<callout type="danger">
**Note:**
As of %%FreeBSD%% 10.3-RC1 this is a working proof of concept for the RELEASE branch.
</callout>

====== FreeBSD 10.3 Release ======

The 10.3 version is based on the work done in [[https://hardenedbsd.org|HardenedBSD]] on the master branch (%%FreeBSD%% CURRENT). The question there was if we could devise a structure that allows building with %%LibreSSL%% whilst not replacing %%OpenSSL%%. Replacing %%OpenSSL%% causes issues with maintaining a forked repo.

{{https://cloud.githubusercontent.com/assets/7547697/13683368/9a2d31f0-e706-11e5-8c72-4f66273040ac.png|LibreBSD}}

%%**%%Before you ask:%%**%% This will not be a fork! I intend to maintain this as a patch-set for the most recent release of %%FreeBSD%% and will maintain it for [[https://hardenedbsd.org|HardenedBSD]] as well.

Early March 2016 I managed to get %%LibreSSL%% to build, and all binaries to link to it on %%HardenedBSD%%. The patches were created on a derivative of the -to be released later this year- %%FreeBSD%% 11. See my earlier blog-posts for more details [[https://brnrd.eu/libressl/2016-03-05/libressl-in-hardenedbsd-base-part-i.html|Part I]] and [[https://brnrd.eu/libressl/2016-03-06/libressl-in-hardenedbsd-base-part-ii.html|Part II]].

I had tried to replace %%OpenSSL%% in %%FreeBSD%% 10 when I was at %%OpenBSD%%'s %%LibreSSL%% hackathon in Varaždin (Croatia) last year but hadn't managed to complete the project. The release of %%LibreSSL%% 2.3 also removed SSLv3 so my attention was on fixing fallout from that removal. 'Evidence' of that work and the patches can be found in [[OpenSSL/No-SSLv3|the No-SSLv3]] wiki article. As it turned out this time, it wasn't extremely difficult to do so I thought it wouldn't take too much time to do this for %%FreeBSD%% 10 as well. %%FreeBSD%% 10.3 is nearing its completion, so where better to start than with the current first Release Candidate!

%%**%%Feedback appreciated:%%**%% I haven't replayed all the steps here, do let me know where I've hidden my typos and mistakes! (email, Twitter, [[/GitHub|GitHub]], Facebook, avionary)

===== The 'recipe' =====

%%**%%You'll need to select the correct branch for your %%FreeBSD%% version%%**%%

  - Download the [[http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.3.tar.gz|LibreSSL 2.3 tarball]]
    * Extract this tarball into /usr/src/crypto and rename the directory from ''%%libressl-2.3.3%%'' to ''%%libressl%%''
  - Apply the patch-set from [[https://github.com/Sp1l/LibreBSD/tree/FreeBSD-10.3/patchset|my GitHub repo]]
  - Add WITH_LIBRESSL=yes to /etc/src.conf
  - Rebuild and install your kernel and world (see the [[https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html|FreeBSD handbook chapter]] for detail)
  - Reboot

==== Commands ====

As commands (assuming you already have checked out %%FreeBSD%% 10.3 into /usr/src)

<code bash>
cd ~
mkdir download && cd download
fetch http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.3.tar.gz
fetch https://github.com/Sp1l/LibreBSD/raw/FreeBSD-10.3/patchset/patchset
cd /usr/src/crypto
tar xf ~/download/libressl-2.3.3.tar.gz
mv libressl-2.3.3 libressl
cd /usr/src
patch < ~/download/patchset
echo 'WITH_LIBRESSL=yes' >> /etc/src.conf
make buildworld && make buildkernel && make installkernel && make installworld
reboot
</code>

Line 3: You should verify the tarball using ''%%signify%%'' or ''%%gpg%%''.
Line 11: This should take quite a lot of time (probably hours) and is NOT the canonical way to do this. See the handbook [[https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html|chapter on rebuilding your system]] for a complete description!

Now that was easy wasn't it?

==== Update your ports ====

After upgrading the kernel and world you'll need to rebuild all ports. If before you had defined

<code make>
WITH_OPENSSL_PORT= yes
OPENSSL_PORT=	security/libressl-devel
</code>

you can now remove these bits, but then you should rebuild world and kernel after every update of %%LibreSSL%%. Unless the shared library version -and thus the ABI- stay the same.

