From sacadmin Mon Sep 25 05:44:17 2006 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8PCiHuu027636; Mon, 25 Sep 2006 05:44:17 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6/Submit) id k8PCiHDM027630; Mon, 25 Sep 2006 05:44:17 -0700 (PDT) Date: Mon, 25 Sep 2006 05:44:17 -0700 (PDT) From: Darren J Moffat Message-Id: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> To: PSARC-EXT@sac.sfbay.sun.com Cc: Jan.Pechanec@Sun.COM, security-discuss@opensolaris.org Subject: Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] Status: RO Content-Length: 5073 Template Version: @(#)onepager.txt 1.29 04/11/15 SMI 1. Introduction 1.1. Project/Component Working Name: Move OpenSSL from /usr/sfw to /usr 1.2. Name of Document Author/Supplier: Author: Jan Pechanec 1.3. Date of This Document: Sep 22, 2006 1.5. Email Aliases: 1.5.1. Responsible Manager: Craig.Payne@Sun.COM 1.5.2. Responsible Engineer: Jan.Pechanec@Sun.COM 1.5.3. Marketing Manager: Mark.Thacker@Sun.COM 1.5.4. Interest List: OpenSSL-iteam@Sun.COM 2. Project Summary 2.1. Project Description: Move OpenSSL from /usr/sfw to /usr. It includes moving libraries, C header files, binaries, manual pages and a configuration file. 2.2. Risks and Assumptions: We will move libraries, headers, binaries and manual pages from non-standard/non-default locations to the default ones. There will be no change in the OpenSSL code or in API/ABI interfaces. That way all consumers will continue to work without any change. However, we should flag them so that they can remove those non-standard locations from their Makefiles, PATH and MANPATH variables etc. There might be a problem if any consumer used a full path for OpenSSL binary /usr/sfw/bin/openssl or libraries so that's another situation that will have to be checked with all consumers. We will keep symbolic link from /etc/sfw/openssl to /etc/openssl. This directory contains OpenSSL configuration file that is used for creation of certificates. 3. Business Summary 3.1. Problem Area: We should move OpenSSL to the standard system locations from non-standard ones. What's more, Gnome already ships GNU-TLS in /usr/lib so it might be confusing for our users to find one SSL/TLS toolkit in /usr/sfw and another competitive one in /usr. 3.4. Competitive Analysis: Quick analysis shows that FreeBSD, OpenBSD and Gentoo already ship OpenSSL in /usr/lib. HP-UX ships OpenSSL in /opt. Moving OpenSSL to /usr/ will also help third-party software autoconf scripts to find OpenSSL in Solaris more easily which is what our users will definitely benefit from. No more manually adding "--with-ssl-dir" options for configure scripts. 3.6. How will you know when you are done?: OpenSSL will be in /usr, which means that: - libraries will be in /usr/lib - header files will be in /usr/include - manual pages will be in /usr/share/man - binaries will be in /usr/bin - and configuration file will be in /etc/openssl 4. Technical Description: 4.1. Details: No existing functionality will be changed, no new functionlity will be added, no interfaces will be changed. Only one minor bug in addition to that RFE will be fixed - Makefile cleanup. The only thing that will be changed in this project will be Makefiles in OpenSSL and probably some Makefiles for OpenSSL's consumers residing in ON, to remove -l/-I/-R options that will be no longer neccessary. Part of the project will be also heads-up's to consumers outside of ON to clean up their Makefiles. Some some packaging files that contain /usr/sfw paths will be changed. 4.2. Bug/RFE Number(s): 6449514 move OpenSSL from /usr/sfw to /usr 6457487 clean up Makefile for cmd/openssl 4.5. Interfaces: Removed interfaces: none Changed interfaces: Location change from /usr/sfw to /usr only. New interfaces: none 4.5.1 Release binding A Minor release binding is requested. We do not intend to ever backport this as a patch or in an update release since the work to do so has no obvious benefit and could cause distruption in a patch. 