Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

switch to system-wide libtomcrypt library #711

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

xambroz
Copy link
Contributor

@xambroz xambroz commented Feb 3, 2023

Hello,
please would you consider switching to the system installed share library of libtomcrypt instead of embedding its code in this project?

There is libtom system package in major distributions:
Fedora/EPEL - https://src.fedoraproject.org/rpms/libtomcrypt
Ubuntu - https://packages.ubuntu.com/bionic/libtomcrypt-dev
Debian - https://packages.debian.org/search?keywords=libtomcrypt

Embedding the code makes it difficult to identify and update some vulnerable code in case it is found (from recent history for example log4shell / text4shell vulnerabilities). All major distributions have a rule that the usage of embedded code should be avoided when possible. Inclusion of this patch would make it easier for the distribution package maintainers to deal with the updates of your package.

Thank you
Michal Ambroz

@xambroz
Copy link
Contributor Author

xambroz commented Feb 3, 2023

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant