Is it wise to include something like OpenSSL or GnuTLS with a project in a repository?

Question

I am currently working on a project that makes use of the OpenSSL library for secure communications. Since this library is a requirement for building the project, I am considering including it in the project's repository. Here are the pros and cons as I see them:

Pros:

• Self-contained build - with one exception, everything needed for building the project is contained in the repository. It would be nice if the user didn't need to go through the trouble of installing and configuring the development headers / libraries for OpenSSL.

Cons:

• Security concerns - it goes without saying that the only version of OpenSSL that anyone should be using is always the latest. As soon as a new release is issued, I will need to update the version of OpenSSL in the project's repository.

So the question boils down to this:

Is it wise to include a security library with the project that we need to always ensure gets updated whenever a new release is issued?

Answer 1

The main reason it is not wise to bundle your own copy of OpenSSL (or other commonly used libraries) is that your project will not be the only thing your end users install that uses those libraries.

If you depend on the installed system version of OpenSSL on the host where you run, your users need only update that copy of OpenSSL when a new security issue in OpenSSL is discovered. If you bundle your own copy, they need to update the system copy (for all of the other software they use that links against it) and your application. And that, of course, is assuming they realize -- and remember -- that your application is not using the system copy of OpenSSL.

Worse, to get a copy of your application which links with the new version of OpenSSL, they have to rebuild (or re-download) not just your copy of OpenSSL, but the rest of your application. In contrast, if you use the system OpenSSL libraries, then as long as the version of OpenSSL they are upgrading to is a new minor release, with no ABI changes since the version they had been using, they need only rebuild OpenSSL, not your application.

This only gets worse, of course, if other third-party applications they are using also have their own private copies of OpenSSL...