4.6. Doc Impact: openssl.5 manual page will be updated so that it doesn't refer to /usr/sfw/man/man1/openssl.1 but to openssl(1) because we also move manual pages to system default location /usr/man. 4.7. Admin/Config Impact: none 4.10. Packaging & Delivery: new version will be delivered the same way as the old one was. 4.12. Dependencies: OpenSSL is used by several commands and libraries in ON (sendmail, pktool, kssladmin, wanboot, dns) and by other parts of Solaris outside of ON - Gnome, SFW, install and packaging tools (Install gate) and Sun Update Connection consolidation. project team will work with all of those consumers of OpenSSL in Solaris and will notify them that they will be allowed to remove anything what was needed to use to compensate for non-standard location of OpenSSL components. this project is not dependent on any other project. 4.13. Impact on Developers after this project is integrated, developers won't have to use a special options to let their tools know where OpenSSL is located. However, keeping using them won't cause any problems so this project will ensure backward compatibility. 5. Reference Documents: all relevant documentation about OpenSSL is on the open source project's homepage http://www.openssl.org/ internal website about Solaris's version of OpenSSL can be found on http://openssl.eng 6.5. ARC review type: FastTrack From sacadmin Wed Sep 27 15:35:24 2006 Received: from izimbra.SFBay.Sun.COM (izimbra.SFBay.Sun.COM [129.146.226.141]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8RMZOGM005014 for ; Wed, 27 Sep 2006 15:35:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by izimbra.SFBay.Sun.COM (8.13.8+Sun/8.13.8) with ESMTP id k8RMZOOD118245; Wed, 27 Sep 2006 15:35:24 -0700 (PDT) Date: Wed, 27 Sep 2006 15:35:24 -0700 (PDT) From: David.Comay@Sun.COM Sender: comay@izimbra.SFBay.Sun.COM To: Darren.Moffat@Sun.COM cc: PSARC-EXT@sac.sfbay.sun.com, Jan.Pechanec@Sun.COM, security-discuss@opensolaris.org Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-Reply-To: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> Message-ID: References: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Status: RO Content-Length: 1207 > 3.4. Competitive Analysis: > Moving OpenSSL to /usr/ will also help third-party software autoconf > scripts to find OpenSSL in Solaris more easily which is what our users > will definitely benefit from. No more manually adding "--with-ssl-dir" > options for configure scripts. Although I support the move of the OpenSSL components out of /usr/sfw, I think it's important to realize the above benefit is a mixed blessing. While certainly configure scripts will more easily discover the presence of OpenSSL in the system, it also makes that resulting software more susceptible to incompatible changes in the future. A good example of this occurred with the introduction of PSARC 2006/019 OpenSSL upgrade to 0.9.8a which caused numerous already-compiled third-party components to fail[1] since the previous revision of the library (0.9.7) no longer existed on the system. As OpenSSL was ARC'ed at a Volatile (nee External) commitment level, such a change was completely allowed but it needs to be carefully communicated to the community and other open-source developers. dsc [1] As an example, roughly 4% of the Companion CD needs to be recompiled in order to work with the updated OpenSSL. From sacadmin Wed Sep 27 15:58:02 2006 Received: from izimbra.SFBay.Sun.COM (izimbra.SFBay.Sun.COM [129.146.226.141]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8RMw2SU006219 for ; Wed, 27 Sep 2006 15:58:02 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by izimbra.SFBay.Sun.COM (8.13.8+Sun/8.13.8) with ESMTP id k8RMw1xu118314; Wed, 27 Sep 2006 15:58:01 -0700 (PDT) Date: Wed, 27 Sep 2006 15:58:01 -0700 (PDT) From: David.Comay@Sun.COM Sender: comay@izimbra.SFBay.Sun.COM To: Darren.Moffat@Sun.COM cc: PSARC-EXT@sac.sfbay.sun.com, Jan.Pechanec@Sun.COM, security-discuss@opensolaris.org Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-Reply-To: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> Message-ID: References: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Status: RO Content-Length: 442 > There might be a problem if any consumer used a full path for OpenSSL > binary /usr/sfw/bin/openssl or libraries so