Fossil SCM

Clarified the early parts of www/ssl.wiki.

wyoung 2026-09-25 18:58 UTC trunk
Commit df389b91f111193dae07cd826c754663f689b0d25dbf89038835574088e91786
Parent 9ce7e77d9836ceb…
1 file changed +16 -31
~ www/ssl.wiki
M www/ssl.wiki
+16 -31
--- www/ssl.wiki
+++ www/ssl.wiki
@@ -1,25 +1,21 @@
11
 <title>Securing a Repository with TLS</title>
22
3
-<h2>Using TLS-Encrypted Communications with Fossil</h2>
3
+<h2>Motivation</h2>
44
55
 If you are storing sensitive information in a repository accessible over
66
 a network whose integrity you do not fully trust, you should use TLS to
77
 encrypt all communications with it. This is most true for repositories
88
 accessed over the Internet, especially if they will be accessed from
9
-edge networks you do not control, since that admits of various forms of
9
+edge networks you do not control, since that allows various forms of
1010
 [https://en.wikipedia.org/wiki/Man-in-the-middle_attack|man in the
1111
 middle attack].
1212
1313
 TLS protects the credentials used to access the server, prevents
1414
 eavesdropping, prevents in-flight data modification, prevents server
1515
 identify spoofing, and more.
1616
17
-There are two major aspects to this, both of which have to be addressed
18
-in different ways. Those are the subjects of the next two major
19
-sections.
20
-
2117
2218
 <h2 id="client">Client-Side Configuration</h2>
2319
2420
 You can build Fossil against [https://www.openssl.org/ |
2521
 OpenSSL] to allow it to clone and sync with a remote
@@ -38,44 +34,33 @@
3834
 package manager. Examples:
3935
4036
 * <b>RHEL & Fedora</b>: <tt>sudo dnf install openssl-devel</tt>
4137
 * <b>Debian & Ubuntu</b>: <tt>sudo apt install libssl-dev</tt>
4238
 * <b>FreeBSD</b>: <tt>su -c 'pkg install openssl'</tt>
43
- * <b>macOS</b>: <tt>sudo brew install openssl</tt>
39
+ * <b>macOS</b>: <tt>brew install openssl</tt>
4440
 * <b>Cygwin</b>: Install <tt>openssl-devel</tt> via Cygwin's
4541
 <tt>setup-*.exe</tt> program
4642
47
-The macOS case requires explanation. Apple last shipped OpenSSL
48
-develpoment files in OS X 10.6 (Snow Leopard), choosing to deprecate it
49
-from that point forward. (Apple wants you to use their proprietary
50
-platform-specific encryption methods instead.) Since macOS has no
51
-built-in package manager, a number have sprung up out of the FOSS world.
52
-It is not known to this author whether Fossil's current build system can
53
-find OpenSSL as installed with any of these other package managers, so
54
-unless you have a particular reason to avoid it, we recomend that you
55
-use [https://brew.sh|Homebrew] on macOS to install OpenSSL as above.
56
-Fossil's build system will seek it out and use it automatically.
43
+The macOS case requires explanation. Apple deprecated OpenSSL in favor
44
+of the nominally API-compatible LibreSSL long ago, but the conformance
45
+often lags in ways that affect whether Fossil will build against it.
46
+The [https://brew.sh | Homebrew] method given above is not the only way
47
+to install the OpenSSL development libraries on macOS, but it *is* the
48
+only one the <tt>configure</tt> script includes automatic checks for.
5749
5850
5951
 <h3 id="openssl-src">Building Against a Non-Platform Version of
6052
 OpenSSL</h3>
6153
62
-The Fossil build system has a few other methods for finding OpenSSL when
63
-the automatic methods fail or when you'd prefer that Fossil use a
64
-different version of OpenSSL than the one Fossil's build system picks on
65
-its own.
66
-
67
-A good reason to do this is when the Fossil build system finds a
68
-functioning version of OpenSSL which is nevertheless unsuitable. One
69
-common case is that your OS is sufficiently outdated that the platform
54
+The Fossil build system offers manual overrides for finding OpenSSL.
55
+These are useful either when the automatic methods fail or when you'd
56
+prefer that Fossil use a different version of OpenSSL than the one
57
+Fossil's build system picks on its own. Perhaps the most common reason
58
+to do this is when your OS is sufficiently outdated that the platform
7059
 version of OpenSSL can no longer communicate with remote systems
71
-adhering to the latest advice on secure communications. An old OpenSSL
72
-might not support any of the
73
-[https://en.wikipedia.org/wiki/Cipher_suite|cipher suites] the remote
74
-Fossil repository's HTTPS proxy is willing to offer, for example, so
75
-that even though both sides are speaking a variant of TLS/SSL, the peers
76
-cannot come to an agreement on the cryptography.
60
+adhering to the latest advice on secure communications for lack of
61
