want to figure out: will it cause any troubles for openSUSE packager if we will drop support of libnss as cryptobackend in next 2.x upstream release?

I guess it shouldn't, since every spec-file uses --with-crypto=libcrypto.

[scabrero]

Hi @alexey-tikhonov,

each release maintains its own spec file in the build system, we don't use in-tree spec files. As you said, switching to openSSL is not a problem as we build with --with-crypto=libcrypto since long time ago.

Thanks for taking the time to ask.

[pbrezina]

Pushed PR: #5246

• master
  • a291148 - Get rid of "NSS DB" references.
  • 266ecc0 - Drop support of libnss as a crypto backend