that's another situation > that will have to be checked with all consumers. [ my apologies, one additional question ] Besides the proposed symbolic link for /etc/sfw/openssl, does the project plan to introduce any others such as one for /usr/sfw/bin/openssl or other OpenSSL commands delivered under /usr/sfw/bin? dsc From sacadmin Thu Sep 28 02:25:11 2006 Received: from sfbaymail1sca.SFBay.Sun.COM (sfbaymail1sca.SFBay.Sun.COM [129.145.154.35]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8S9PBWL015912 for ; Thu, 28 Sep 2006 02:25:11 -0700 (PDT) Received: from gmp-ea-fw-1.sun.com (gmpes-gis-mail-1.UK.Sun.COM [129.156.42.5]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8S9PAEB001222 for ; Thu, 28 Sep 2006 02:25:10 -0700 (PDT) Received: from d1-emea-10.sun.com (d1-emea-10.sun.com [192.18.2.120] (may be forged)) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id k8S9P24A022389 for ; Thu, 28 Sep 2006 10:25:04 +0100 (BST) Received: from conversion-daemon.d1-emea-10.sun.com by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0J6A00E01Q3I7B00@d1-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-EXT@sac.sfbay.sun.com; Thu, 28 Sep 2006 10:25:02 +0100 (BST) Received: from [129.150.120.190] by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0J6A00460Q5OCX10@d1-emea-10.sun.com>; Thu, 28 Sep 2006 10:25:01 +0100 (BST) Date: Thu, 28 Sep 2006 10:24:56 +0100 From: Darren J Moffat Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-reply-to: Sender: Darren.Moffat@Sun.COM To: David.Comay@Sun.COM Cc: PSARC-EXT@sac.sfbay.sun.com, Jan.Pechanec@Sun.COM, security-discuss@opensolaris.org Message-id: <451B94E8.40707@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT References: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> User-Agent: Thunderbird 1.5.0.5 (X11/20060828) Status: RO Content-Length: 1130 David.Comay@Sun.COM wrote: >> 3.4. Competitive Analysis: > >> Moving OpenSSL to /usr/ will also help third-party software autoconf >> scripts to find OpenSSL in Solaris more easily which is what our >> users >> will definitely benefit from. No more manually adding >> "--with-ssl-dir" >> options for configure scripts. > > Although I support the move of the OpenSSL components out of /usr/sfw, > I think it's important to realize the above benefit is a mixed > blessing. While certainly configure scripts will more easily discover > the presence of OpenSSL in the system, it also makes that resulting > software more susceptible to incompatible changes in the future. A > good example of this occurred with the introduction of > > PSARC 2006/019 OpenSSL upgrade to 0.9.8a I don't see how the libs being in /usr/lib versus /usr/sfw/lib makes any difference. If you use the one that is in Solaris you use it as Volatile (External) and that means you have to take the meager binary compatibility that OpenSSL gives. If you don't want that don't use OpenSSL use something else. -- Darren J Moffat From sacadmin Thu Sep 28 04:22:02 2006 Received: from phys-bohemia2-1 (phys-bohemia2-1.Czech.Sun.COM [129.157.72.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8SBM128017654 for ; Thu, 28 Sep 2006 04:22:02 -0700 (PDT) Received: from conversion-daemon.bohemia2-mail1.czech.sun.com by bohemia2-mail1.czech.sun.com (iPlanet Messaging Server 5.2 HotFix 1.24 (built Dec 19 2003)) id <0J6A00301V6D1S@bohemia2-mail1.czech.sun.com> (original mail from Jan.Pechanec@Sun.COM) for PSARC-EXT@sac.sfbay.sun.com; Thu, 28 Sep 2006 13:22:00 +0200 (CEST) Received: from andal (andal.Czech.Sun.COM [129.157.18.59]) by bohemia2-mail1.czech.sun.com (iPlanet Messaging Server 5.2 HotFix 1.24 (built Dec 19 2003)) with ESMTP id <0J6A00MJFVKOOP@bohemia2-mail1.czech.sun.com>; Thu, 28 Sep 2006 13:22:00 +0200 (CEST) Date: Thu, 28 Sep 2006 13:21:31 +0200 (CEST) From: Jan Pechanec Subject: Re: [security-discuss] Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-reply-to: X-X-Sender: jp161948@andal To: David.Comay@Sun.COM Cc: Darren.Moffat@Sun.COM, security-discuss@opensolaris.org, PSARC-EXT@sac.sfbay.sun.com Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII References: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> Status: