configure does not allow choosing the md5 implementation

[Diego Elio Pettenò]

While the md5 implementation currently can be either of OpenSSL's libcrypto or GnuTLS's OpenSSL compatibility layer, there seem to be no way to choose between the two of them using the configure script, without tricking it with an ac_cv_* variable.

Choosing the implementation is important for source-based distributions such as Gentoo because curl also has multiple SSL implementations, and if both http-auth and md5 plugins are enabled, they should use the same implementation to avoid linking conflicts at runtime.

[Monty Taylor (mordred)]

Darn. I was hoping no-one would notice that... :)

Diego E. Flameeyes Pettenò wrote:
> Public bug reported:
>
> While the md5 implementation currently can be either of OpenSSL's
> libcrypto or GnuTLS's OpenSSL compatibility layer, there seem to be no
> way to choose between the two of them using the configure script,
> without tricking it with an ac_cv_* variable.
>
> Choosing the implementation is important for source-based distributions
> such as Gentoo because curl also has multiple SSL implementations, and
> if both http-auth and md5 plugins are enabled, they should use the same
> implementation to avoid linking conflicts at runtime.
>
> ** Affects: drizzle
> Importance: Undecided
> Status: New
>

[Brian Aker (brianaker)]

Hmmm while this is typically not what we do, the MD5 code is the same in all projects, and is never touched. We do need a signature function in Drizzle, so we might consider having it built in.

Which of course is moving backwards... but it is a thought we should consider.

[Monty Taylor (mordred)]

On 03/18/2010 03:18 PM, Brian Aker wrote:
> Hmmm while this is typically not what we do, the MD5 code is the same in
> all projects, and is never touched. We do need a signature function in
> Drizzle, so we might consider having it built in.
>
> Which of course is moving backwards... but it is a thought we should
> consider.
>

I think there is a very simple way to add a selection flag for this - I
just haven't done it yet because I haven't needed to. :)

[Stewart Smith (stewart)]

On Thu, Mar 18, 2010 at 10:18:51PM -0000, Brian Aker wrote:
> Hmmm while this is typically not what we do, the MD5 code is the same in
> all projects, and is never touched. We do need a signature function in
> Drizzle, so we might consider having it built in.
>
> Which of course is moving backwards... but it is a thought we should
> consider.

we should use libs... will take advantage of hardware accelleration
where available.

--
Stewart Smith

[Diego Elio Pettenò (flameeyes)]

The main problem is that the MD5 symbols provided by GnuTLS use the same name as those from OpenSSL's libcrypto… which means that if the two libraries are loaded in the same address space, symbol collisions happen and those are never good. Unfortunately not even on GNU/Linux (using the GNU/ prefix to refer to glibc-based) GnuTLS uses versioning to avoid colliding between the two.

An alternative would be to use a different library altogether that does not collide with either, to avoid bringing them in object space, such as libgcrypt.

[Monty Taylor (mordred)]

Ooh. The "use libgcrypt instead" suggestion sounds like a winner. Smaller, less crazy depend. And it was an optional depend anyway. LGPL. Win.