0

Ubuntu 12.04 LTS provides OpenSSL 1.0.1e, but it disables TLSv1.1 and TLSv1.2. In the past it was an interop decision because of broken client implementations. In 2014, its really not appropriate since the clients have had time to fix their broken-ness. Any remaining broken clients are penalizing the majority of complying clients.

I want to provide the same version of OpenSSL 1.0.1e, but I want to provide the [currently] disabled protocols. I know I can create a Personal Package Archive (PPA), but its not clear to me if I can use it to override a Ubuntu base package.

(I also realize statically linked clients will not benefit from the improved packaging).

How does one provide an override to a specific package in Ubuntu?

1 Answers1

0

Yes, you can provide packages in a PPA that will install over top the standard Ubuntu packages. However, you will have to take the time to keep the packages up to date whenever new versions are released into Ubuntu. You may also want to check that it is still not enabled in the packages in Trusty as well. If it's already enabled in Trusty, then when 14.04 LTS is released in April 2014, it might be better to just upgrade. If it's not already enabled, you might want to discuss with the Ubuntu security team, about getting it enabled, by filing a bug report, and subscribing them to it.

You can do it by fixing the version number. For example, if the current version in Ubuntu is 1.0.1e-0ubuntu1, then you'll want to specify your version as 1.0.1e-0ubuntu1.1~12.04.1 for building in your PPA. Appending the .1~12.04.1 makes it higher than the current Ubuntu version, but lower than the next Ubuntu version (so that if there is a security update in Ubuntu, it will take precedence). The 12.04 portion specifies it's built for 12.04, and the final .1 is your build number (in case you make a mistake and need to rebuild the same package, you can bump this to .2 for example). You will also need to specify the appropriate release series code name in the debian/changelog file as precise for 12.04, though if building off the existing 12.04 packages, on 12.04, should be set by default already.

dobey
  • 41,650