RO Content-Length: 819 On Wed, 27 Sep 2006 David.Comay@sun.com wrote: >> There might be a problem if any consumer used a full path for OpenSSL >> binary /usr/sfw/bin/openssl or libraries so that's another situation >> that will have to be checked with all consumers. > > [ my apologies, one additional question ] > > Besides the proposed symbolic link for /etc/sfw/openssl, does the > project plan to introduce any others such as one for > /usr/sfw/bin/openssl or other OpenSSL commands delivered under > /usr/sfw/bin? my intention is not to do that if I'm allowed not to. I know that that will break scripts that use full path /usr/sfw/bin/openssl - so, can I do that (= force people to fix such scripts) with reference to the fact that we are moving it to the default PATH location from a non default one? Jan. -- Jan Pechanec From sacadmin Thu Sep 28 23:16:46 2006 Received: from jurassic.eng.sun.com (jurassic.SFBay.Sun.COM [129.146.228.50]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8T6GkqJ026184 for ; Thu, 28 Sep 2006 23:16:46 -0700 (PDT) Received: from hawaiian-sun (vpn-129-150-12-95.SFBay.Sun.COM [129.150.12.95]) by jurassic.eng.sun.com (8.13.8+Sun/8.13.8) with SMTP id k8T6GbqD105720; Thu, 28 Sep 2006 23:16:42 -0700 (PDT) Message-Id: <200609290616.k8T6GbqD105720@jurassic.eng.sun.com> Date: Thu, 28 Sep 2006 20:16:26 -1000 (HST) From: Joseph Kowalski Reply-To: Joseph Kowalski Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] To: David.Comay@sun.com, Darren.Moffat@sun.com Cc: PSARC-EXT@sac.sfbay.sun.com, Jan.Pechanec@sun.com, security-discuss@opensolaris.org MIME-Version: 1.0 Content-Type: TEXT/plain; charset=us-ascii Content-MD5: w/Gvtapqb3dGh1kX4ufPSg== X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_20 SunOS 5.11 i86pc i386 Status: RO Content-Length: 928 > From: Darren J Moffat ... > I don't see how the libs being in /usr/lib versus /usr/sfw/lib makes any > difference. If you use the one that is in Solaris you use it as > Volatile (External) and that means you have to take the meager binary > compatibility that OpenSSL gives. > > If you don't want that don't use OpenSSL use something else. Right. I hope and pray that by the time Nevada becomes Solaris something, that no actual files live in /usr/sfw. It would only have symbolic links for compatibility purposes. It was an idea that maybe had short-term merit, but the world evolved in such a way to make it not such a good idea. Maybe a better way to express my "vision" would be that a grep of the man pages for the string "/sfw/" would return empty. Unfortunately, some of the people who seemed eager to make this happen have been reassigned and have different priorities now. - jek3 From sacadmin Fri Sep 29 09:47:14 2006 Received: from phys-bohemia2-1 (phys-bohemia2-1.Czech.Sun.COM [129.157.72.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8TGlDul007752 for ; Fri, 29 Sep 2006 09:47:13 -0700 (PDT) Received: from conversion-daemon.bohemia2-mail1.czech.sun.com by bohemia2-mail1.czech.sun.com (iPlanet Messaging Server 5.2 HotFix 1.24 (built Dec 19 2003)) id <0J6D00J01580KN@bohemia2-mail1.czech.sun.com> (original mail from Jan.Pechanec@Sun.COM) for PSARC-EXT@sac.sfbay.sun.com; Fri, 29 Sep 2006 18:47:11 +0200 (CEST) Received: from andal (andal.Czech.Sun.COM [129.157.18.59]) by bohemia2-mail1.czech.sun.com (iPlanet Messaging Server 5.2 HotFix 1.24 (built Dec 19 2003)) with ESMTP id <0J6D004TI5AN9N@bohemia2-mail1.czech.sun.com>; Fri, 29 Sep 2006 18:47:11 +0200 (CEST) Date: Fri, 29 Sep 2006 18:46:43 +0200 (CEST) From: Jan Pechanec Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-reply-to: <200609290616.k8T6GbqD105720@jurassic.eng.sun.com> X-X-Sender: jp161948@andal To: Joseph Kowalski Cc: David.Comay@Sun.COM, Darren.Moffat@Sun.COM, PSARC-EXT@sac.sfbay.sun.com, security-discuss@opensolaris.org Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII References: <200609290616.k8T6GbqD105720@jurassic.eng.sun.com> Status: RO Content-Length: 715 On Thu, 28 Sep 2006, Joseph Kowalski wrote: >I hope and pray that by the time Nevada becomes Solaris something, that >no actual files live in /usr/sfw. It would only have symbolic