Dependencies of statically linked apps (was Re: update of OpenSSL
from tarball)
John Mills
johnmills at speakeasy.net
Sat Mar 20 09:48:25 PST 2004
On 20 Mar 2004, Lowell Gilbert wrote:
> "J.D. Bronson" <jbronson at wixb.com> writes:
> > ..this seems to correctly place all the files where they need to be
> > with the exception of a few. I did recompile a few apps since they had
> > ldd to older files that were incorrect.
..
> Most peoples' mileage *does* vary, because updating OpenSSL by itself
> isn't enough. Everything that linked to it statically needs to be
> updated as well, which most people won't have the skill (or
> inclination) to track down.
Good point, but how _does_ one learn which libs have been statically
linked when one has only the binary (assuming debug tags were stripped)?
If common dependent apps are identified in the bug or fix report, well and
good. Otherwise I don't see any alternative to that app's maintainers
making the vulnerability information available. If there is a central list
or clearing-house of such information, where would it be?
- John Mills
1884 Ridgewood Dr, NE
Atlanta, GA 30307-1166
404.377.2577
john.m.mills at alum.mit.edu
More information about the freebsd-questions
mailing list