Changeset 7b231190 for networking/netlibs/curl.xml

Timestamp:

02/03/2024 01:23:14 AM (5 months ago)

Author:

Douglas R. Reno <renodr@…>

Branches:

12.1, ken/TL2024, lazarus, rahul/power-profiles-daemon, trunk, xry111/llvm18

Children:

50ceb065

Parents:

51347047

Message:

Promote libpsl to recommended in wget, curl, and NetworkManager.

This is to protect against the "global cookie" issue outlined in
​https://daniel.haxx.se/blog/2024/01/10/psl-in-curl/

After some discussion we've decided to promote these to recommended, and
in cURL I've added a note that while the package can technically be
built without psl support, it's not recommended due to the security
implications.

File:

• networking/netlibs/curl.xml (modified) (1 diff)

networking/netlibs/curl.xml

@@ -85 +85 @@
     <bridgehead renderas="sect3">cURL Dependencies</bridgehead>
 
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="libpsl"/>
-    </para>
-
     <bridgehead renderas="sect4">Recommended</bridgehead>
     <para role="recommended">
-      <xref role="runtime" linkend="make-ca"/> (runtime)
+      <xref linkend="libpsl"/>
+    </para>
+
+    <note>
+      <para>
+        While there is an option to build the package without libpsl, both
+        the upstream developers and the BLFS editors alike highly recommend
+        not disabling support for libpsl due to severe security implications.
+      </para>
+    </note>
+
+    <bridgehead renderas="sect4">Recommended at runtime</bridgehead>
+    <para role="recommended">
+      <xref role="runtime" linkend="make-ca"/>
     </para>