Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

You don't need to use Crypt::SSLeay #258

Closed
nanis opened this issue Apr 6, 2017 · 1 comment
Closed

You don't need to use Crypt::SSLeay #258

nanis opened this issue Apr 6, 2017 · 1 comment

Comments

@nanis
Copy link

nanis commented Apr 6, 2017

If I understand correctly, the script wants to be able to make https connections using LWP. You don't need to depend on Crypt::SSLeay for that purpose. What you want is to have the users of the script install LWP::Protocol::https.

See also Do you need Crypt::SSLeay?:

Starting with version 6.02 of LWP, https support was unbundled into LWP::Protocol::https. This module specifies as one of its prerequisites IO::Socket::SSL which is automatically used by LWP::UserAgent unless this preference is overridden seperately. IO::Socket::SSL is a more complete implementation, and, crucially, it allows hostname verification. Crypt::SSLeay does not support this. At this point, Crypt::SSLeay is maintained to support existing software that already depends on it. However, it is possible that your software does not really depend on Crypt::SSLeay, only on the ability of LWP::UserAgent class to communicate with sites over SSL/TLS.

If you are using version LWP 6.02 or later, and therefore have installed LWP::Protocol::https and its dependencies, and do not explicitly use Net::SSL before loading LWP::UserAgent, or override the default socket class, you are probably using IO::Socket::SSL and do not really need Crypt::SSLeay.

Admittedly, I am not familiar with the script, but, as far as I can see, by virtue of the fact that the script loads LWP::UserAgent first, I am going to guess that Crypt::SSLeay is not used. You can verify this by printing the value of $Net::HTTPS::SSL_SOCKET_CLASS in your script. If you get something other than Net::SSL, you are not using Crypt::SSLeay.

@shirkdog
Copy link
Owner

shirkdog commented Dec 7, 2017

I have done a test with FreeBSD and removed SSLeay, it appears it is not needed for https and pulledpork to work. I will comment out SSLeay in this release, and will create a bug to remove it completely from the script in the next release.

shirkdog added a commit that referenced this issue Dec 7, 2017
@shirkdog shirkdog closed this as completed Dec 7, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants