|
LibreSSL is an open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It was forked from the OpenSSL cryptographic software library in April 2014 as a response by OpenBSD developers to the Heartbleed security vulnerability in OpenSSL, with the aim of refactoring the OpenSSL code so as to provide a more secure implementation. LibreSSL was forked from the OpenSSL library starting with the 1.0.1g branch and will follow the security guidelines used elsewhere in the OpenBSD project. == History == After the Heartbleed bug in OpenSSL, the OpenBSD team audited the code afresh, and quickly realised they would need to maintain a fork themselves.〔 The libressl.org domain was registered on 11 April 2014; the project announced the name on 22 April 2014. In the first week of code pruning, more than 90,000 lines of C code were removed.〔 Older or unused code has been removed, and support for some older or now-rare operating systems removed. LibreSSL is initially being developed as an intended replacement for OpenSSL in OpenBSD 5.6, and it is then expected to be ported back to other platforms once a stripped-down version of the library is stable. , the project was seeking a "stable commitment" of external funding.〔 On 17 May 2014, Bob Beck presented "LibreSSL: The first 30 days, and what the Future Holds" during the 2014 BSDCan conference, in which he described the progress made in the first month, encountered issues, and implemented changes. On 5 June 2014, several OpenSSL bugs became public. While several projects were notified in advance, LibreSSL was not; Theo de Raadt accused the OpenSSL developers of intentionally withholding this information from OpenBSD and LibreSSL. On 20 June 2014, Google created another fork of OpenSSL called BoringSSL, and promised to exchange fixes with LibreSSL. Google has already relicensed some of its contributions under the ISC license, as it was requested by the LibreSSL developers.〔 On 21 June, Theo de Raadt welcomed BoringSSL and outlined the plans for LibreSSL-portable. Starting on 8 July, code porting for OS X and Solaris began, while initial porting to Linux began on 20 June. On 11 July 2014, the first portable version of LibreSSL was released as version 2.0.0.〔(【引用サイトリンク】title=Index of /pub/OpenBSD/LibreSSL )〕 The first release was quickly followed by 2.0.1 on 13 July, 2.0.2 on 16 July, 2.0.3 on 22 July, 2.0.4 on 3 August and 2.0.5 on 5 August 2014. Many issues with the first portable release were fixed in the 2.0 series. On 28 September 2014, Ted Unangst presented "LibreSSL: More Than 30 Days Later", in which he described the progress, issues and changes in the months since Bob Beck's BSDCan talk.〔 With the version 2.1.0, released on 12 October 2014, the rate of changes in LibreSSL became considerably lower and LibreSSL became a usable alternative to OpenSSL. Most of the changes in the 2.1.x versions were related to security vulnerabilities found in OpenSSL. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「LibreSSL」の詳細全文を読む スポンサード リンク
|