links for >compatibility purposes. It was an idea that maybe had short-term >merit, but the world evolved in such a way to make it not such a good idea. hi, I would like to repeat my question since this is something I'm not sure how to solve - is /usr/sfw/bin/openssl link to /usr/bin/openssl then neccessary or can I not to create it? how would that work if /usr/sfw would be just full of symbolic links? Would it go away completely after some time or would we have to keep delivering them? thanks, Jan. -- Jan Pechanec From sacadmin Fri Sep 29 11:27:21 2006 Received: from izimbra.SFBay.Sun.COM (izimbra.SFBay.Sun.COM [129.146.226.141]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8TIRLZg012375 for ; Fri, 29 Sep 2006 11:27:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by izimbra.SFBay.Sun.COM (8.13.8+Sun/8.13.8) with ESMTP id k8TIRJbe102304; Fri, 29 Sep 2006 11:27:19 -0700 (PDT) Date: Fri, 29 Sep 2006 11:27:19 -0700 (PDT) From: David.Comay@Sun.COM Sender: comay@izimbra.SFBay.Sun.COM To: Darren J Moffat cc: Jan.Pechanec@Sun.COM, security-discuss@opensolaris.org, PSARC-EXT@sac.sfbay.sun.com Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-Reply-To: <451B94E8.40707@Sun.COM> Message-ID: References: <200609251244.k8PCiHDM027630@sac.sfbay.sun.com> <451B94E8.40707@Sun.COM> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Status: RO Content-Length: 592 > I don't see how the libs being in /usr/lib versus /usr/sfw/lib makes any > difference. If you use the one that is in Solaris you use it as Volatile > (External) and that means you have to take the meager binary compatibility > that OpenSSL gives. Understood. I was simply pointing out that the justification that configure scripts will now find the OpenSolaris supplied version may be a mixed blessing (especially since we are not following the OpenSolaris Perl model of keeping the older version around for one release cycle to give users time to recompile their applications). dsc From sacadmin Fri Sep 29 11:34:43 2006 Received: from jurassic.eng.sun.com (jurassic.SFBay.Sun.COM [129.146.108.38]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8TIYh8A012528 for ; Fri, 29 Sep 2006 11:34:43 -0700 (PDT) Received: from hawaiian-sun (vpn-129-150-12-95.SFBay.Sun.COM [129.150.12.95]) by jurassic.eng.sun.com (8.13.8+Sun/8.13.8) with SMTP id k8TIYbXL322581; Fri, 29 Sep 2006 11:34:41 -0700 (PDT) Message-Id: <200609291834.k8TIYbXL322581@jurassic.eng.sun.com> Date: Fri, 29 Sep 2006 08:34:24 -1000 (HST) From: Joseph Kowalski Reply-To: Joseph Kowalski Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] To: Joseph.Kowalski@eng.sun.com, Jan.Pechanec@sun.com Cc: David.Comay@sun.com, Darren.Moffat@sun.com, PSARC-EXT@sac.sfbay.sun.com, security-discuss@opensolaris.org MIME-Version: 1.0 Content-Type: TEXT/plain; charset=us-ascii Content-MD5: d/Fl4HrRlYZGcWIZjGNsXA== X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_20 SunOS 5.11 i86pc i386 Status: RO Content-Length: 1459 > From: Jan Pechanec ... > On Thu, 28 Sep 2006, Joseph Kowalski wrote: > > >I hope and pray that by the time Nevada becomes Solaris something, that > >no actual files live in /usr/sfw. It would only have symbolic links for > >compatibility purposes. It was an idea that maybe had short-term > >merit, but the world evolved in such a way to make it not such a good idea. > > hi, I would like to repeat my question since this is something I'm > not sure how to solve - is /usr/sfw/bin/openssl link to /usr/bin/openssl > then neccessary or can I not to create it? > > how would that work if /usr/sfw would be just full of symbolic > links? Would it go away completely after some time or would we have to keep > delivering them? > > thanks, Jan. Well, since this is the first detailed case in the slow death of /usr/sfw, it gets to propose and we get to decide. I think you will need to deliver the link. You certainly will need to deliver the link as long as there is a conflict between the commitment level and the release binding. It could probably be deleted by the rules once such a conflict doesn't exist, but my view is that the link is such low cost that it should be delivered and probably delivered until a project appears in 2027 to remove all the /usr/sfs links. Having them disappear randomly would certainly confuse customers. Until an ARC case or two on this passes, the above is just my opinion. - jek3 From sacadmin Mon Oct 2 01:44:25 2006 Received: from phys-bohemia2-1 (phys-bohemia2-1.Czech.Sun.COM [129.157.72.