Re: Plea for base system trim

2003-03-05 Thread Doug Barton
On Wed, 5 Mar 2003, Subscriber wrote: Would the powers that be please consider removing sendmail, bind and openssl from the base system, as was done for perl with 5.0? This topic has been discussed ad nauseum, and the consensus has always been that those three things (and openssh) should stay

Re: Plea for base system trim

2003-03-05 Thread Doug Barton
D'oh, I forgot the other half of my response (I KNOW you're disappointed by this). :) A big part of the reason that perl was cut is that bmake'ing the build was a NIGHTMARE. By contrast, the BIND bmake glue is not terribly difficult to maintain. The other contributing factors were the license

Re: Plea for base system trim

2003-03-05 Thread David Schultz
Thus spake Subscriber [EMAIL PROTECTED]: Would the powers that be please consider removing sendmail, bind and openssl from the base system, as was done for perl with 5.0? Please don't restart this flamewar. When we have a better installer, then it may be possible in the future to select

Re: Plea for base system trim

2003-03-05 Thread Jacques A. Vidrine
On Wed, Mar 05, 2003 at 09:54:13AM -, Subscriber wrote: Having just done two rebuilds for recent OpenSSL and sendmail vulnerabilities, I was surprised to discover that building the port of apache13-modssl required the build of a port version of OpenSSL when I had the most updated (4.7)

Re: Plea for base system trim

2003-03-05 Thread ianf
Subscriber wrote: Would the powers that be please consider removing sendmail, bind and openssl from the base system, as was done for perl with 5.0? There are /etc/make.conf variables to control this so you can do it for yourself: #NO_BIND= true# do not build BIND #NO_OPENSSH=

Re: Plea for base system trim

2003-03-05 Thread Brooks Davis
On Wed, Mar 05, 2003 at 07:43:15AM -0600, Jacques A. Vidrine wrote: On Wed, Mar 05, 2003 at 09:54:13AM -, Subscriber wrote: Having just done two rebuilds for recent OpenSSL and sendmail vulnerabilities, I was surprised to discover that building the port of apache13-modssl required the

Re: Plea for base system trim

2003-03-05 Thread Adrian Steinmann
I use this command in my build script to force apache13+modssl to use the openssl in base. # Use base openssl (OpenSSL 0.9.7a as of Feb 19 2003) cd /usr/ports/www/apache13-modssl cp Makefile Makefile- sed -ie 's/^\.include.*Makefile\.ssl.*$/OPENSSLBASE=\/usr/' Makefile- Makefile You wrote:

Re: Plea for base system trim

2003-03-05 Thread Jacques A. Vidrine
On Wed, Mar 05, 2003 at 08:54:28AM -0800, Brooks Davis wrote: At least in the case of net/net-snmp the problem is that the shared lib version of the openssl port was bumped when the base wasn't which screws up the dependencies. :-( That's part of the problem. The port bumped the shared

Re: Plea for base system trim

2003-03-05 Thread Barney Wolff
I have both apache-modssl and net-snmp running, but do NOT have the openssl port installed. Everything builds and runs fine, with no mods to anything. I conjecture that the problem others experience is that they have installed the openssl port, which I have never done. This is on both current

Re: Plea for base system trim

2003-03-05 Thread Brooks Davis
On Wed, Mar 05, 2003 at 01:15:29PM -0500, Barney Wolff wrote: I have both apache-modssl and net-snmp running, but do NOT have the openssl port installed. Everything builds and runs fine, with no mods to anything. I conjecture that the problem others experience is that they have installed the

Re: Plea for base system trim

2003-03-05 Thread Doug Barton
On Wed, 5 Mar 2003, Adrian Steinmann wrote: I use this command in my build script to force apache13+modssl to use the openssl in base. # Use base openssl (OpenSSL 0.9.7a as of Feb 19 2003) cd /usr/ports/www/apache13-modssl cp Makefile Makefile- sed -ie

Re: Plea for base system trim

2003-03-05 Thread The Anarcat
On Wed Mar 05, 2003 at 02:29:00PM -0800, Doug Barton wrote: On Wed, 5 Mar 2003, Adrian Steinmann wrote: I use this command in my build script to force apache13+modssl to use the openssl in base. # Use base openssl (OpenSSL 0.9.7a as of Feb 19 2003) cd /usr/ports/www/apache13-modssl

Re: Plea for base system trim

2003-03-05 Thread Philip Paeps
On 2003-03-05 02:14:16 (-0800), Doug Barton [EMAIL PROTECTED] wrote: On Wed, 5 Mar 2003, Subscriber wrote: Would the powers that be please consider removing sendmail, bind and openssl from the base system, as was done for perl with 5.0? For example, as BIND maintainer I actually _support_

Re: Plea for base system trim

2003-03-05 Thread Doug Barton
On Wed, 5 Mar 2003, The Anarcat wrote: Juste jumping in... Couldn't you just: sed -i.orig -e pattern Makefile No, because sed -i is evil, and will cause you to have hairy palms. -- This .signature sanitized for your protection To Unsubscribe: send mail to [EMAIL PROTECTED] with

Re: Plea for base system trim

2003-03-05 Thread The Anarcat
On Wed Mar 05, 2003 at 03:52:22PM -0800, Doug Barton wrote: On Wed, 5 Mar 2003, The Anarcat wrote: Juste jumping in... Couldn't you just: sed -i.orig -e pattern Makefile No, because sed -i is evil, and will cause you to have hairy palms. What? A. To Unsubscribe: send mail to [EMAIL

Re: Plea for base system trim

2003-03-05 Thread Doug Barton
On Thu, 6 Mar 2003, Philip Paeps wrote: Is it actually possible for one to build a custom release without the ``unnecessary'' BIND bits? I haven't grepped the source, forgive me, but what does 'NO_BIND=true' actually do? If I were to make a release like that, would that end me up without

Re: Plea for base system trim

2003-03-05 Thread Philip Paeps
On 2003-03-05 16:46:04 (-0800), Doug Barton [EMAIL PROTECTED] wrote: On Thu, 6 Mar 2003, Philip Paeps wrote: Is it actually possible for one to build a custom release without the ``unnecessary'' BIND bits? I haven't grepped the source, forgive me, but what does 'NO_BIND=true' actually do?

Re: Plea for base system trim

2003-03-05 Thread Brad Knowles
At 2:07 AM +0100 2003/03/06, Philip Paeps wrote: Speaking of ndc, I think that's a BIND8-ism. Indeed, it is. With BIND-9, ndc won't even work -- Unix sockets aren't supported, and IP sockets are secured with crypto keys. Could the port be

Re: Plea for base system trim

2003-03-05 Thread Doug Barton
On Thu, 6 Mar 2003, Philip Paeps wrote: That way, both named and ndc see the same picture of the system, in and out of the chroot tree. Speaking of ndc, I think that's a BIND8-ism. Not _exactly_ true, but yes, ndc is what you use to manage BIND 8. All comparisons to tools that you may or

Re: Plea for base system trim

2003-03-05 Thread Philip Paeps
On 2003-03-06 02:17:19 (+0100), Brad Knowles [EMAIL PROTECTED] wrote: At 2:07 AM +0100 2003/03/06, Philip Paeps wrote: Speaking of ndc, I think that's a BIND8-ism. Indeed, it is. With BIND-9, ndc won't even work I discovered that the unpleasant way. Typing ndc gave me a long list of