==== Updating LibreSSL ====

If %%LibreSSL%% receives an update that has the same shared library version, you can use my guidance from [[BernardSpil/PartialWorldBuilds|the FreeBSD wiki]] after downloading/extracting the latest %%LibreSSL%% tarball as discussed in the previous paragraph.

<code bash>
cd /usr/src/secure/lib/libcrypto
make obj && make depend && make includes && make
make install
cd /usr/src/secure/lib/libssl
make clean && make depend && make includes && make
make install
cd /usr/src/secure/usr.bin/openssl
make clean && make
make install
</code>

===== The detail =====

Next to the patchset, I've also added all the files that were changed to my [[/GitHub|GitHub]] repo. The files are in their original location so you can use these as an overlay for your ''%%/usr/src%%''.

==== LibreSSL patches ====

%%FreeBSD%% 11 changed quite a lot in the build framework, so I had to adapt the patches for libcrypto, libssl and openssl accordingly. This made the build for the ''%%openssl%%'' binary fail, so I had to change

<code make>
LIBADD+= crypto ssl
</code>

into

<code make>
DPADD=  ${LIBSSL} ${LIBCRYPTO}
LDADD=  -lssl -lcrypto
</code>

The bulk of the patches I created for %%HardenedBSD%% just worked just fine on 10.3

==== base software patches ====

Most of the patches that I created for %%HardenedBSD%% applied cleanly.

  - The patches for ''%%libtelnet%%'' and ''%%ppp%%'' worked fine.
  - The ''%%wpa%%'' patches are not required, in 10.3 there's a much older version that doesn't have all the %%OpenSSL%% version checks.
  - The ''%%heimdal%%'' patches I've not yet tested but these patches.

====== FreeBSD CURRENT ======

AKA HEAD, master, 11, ...

The original patch set was created for [[https://hardenedbsd.org|HardenedBSD]] for their playground/master branch.

Early March 2016 I managed to get %%LibreSSL%% to build, and all binaries to link to it on %%HardenedBSD%%. The patches were created on a derivative of the -to be released later this year- %%FreeBSD%% 11. See my earlier blog-posts for more details [[https://brnrd.eu/libressl/2016-03-05/libressl-in-hardenedbsd-base-part-i.html|Part I]] and [[https://brnrd.eu/libressl/2016-03-06/libressl-in-hardenedbsd-base-part-ii.html|Part II]].

The build system for %%FreeBSD%% 11 is slightly different from the 10 branch. All of the resources you need can be found on [[https://github.com/HardenedBSD/hardenedBSD-playground/tree/hardened/current/libressl|the HardenedBSD-playground repo]] in the ''%%hardened/current/libressl%%'' branch.

===== recipe =====

The recipe doesn't differ from the recipe for 10.3 but you'll need a different patch-set.

===== TODO =====

  - Create a branch in [[https://github.com/Sp1l/LibreBSD|the LibreBSD repo]] for %%FreeBSD%% current.
  - Create a patch-set for vanilla %%FreeBSD%% head in the %%LibreBSD%% repository

====== Historical information ======

[[http://bsdxbsdx.blogspot.nl/2015/04/build-packages-in-poudriere-without.htm|Starting point]]

Base programs/libraries known to link with %%LibreSSL%% when installed as a port
  * sendmail
  * <del>libfetch (''%%fetch%%'' links to base libcrypto/ssl)</del> Fixed in 10.2?

===== Software linking to OpenSSL libs in base =====

  - ldns -> replace with ports' dns/ldns
  - pkg -> replace with ports' ports-mgmt/pkg
  - svnlite -> replace with ports' devel/subversion
  - libfetch -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=191951
  - bsdinstall
  - iscsi
  - ppp (also relies on deprecated des_ functions)
  - bsdmp (not in 10.2?)

bsdx' patches here http://www.egr.msu.edu/~mcdouga9/nossl-patches/

===== Make ssl/crypto in base private =====

[[http://www.allanjude.com/bsd/privatessl.patch|patch]]
[[https://github.com/freebsd/pkg/compare/master...allanjude:privatessl|Pre-req patch for pkg]]

===== Hackathon build =====

Really, really experimental!

  - Grab the tarball from github/libressl-portable/openbsd (NOT the portable bits!)
  - Hack the secure/lib/libcrypto/Makefile (align with %%OpenBSD%%'s lib/libcrypto/Makefile)