[Feature request] Dockerfile - Include `openssl1.1-compat` about testssl.sh HOT 3 CLOSED

CI (GitHub Actions) workflow runs for the test cases I had observed performance of locally (with --openssl /usr/bin/openssl) now cover the drwetter/testssl.sh:3.1dev image changed from Alpine 3.16 (OpenSSL 1.1) to Alpine 3.17 (OpenSSL 3.0) below.

Alpine 3.16 (199s):

ok 2 [Security] (TLS) (cipher lists) 'TLS_LEVEL=intermediate' + RSA in 34254ms
ok 3 [Security] (TLS) (cipher lists) 'TLS_LEVEL=intermediate' + ECDSA in 30780ms
ok 4 [Security] (TLS) (cipher lists) 'TLS_LEVEL=intermediate' + ECDSA with RSA fallback in 34941ms
ok 5 [Security] (TLS) (cipher lists) 'TLS_LEVEL=modern' + RSA in 32754ms
ok 6 [Security] (TLS) (cipher lists) 'TLS_LEVEL=modern' + ECDSA in 31752ms
ok 7 [Security] (TLS) (cipher lists) 'TLS_LEVEL=modern' + ECDSA with RSA fallback in 35344ms

Alpine 3.17 update (223s):

ok 2 [Security] (TLS) (cipher lists) 'TLS_LEVEL=intermediate' + RSA in 37618ms
ok 3 [Security] (TLS) (cipher lists) 'TLS_LEVEL=intermediate' + ECDSA in 35239ms
ok 4 [Security] (TLS) (cipher lists) 'TLS_LEVEL=intermediate' + ECDSA with RSA fallback in 39413ms
ok 5 [Security] (TLS) (cipher lists) 'TLS_LEVEL=modern' + RSA in 37449ms
ok 6 [Security] (TLS) (cipher lists) 'TLS_LEVEL=modern' + ECDSA in 36310ms
ok 7 [Security] (TLS) (cipher lists) 'TLS_LEVEL=modern' + ECDSA with RSA fallback in 37397ms

So local observations are likely to benefit the Github Actions CI runs by approx 15% as well if openssl1.1-compat were used instead.

from testssl.sh.

CI (GitHub Actions) workflow runs for the test cases I had observed performance of locally (with --openssl /usr/bin/openssl) now cover the drwetter/testssl.sh:3.1dev image

Probably I haven´t looked good enough at this. Any change in the Dockerimage which is not coherent with the pulled files is not something which I am really fond of -- for both the CI and the user image.

For the former case the point of the CI test is to test the binary. I´d rather skip one test there. And to the user the image should hand out the same as if it's pulled from the repo.

In next development stage (after 3.2) is usage of a different openssl version per default probably a good idea (TBC).

from testssl.sh.

When I was talking about CI, I meant the CI runs on a project I maintain where testssl.sh was used via the Docker image.

Any change in the Dockerimage which is not coherent with the pulled files is not something which I am really fond of -- for both the CI and the user image.

No change here. Just an additional package installed in the image that can be used with --openssl as an alternative binary.

The user running the image would explicitly provide that option and path to use the openssl1.1-compat binary.

And to the user the image should hand out the same as if it's pulled from the repo.

Sorry, I'm not following?

With the upgrade to Alpine 3.17 base image, OpenSSL is 3.x series, where as previously it was the 1.x series. This is not related to testssl.sh beyond Dockerfile.

A pull from this repo doesn't control the OpenSSL provided within the base image (or outside of Docker, whatever OpenSSL is on the host system).

It's all good to decline this request 👍

Main benefit is the observed 15% faster performance running testssl.sh with the OpenSSL 1.x series.

from testssl.sh.