+compatible [https://en.wikipedia.org/wiki/Cipher_suite | cipher suites].
7762
7863
 If you've installed the OpenSSL development files somewhere that
7964
 Fossil's build system cannot find on its own, you can clue it in by
8065
 passing the <tt>--with-openssl</tt> option to the <tt>configure</tt>
8166
 script. Type <tt>./configure --help</tt> for details.
8267
--- www/ssl.wiki
+++ www/ssl.wiki
@@ -1,25 +1,21 @@
1 <title>Securing a Repository with TLS</title>
2
3 <h2>Using TLS-Encrypted Communications with Fossil</h2>
4
5 If you are storing sensitive information in a repository accessible over
6 a network whose integrity you do not fully trust, you should use TLS to
7 encrypt all communications with it. This is most true for repositories
8 accessed over the Internet, especially if they will be accessed from
9 edge networks you do not control, since that admits of various forms of
10 [https://en.wikipedia.org/wiki/Man-in-the-middle_attack|man in the
11 middle attack].
12
13 TLS protects the credentials used to access the server, prevents
14 eavesdropping, prevents in-flight data modification, prevents server
15 identify spoofing, and more.
16
17 There are two major aspects to this, both of which have to be addressed
18 in different ways. Those are the subjects of the next two major
19 sections.
20
21
22 <h2 id="client">Client-Side Configuration</h2>
23
24 You can build Fossil against [https://www.openssl.org/ |
25 OpenSSL] to allow it to clone and sync with a remote
@@ -38,44 +34,33 @@
38 package manager. Examples:
39
40 * <b>RHEL & Fedora</b>: <tt>sudo dnf install openssl-devel</tt>
41 * <b>Debian & Ubuntu</b>: <tt>sudo apt install libssl-dev</tt>
42 * <b>FreeBSD</b>: <tt>su -c 'pkg install openssl'</tt>
43 * <b>macOS</b>: <tt>sudo brew install openssl</tt>
44 * <b>Cygwin</b>: Install <tt>openssl-devel</tt> via Cygwin's
45 <tt>setup-*.exe</tt> program
46
47 The macOS case requires explanation. Apple last shipped OpenSSL
48 develpoment files in OS X 10.6 (Snow Leopard), choosing to deprecate it
49 from that point forward. (Apple wants you to use their proprietary
50 platform-specific encryption methods instead.) Since macOS has no
51 built-in package manager, a number have sprung up out of the FOSS world.
52 It is not known to this author whether Fossil's current build system can
53 find OpenSSL as installed with any of these other package managers, so
54 unless you have a particular reason to avoid it, we recomend that you
55 use [https://brew.sh|Homebrew] on macOS to install OpenSSL as above.
56 Fossil's build system will seek it out and use it automatically.
57
58
59 <h3 id="openssl-src">Building Against a Non-Platform Version of
60 OpenSSL</h3>
61
62 The Fossil build system has a few other methods for finding OpenSSL when
63 the automatic methods fail or when you'd prefer that Fossil use a
64 different version of OpenSSL than the one Fossil's build system picks on
65 its own.
66
67 A good reason to do this is when the Fossil build system finds a
68 functioning version of OpenSSL which is nevertheless unsuitable. One
69 common case is that your OS is sufficiently outdated that the platform
70 version of OpenSSL can no longer communicate with remote systems
71 adhering to the latest advice on secure communications. An old OpenSSL
72 might not support any of the
73 [https://en.wikipedia.org/wiki/Cipher_suite|cipher suites] the remote
74 Fossil repository's HTTPS proxy is willing to offer, for example, so
75 that even though both sides are speaking a variant of TLS/SSL, the peers
76 cannot come to an agreement on the cryptography.
77
78 If you've installed the OpenSSL development files somewhere that
79 Fossil's build system cannot find on its own, you can clue it in by
80 passing the <tt>--with-openssl</tt> option to the <tt>configure</tt>
81 script. Type <tt>./configure --help</tt> for details.
82
--- www/ssl.wiki
+++ www/ssl.wiki
@@ -1,25 +1,21 @@
1 <title>Securing a Repository with TLS</title>
2
3 <h2>Motivation</h2>
4
5 If you are storing sensitive information in a repository accessible over
6 a network whose integrity you do not fully trust, you should use TLS to
7 encrypt all communications with it. This is most true for repositories
8 accessed over the Internet, especially if they will be accessed from
9 edge networks you do not control, since that allows various forms of
10 [https://en.wikipedia.org/wiki/Man-in-the-middle_attack|man in the
11 middle attack].
12
13 TLS protects the credentials used to access the server, prevents
14 eavesdropping, prevents in-flight data modification, prevents server
15 identify spoofing, and more.
16
 
