Using xmlsec on alpine. Is libressl really required?

[paulzakin]

Looking at the documentation, the libraries for Alpine are: apk add build-base libressl libffi-dev libressl-dev libxslt-dev libxml2-dev xmlsec-dev xmlsec.

However, if libressl and libressl dev really required? Alpine uses openssl by default now and on the most recent version of the Docker image python:3.13-alpine, install xmlsec-dev xmlsec, and run xmlsec1 --version. You see it is compiled with: xmlsec1 1.3.7 (openssl). So it seems to be using openssl?

And if you try to install libressl-dev with this command apk add --no-cache libressl libressl-dev libpq-dev xmlsec-dev xmlsec, you get the following conflict. And if you remove libpq-dev, and run xmlsec1 --version, it still outputs xmlsec1 1.3.7 (openssl). In short, I do not think libressl and libressl dev is required - but I do not know for sure. Hence, I am opening this issue. Thanks!

#14 3.292 (40/79) Installing libressl-dev (4.1.0-r0)
#14 3.308 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/aes.h owned by openssl-dev-3.5.1-r0.
#14 3.308 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/asn1.h owned by openssl-dev-3.5.1-r0.
#14 3.308 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/asn1t.h owned by openssl-dev-3.5.1-r0.
#14 3.308 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/bio.h owned by openssl-dev-3.5.1-r0.
#14 3.308 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/blowfish.h owned by openssl-dev-3.5.1-r0.
#14 3.308 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/bn.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/buffer.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/camellia.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/cast.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/cmac.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/cms.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/comp.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/conf.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/crypto.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ct.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/des.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/dh.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/dsa.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/dtls1.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ec.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ecdh.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ecdsa.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/engine.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/err.h owned by openssl-dev-3.5.1-r0.
#14 3.309 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/evp.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/hmac.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/idea.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/kdf.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/lhash.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/md4.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/md5.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/modes.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/obj_mac.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/objects.h owned by openssl-dev-3.5.1-r0.
#14 3.310 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ocsp.h owned by openssl-dev-3.5.1-r0.
#14 3.311 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/opensslconf.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/opensslv.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ossl_typ.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/pem.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/pkcs12.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/pkcs7.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/rand.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/rc2.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/rc4.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ripemd.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/rsa.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/safestack.h owned by openssl-dev-3.5.1-r0.
#14 3.312 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/sha.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/srtp.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ssl.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ssl3.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/stack.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/tls1.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ts.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/txt_db.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/ui.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/x509.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/x509_vfy.h owned by openssl-dev-3.5.1-r0.
#14 3.313 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/include/openssl/x509v3.h owned by openssl-dev-3.5.1-r0.
#14 3.411 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/lib/libcrypto.so owned by openssl-dev-3.5.1-r0.
#14 3.435 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/lib/libssl.so owned by openssl-dev-3.5.1-r0.
#14 3.439 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/lib/pkgconfig/libcrypto.pc owned by openssl-dev-3.5.1-r0.
#14 3.439 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/lib/pkgconfig/libssl.pc owned by openssl-dev-3.5.1-r0.
#14 3.439 ERROR: libressl-dev-4.1.0-r0: trying to overwrite usr/lib/pkgconfig/openssl.pc owned by openssl-dev-3.5.1-r0.

[mxamin]

I guess you're right, we don't need LibreSSL for linux Alpine. What I found was that Alpine switched from OpenSSL to LibreSSL in 3.5 (Dec 22, 2016), then back to OpenSSL in 3.9 (Jan 29, 2019). Since Alpine 3.17 (Nov 2022), the default is OpenSSL 3.x.
Basically we need to remove libressl and libressl-dev and add openssl and openssl-dev Can you create a PR for that?

[paulzakin]

Sure! To just update the README?

[mxamin]

Sure! To just update the README?

And docs: doc/source/install.rst

[paulzakin]

Ok! PR #373 open

[mxamin]

Thanks @paulzakin, I merged your PR.