From 107e320a20f32bb05e13aab6be81aedad66fec17 Mon Sep 17 00:00:00 2001
From: Marian Beermann <public@enkore.de>
Date: Fri, 2 Jun 2017 12:52:30 +0200
Subject: [PATCH] binaries: don't bundle libssl

ArchiverTestCaseBinary passes.
---
 docs/internals/security.rst | 12 +++++-------
 scripts/borg.exe.spec       | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/docs/internals/security.rst b/docs/internals/security.rst
index 8421685c1..d028c7f98 100644
--- a/docs/internals/security.rst
+++ b/docs/internals/security.rst
@@ -355,11 +355,9 @@ updates.
 
 OpenSSL is a large and complex piece of software and has had its share of vulnerabilities,
 however, it is important to note that Borg links against ``libcrypto`` **not** ``libssl``.
-libcrypto is the low-level cryptography part of OpenSSL, while libssl implements TLS and related protocols.
-The latter is not used by Borg (cf. `Remote RPC protocol security`_, Borg does not implement
+libcrypto is the low-level cryptography part of OpenSSL,
+while libssl implements TLS and related protocols.
+
+The latter is not used by Borg (cf. `Remote RPC protocol security`_, Borg itself does not implement
 any network access) and historically contained most vulnerabilities, especially critical ones.
-
-Historic vulnerabilities affecting libcrypto in ways relevant to Borg were flaws in primtives
-enabling side-channel and similar attacks.
-
-Therefore, both using and bundling OpenSSL is considered unproblematic for Borg.
+The static binaries released by the project contain neither libssl nor the Python ssl/_ssl modules.
diff --git a/scripts/borg.exe.spec b/scripts/borg.exe.spec
index 07dcdfbe1..ea86a91d4 100644
--- a/scripts/borg.exe.spec
+++ b/scripts/borg.exe.spec
@@ -16,7 +16,9 @@ a = Analysis([os.path.join(basepath, 'src/borg/__main__.py'), ],
              hiddenimports=['borg.platform.posix'],
              hookspath=[],
              runtime_hooks=[],
-             excludes=[],
+             excludes=[
+                '_ssl', 'ssl',
+             ],
              win_no_prefer_redirects=False,
              win_private_assemblies=False,
              cipher=block_cipher)
@@ -38,3 +40,16 @@ exe = EXE(pyz,
           strip=False,
           upx=True,
           console=True )
+
+if False:
+    # Enable this block to build a directory-based binary instead of
+    # a packed single file. This allows to easily look at all included
+    # files (e.g. without having to strace or halt the built binary
+    # and introspect /tmp).
+    coll = COLLECT(exe,
+                   a.binaries,
+                   a.zipfiles,
+                   a.datas,
+                   strip=False,
+                   upx=True,
+                   name='borg-dir')