Requesting information about interactions with OpenSSL

Installation & Packaging
#1

Description

Hello, I am trying to maintain a Gentoo package of Mailspring in the GURU repository. For now, I am only working with the binary version (the official .debpackage).

My question is the following: does Mailspring uses OpenSSL from the host system ? Which version is needed ? Can some files be stripped (some .so files ?) if one has finer control over the install and versions ?

As far as I understand things, Mailspring, in its version 1.8.0 and 1.9.0 install the following .so files that seem to be dynamically linked with openssl v1.0.0.

 * 	/usr/share/mailspring/resources/app.asar.unpacked/libdigestmd5.so: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libdigestmd5.so.2: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libdigestmd5.so.2.0.25: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libntlm.so: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libntlm.so.2: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libntlm.so.2.0.25: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libscram.so: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libscram.so.2: libcrypto.so.1.0.0
 * 	/usr/share/mailspring/resources/app.asar.unpacked/libscram.so.2.0.25: libcrypto.so.1.0.0

The weird thing is that I can delete these files and Mailspring seems to work just fine. A log shows that it’s using openssl 1.1.0f

----------IMAP----------
connect <mailcore::IMAPSession:0x7ffed07b4450>
* OK The Microsoft Exchange IMAP4 service is ready. [...] 
ssl connect imap-mail.outlook.com 993 2
OpenSSL version: OpenSSL 1.1.0f 25 May 2017

Setup

  • OS and Version: Gentoo (Rolling release) OpenSSL 1.1.1k
    • Installation Method: extract the official .deb package.
  • Mailspring Version: 1.8.0 and 1.9.0
#2

I too try to package mailspring’s mailsync and I see in the readme that they use a bundled version of openssl. The fact that they compile it all and not use all of it’s components makes sense, since they base their bundled build upon the default build. The fact that they don’t trust any distribution to provide a sane and recent enough version of openssl is a what’s peculiar.