wolfssl: drop (#504471)

This commit is contained in:
Jo
2026-04-27 04:51:34 +00:00
committed by GitHub
12 changed files with 134 additions and 183 deletions
+1 -2
View File
@@ -2,7 +2,6 @@
lib,
stdenv,
fetchFromGitLab,
wolfssl,
bionic-translation,
python3,
which,
@@ -35,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
patches = [
# Do not hardocde addr2line binary path
./no-hardcode-path-addr2line.patch
./remove-wolfssljni.patch
];
postPatch = ''
@@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
libpng
lz4
openssl
(wolfssl.override { enableJni = true; })
xz
zlib
];
@@ -0,0 +1,96 @@
diff --git a/Makefile b/Makefile
index 3383a64b36..b658f49c23 100644
--- a/Makefile
+++ b/Makefile
@@ -53,7 +53,7 @@
default: ____art_all
-____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex wolfssljni-hostdex okhttp-hostdex libandroidfw art-standalone.pc
+____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex okhttp-hostdex libandroidfw art-standalone.pc
art-standalone.pc: art-standalone.pc.in
sed -e 's|@prefix@|$(____PREFIX)|g' \
@@ -68,8 +68,7 @@
install -Dt $(____INSTALL_LIBDIR)/java/dex/art/natives/ $(____TOPDIR)/out/host/linux-x86/lib64/libjavacore.so \
$(____TOPDIR)/out/host/linux-x86/lib64/libnativehelper.so \
$(____TOPDIR)/out/host/linux-x86/lib64/libopenjdk.so \
- $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so \
- $(____TOPDIR)/out/host/linux-x86/lib64/libwolfssljni.so
+ $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so
#
# these are mostly internal libs which there's no point in versioning because they don't have any kind of stable ABI - so we just shove them in art/ namespace
# even the libunwind is actually a fork of libunwind 1.1 with added stuff that will likely never be upstreamed, especially since google stopped using libunwind
@@ -108,8 +107,7 @@
$(____TOPDIR)/out/host/linux-x86/framework/core-oj-hostdex.jar \
$(____TOPDIR)/out/host/linux-x86/framework/hamcrest-hostdex.jar \
$(____TOPDIR)/out/host/linux-x86/framework/junit-runner-hostdex.jar \
- $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar \
- $(____TOPDIR)/out/host/linux-x86/framework/wolfssljni-hostdex.jar
+ $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar
#
# packaging note: this is needed as bootclasspath when compiling android_translation_layer. Can be in -dev package.
install -D $(____TOPDIR)/out/host/common/obj/JAVA_LIBRARIES/core-all-hostdex_intermediates/classes.jar $(____INSTALL_LIBDIR)/java/core-all_classes.jar
diff --git a/art/runtime/parsed_options.cc b/art/runtime/parsed_options.cc
index 1f8936114a..b8f7566401 100644
--- a/art/runtime/parsed_options.cc
+++ b/art/runtime/parsed_options.cc
@@ -597,8 +597,7 @@
bootclasspath_prefix + "/core-libart-hostdex.jar" + ':' +
bootclasspath_prefix + "/hamcrest-hostdex.jar" + ':' +
bootclasspath_prefix + "/junit-runner-hostdex.jar" + ':' +
- bootclasspath_prefix + "/okhttp-hostdex.jar" + ':' +
- bootclasspath_prefix + "/wolfssljni-hostdex.jar";
+ bootclasspath_prefix + "/okhttp-hostdex.jar";
free(bootclasspath_prefix);
if(args.Exists(M::BootClassPath_a))
diff --git a/libcore/luni/src/main/java/java/security/security.properties b/libcore/luni/src/main/java/java/security/security.properties
index ca55328279..b17437f81e 100644
--- a/libcore/luni/src/main/java/java/security/security.properties
+++ b/libcore/luni/src/main/java/java/security/security.properties
@@ -18,15 +18,13 @@
# Providers
# See also: J2SE doc. "How to Implement a Provider for the JavaTM Cryptography Architecture"
#
-# Android's provider of OpenSSL backed implementations
-security.provider.1=com.wolfssl.provider.jsse.WolfSSLProvider
# Android's stripped down BouncyCastle provider
-security.provider.2=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider
+security.provider.1=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider
# provides implementations that would normally be provided by sun.security.provider.Sun
# (CertPathValidator, CertPathBuilder and (ATL added) JKS)
-security.provider.3=sun.security.provider.CertPathProvider
+security.provider.2=sun.security.provider.CertPathProvider
# Remaining Harmony providers
-security.provider.4=org.apache.harmony.security.provider.crypto.CryptoProvider
+security.provider.3=org.apache.harmony.security.provider.crypto.CryptoProvider
@@ -39,13 +37,6 @@
# javax/net/ssl/SSLSocketFactory.html#getDefault()
# javax/net/ssl/SSLServerSocketFactory.html#getDefault()
-# For regular SSLSockets, we have two implementations:
-ssl.SocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLSocketFactory
-#ssl.SocketFactory.provider=com.android.org.conscrypt.SSLSocketFactoryImpl
-
-# For SSLServerSockets, there's only the new, OpenSSL-based implementation:
-ssl.ServerSocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLServerSocketFactory
-
# Default KeyStore type.
# See specification for java/security/KeyStore.html#getDefaultType()
keystore.type=BKS
diff --git a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java
index e60c3e3ba8..ec66dcb8f0 100644
--- a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java
+++ b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java
@@ -103,7 +103,6 @@
*/
"com.android.org.bouncycastle.jce.provider.BouncyCastleProvider",
"org.apache.harmony.security.provider.crypto.CryptoProvider", // we need SecureRandom
- "com.wolfssl.provider.jsse.WolfSSLProvider",
// END Android-changed: Use Conscrypt and BC, not the sun.security providers.
