# Remove dependency on preinstalled OpenSSL

**URL:** <https://zola.discourse.group/t/remove-dependency-on-preinstalled-openssl/221>\
**Category:** Feature requests\
**Created:** [October 25, 2019, 12:21pm UTC](https://zola.discourse.group/t/remove-dependency-on-preinstalled-openssl/221 "2019-10-25T12:21:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![flyingP0tat0](https://yyz2.discourse-cdn.com/free1/user_avatar/zola.discourse.group/flyingp0tat0/32/65_2.png) [@flyingP0tat0](https://zola.discourse.group/u/flyingP0tat0)\
**Post date:** [October 25, 2019, 12:21pm UTC](https://zola.discourse.group/t/remove-dependency-on-preinstalled-openssl/221/1 "2019-10-25T12:21:25Z")

</div>

Recently, one of my projects [failed on Travis](https://travis-ci.com/janbaudisch/zola-sam/builds/133405662). This was because Travis still uses Ubuntu Xenial (16.04) as their default build environment, and the prebuilt Zola executable from GitHub releases uses another version of OpenSSL as the build environment provides. This is somewhat contrary to the batteries-included approach of Zola.

This is why I am proposing to change this dependency. It is coming from reqwest, [which offers the following cargo features](https://github.com/seanmonstar/reqwest/blob/d2cbc8edabdad7a6696f589111315a2caf2bece5/Cargo.toml#L67-L70):

- `default-tls`: Uses `native-tls`, default and currently used by Zola.
- `default-tls-vendored`: Uses `native-tls/vendored`, which builds the SSL library from source, removing the runtime dependency.
- `rustls-tls`: Uses [Rustls](https://github.com/ctz/rustls), which also eliminates runtime dependencies.

Maybe one could just offer all these features itself in Zola, or a selection.

[Rustls does not support](https://github.com/ctz/rustls#non-features) as many encryption protocols as the native SSL libraries, so it may not be suitable when the linkchecker tries to reach a site that still uses outdated encryption.

Either way, at least the GitHub releases binaries should be as portable as possible, which would be achieved using one of the last two options.

---

<div class="post-metadata">

**Author:** ![keats](https://avatars.discourse-cdn.com/v4/letter/k/34f0e0/32.png) [@keats](https://zola.discourse.group/u/keats)\
**Post date:** [October 25, 2019, 4:56pm UTC](https://zola.discourse.group/t/remove-dependency-on-preinstalled-openssl/221/2 "2019-10-25T16:56:29Z")

</div>

Any idea how often the outdated encryption protocols not supported by Rustls are seen in the wild? With `default-tls-vendored` it sounds like users would have to have the environment setup to build OpenSSL, which might be tricky.

---

<div class="post-metadata">

**Author:** ![flyingP0tat0](https://yyz2.discourse-cdn.com/free1/user_avatar/zola.discourse.group/flyingp0tat0/32/65_2.png) [@flyingP0tat0](https://zola.discourse.group/u/flyingP0tat0)\
**Post date:** [October 25, 2019, 5:53pm UTC](https://zola.discourse.group/t/remove-dependency-on-preinstalled-openssl/221/3 "2019-10-25T17:53:05Z")

</div>

[Here](https://www.ssllabs.com/ssl-pulse/) are some statistics. I can say from my own experience that I had to switch to `native-tls` in a personal project, because it involved a not very up-to-date webserver. It would be too risky to reject all outdated websites by default.

As for the `native-tls-vendored`, there should nothing more to be setup than a C compiler, which you already need when you compile Zola (see `sass-rs`, which builds libsass). The build script of `native-tls` takes care of everything else. It would not make building Zola anything different.

Maybe the following would be a good setup: Expose all three features (`native-tls`, `native-tls-vendored` and `rustls-tls`) and set `native-tls-vendored` as the default. This way it would truly be batteries-included and everyone still had the choice. For example, package maintainers would probably choose `native-tls`.