 
 
 
17
18 <h2 id="client">Client-Side Configuration</h2>
19
20 You can build Fossil against [https://www.openssl.org/ |
21 OpenSSL] to allow it to clone and sync with a remote
@@ -38,44 +34,33 @@
34 package manager. Examples:
35
36 * <b>RHEL & Fedora</b>: <tt>sudo dnf install openssl-devel</tt>
37 * <b>Debian & Ubuntu</b>: <tt>sudo apt install libssl-dev</tt>
38 * <b>FreeBSD</b>: <tt>su -c 'pkg install openssl'</tt>
39 * <b>macOS</b>: <tt>brew install openssl</tt>
40 * <b>Cygwin</b>: Install <tt>openssl-devel</tt> via Cygwin's
41 <tt>setup-*.exe</tt> program
42
43 The macOS case requires explanation. Apple deprecated OpenSSL in favor
44 of the nominally API-compatible LibreSSL long ago, but the conformance
45 often lags in ways that affect whether Fossil will build against it.
46 The [https://brew.sh | Homebrew] method given above is not the only way
47 to install the OpenSSL development libraries on macOS, but it *is* the
48 only one the <tt>configure</tt> script includes automatic checks for.
 
 
 
 
49
50
51 <h3 id="openssl-src">Building Against a Non-Platform Version of
52 OpenSSL</h3>
53
54 The Fossil build system offers manual overrides for finding OpenSSL.
55 These are useful either when the automatic methods fail or when you'd
56 prefer that Fossil use a different version of OpenSSL than the one
57 Fossil's build system picks on its own. Perhaps the most common reason
58 to do this is when your OS is sufficiently outdated that the platform
 
 
 
59 version of OpenSSL can no longer communicate with remote systems
60 adhering to the latest advice on secure communications for lack of
61 compatible [https://en.wikipedia.org/wiki/Cipher_suite | cipher suites].
 
 
 
 
62
63 If you've installed the OpenSSL development files somewhere that
64 Fossil's build system cannot find on its own, you can clue it in by
65 passing the <tt>--with-openssl</tt> option to the <tt>configure</tt>
66 script. Type <tt>./configure --help</tt> for details.
67

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button