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k928iOVN025585 for ; Mon, 2 Oct 2006 01:44:24 -0700 (PDT) Received: from conversion-daemon.bohemia2-mail1.czech.sun.com by bohemia2-mail1.czech.sun.com (iPlanet Messaging Server 5.2 HotFix 1.24 (built Dec 19 2003)) id <0J6I001011KTG4@bohemia2-mail1.czech.sun.com> (original mail from Jan.Pechanec@Sun.COM) for PSARC-EXT@sac.sfbay.sun.com; Mon, 02 Oct 2006 10:44:23 +0200 (CEST) Received: from andal (andal.Czech.Sun.COM [129.157.18.59]) by bohemia2-mail1.czech.sun.com (iPlanet Messaging Server 5.2 HotFix 1.24 (built Dec 19 2003)) with ESMTP id <0J6I004762XYDA@bohemia2-mail1.czech.sun.com>; Mon, 02 Oct 2006 10:44:22 +0200 (CEST) Date: Mon, 02 Oct 2006 10:43:51 +0200 (CEST) From: Jan Pechanec Subject: Re: [osol-arc] Move OpenSSL to /usr [PSARC-EXT/2006/555 Timeout: 10/02/2006] In-reply-to: <200609291834.k8TIYbXL322581@jurassic.eng.sun.com> X-X-Sender: jp161948@andal To: Joseph Kowalski Cc: David.Comay@Sun.COM, Darren.Moffat@Sun.COM, PSARC-EXT@sac.sfbay.sun.com, security-discuss@opensolaris.org Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII References: <200609291834.k8TIYbXL322581@jurassic.eng.sun.com> Status: RO Content-Length: 948 On Fri, 29 Sep 2006, Joseph Kowalski wrote: >> hi, I would like to repeat my question since this is something I'm >> not sure how to solve - is /usr/sfw/bin/openssl link to /usr/bin/openssl >> then neccessary or can I not to create it? >> >> how would that work if /usr/sfw would be just full of symbolic >> links? Would it go away completely after some time or would we have to keep >> delivering them? >> >> thanks, Jan. > >Well, since this is the first detailed case in the slow death of /usr/sfw, >it gets to propose and we get to decide. > >I think you will need to deliver the link. You certainly will need to >deliver the link as long as there is a conflict between the commitment >level and the release binding. It could probably be deleted by the ok, I'm just noting that the creation of the link is not in the onepager. Of course it's not a problem for me to create it if decided. thanks for info, Jan. -- Jan Pechanec From sacadmin Thu Oct 19 08:58:32 2006 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k9JFwVSC011747 for ; Thu, 19 Oct 2006 08:58:32 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id k9JFwRTr011708 for <@sunmail1brm.central.sun.com:psarc@sun.com>; Thu, 19 Oct 2006 23:58:30 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0J7E00J074DH5X00@brm-avmta-1.central.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Thu, 19 Oct 2006 09:58:29 -0600 (MDT) Received: from gmp-ea-fw-1.sun.com ([129.156.42.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0J7E00G7E4DGCK40@brm-avmta-1.central.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Thu, 19 Oct 2006 09:58:29 -0600 (MDT) Received: from d1-emea-10.sun.com ([192.18.2.120]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id k9JFwRis020942 for ; Thu, 19 Oct 2006 16:58:27 +0100 (BST) Received: from conversion-daemon.d1-emea-10.sun.com by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0J7E004014BTP500@d1-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for psarc@sun.com (ORCPT psarc@sun.com); Thu, 19 Oct 2006 16:58:27 +0100 (BST) Received: from [129.156.173.21] by d1-emea-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0J7E00IJZ4DEFF20@d1-emea-10.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Thu, 19 Oct 2006 16:58:27 +0100 (BST) Date: Thu, 19 Oct 2006 16:58:26 +0100 From: Darren J Moffat Subject: PSARC/2006/555 Move OpenSSL to /usr Sender: Darren.Moffat@sun.com To: psarc@sun.com, Jan Pechanec Message-id: <4537A0A2.4000103@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 1.5.0.5 (X11/20060912) Status: RO Content-Length: 50 This case has been approved. -- Darren J Moffat