Has BoringSSL been widely adopted? The OpenBSD people forked to LibreSSL which looked very promising (coming from people who make their main obsession about security) but seemed to quickly burn out at least on Linux hosts
It was never meant to be, it's only providing a subset of the features openssl has.
>The OpenBSD people forked to LibreSSL which looked very promising (coming from people who make their main obsession about security) but seemed to quickly burn out at least on Linux hosts
In the beginning yes it was, they moved fast on cleaning up OpenSSL codebase. The problems began because it's not explicitly a goal to maintain OpenSSL compatibility, so distros had a huge maintenance burden patching things to work with it. Eventually the distros that were maintaining it (Void and Gentoo?) got tired of it and decided OpenSSL had gotten through the worst of its problems.
Then OpenSSL 3 dropped, once again making it annoying to patch for and introducing issues like this CVE. I think Alpine was discussing looking at LibreSSL again but I think that ship has sailed.
I suppose a Linux distro could hypothetically take the same approach and use a mixture of both, but realistically most people don't want to bother with that.
Personally I'd love a Linux distro with a BSD-style base system and extra packages kept separately, but the closest to that would be ... Slackware with pkgsrc or something I guess.
Theo Buehler talked about the current status of LibreSSL compatibility at EuroBSDcon last week. To take some quotes:
“> 2000 OpenBSD ports link against libcrypto or libssl” [i.e., LibreSSL]
“< 100 of these need patches (< 5%)”
“6 ports link against OpenSSL”