Re: TLS support: gnutls and/or openssl

ma, 2018-10-29 kello 11:29 +0100, Xavier Bachelot kirjoitti:
> Hi,
> 
> I have been using xine-lib snapshot lately and have enabled TLS
> support 
> by adding the devel headers for both gnutls and openssl. Both 
> xineplug_tls_gnutls.so and xineplug_tls_openssl.so are then compiled.
> However, I'm wondering if one is preferred over the other ?

by default, gnutls has higher priority:

tls/tls_gnutls.c:   .priority = 10,
tls/tls_openssl.c:  .priority = 5,

so gnutls is used unless it fails to load.


I don't know which one should be preferred, I guess it is up to distro
policy ... ? One could ex. select the one with better performance on
the hardware / arch used. Or the one with smaller binary size. Or the
one with more suitable license.

Having support for both allows faster response to possible security
issues in underlying tls implementations; one can just push updated
packeges without "broken" plugin.

With my limited knowledge I'd prefer gnutls. There used to be license
issues with OpenSSL, but I don't know if those exist anymore. Or how to
handle those with least effort ... Maybe adding an exception to tls
plugin license would be enough (loader interface is "generic" and
plugins can be distributed separately).

> Is it wise 
> to have both built and shipped at the same time ?

You need only one, but having both makes no harm.

It adds ~100kb to install size, but there shouldn't be any measurable
runtime performance impact.

> Regards,
> Xavier
> 
> 
> _______________________________________________
> xine-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/xine-devel