BACKUP_PROVIDER_CLASSNAME,
};
+3 -6
View File
@@ -48,8 +48,6 @@
rtmpdump,
scpSupport ? zlibSupport && !stdenv.hostPlatform.isSunOS && !stdenv.hostPlatform.isCygwin,
libssh2,
wolfsslSupport ? false,
wolfssl,
rustlsSupport ? false,
rustls-ffi,
zlibSupport ? true,
@@ -80,7 +78,6 @@ assert
(lib.count (x: x) [
gnutlsSupport
opensslSupport
wolfsslSupport
rustlsSupport
]) > 1
);
@@ -160,7 +157,6 @@ stdenv.mkDerivation (finalAttrs: {
++ lib.optional pslSupport libpsl
++ lib.optional rtmpSupport rtmpdump
++ lib.optional scpSupport libssh2
++ lib.optional wolfsslSupport wolfssl
++ lib.optional rustlsSupport rustls-ffi
++ lib.optional zlibSupport zlib
++ lib.optional zstdSupport zstd;
@@ -192,7 +188,8 @@ stdenv.mkDerivation (finalAttrs: {
(lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
(lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
(lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
(lib.withFeatureAs wolfsslSupport "wolfssl" (lib.getDev wolfssl))
# TODO: Clean up on `staging`.
"--without-wolfssl"
]
++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}"
# For the 'urandom', maybe it should be a cross-system option
@@ -203,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: {
"--without-ca-bundle"
"--without-ca-path"
]
++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [
++ lib.optionals (!gnutlsSupport && !opensslSupport && !rustlsSupport) [
"--without-ssl"
]
++ lib.optionals (rustlsSupport && !stdenv.hostPlatform.isDarwin) [
-9
View File
@@ -12,7 +12,6 @@
aws-lc,
libressl,
openssl,
wolfssl,
lua5_4,
pcre2,
}:
@@ -21,7 +20,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [
"aws-lc"
"libressl"
"openssl"
"wolfssl"
];
let
sslPkgs = {
@@ -30,10 +28,6 @@ let
libressl
openssl
;
wolfssl = wolfssl.override {
variant = "haproxy";
extraConfigureFlags = [ "--enable-quic" ];
};
};
sslPkg = sslPkgs.${sslLibrary};
in
@@ -85,9 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
++ lib.optionals (sslLibrary == "openssl" && lib.versionOlder openssl.version "3.5.2") [
"USE_QUIC_OPENSSL_COMPAT=yes"
]
++ lib.optionals (sslLibrary == "wolfssl") [
"USE_OPENSSL_WOLFSSL=yes"
]
++ lib.optionals usePcre [
"USE_PCRE2=yes"
"USE_PCRE2_JIT=yes"
+4 -4
View File
@@ -10,16 +10,16 @@
rustPlatform.buildRustPackage {
pname = "lightway";
version = "0-unstable-2026-04-10";
version = "0-unstable-2026-04-24";
src = fetchFromGitHub {
owner = "expressvpn";
repo = "lightway";
rev = "72a924935df9db641e7f4fe28cbeafaead59014f";
hash = "sha256-tygK2CQmbbynJiwGkMvYzt2dHoE17DCJeqD+jlai/m8=";
rev = "8e0940f047ee72db5daa1fb7c3bb82bc89e0f1d9";
hash = "sha256-OFMAEw613aIGG7N5LBAGbVrpkqMUBi7lUy7jm5tZowc=";
};
cargoHash = "sha256-NdVOphyBW5sflv5jZPV/ShfAJXb3ZOyDRctmn/2JY38=";
cargoHash = "sha256-gY8KokOtdBT7Vq+lGn2sk4/o3A0TypEqv09TVJqaZjc=";
cargoBuildFlags = lib.cli.toCommandLineGNU { } {
package = [
+1 -5
View File
@@ -7,8 +7,6 @@
pkg-config,
file,
protobufc,
withWolfSSL ? false,
wolfssl,
withGnuTLS ? false,
gnutls,
withJSON ? true,
@@ -45,12 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
file
protobufc
]
++ lib.optional withWolfSSL wolfssl
++ lib.optional withGnuTLS gnutls
++ lib.optional withJSON json_c;
configureFlags =
[ ] ++ lib.optional withWolfSSL "--with-tls=wolfssl" ++ lib.optional withGnuTLS "--with-tls=gnutls";
configureFlags = [ ] ++ lib.optional withGnuTLS "--with-tls=gnutls";
doCheck = true;
enableParallelBuilding = true;
+23 -8
View File
@@ -18,7 +18,6 @@
libusb1,
zlib,
curl,
wolfssl,
python3,
pugixml,
protobuf_33,
@@ -50,19 +49,19 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "rpcs3";
version = "0.0.39-unstable-2026-02-20";
version = "0.0.40-unstable-2026-04-25";
src = fetchFromGitHub {
owner = "RPCS3";
repo = "rpcs3";
rev = "6bfb33279f6989f3ff9ea2dc40ef45d6aeb57ef8";
rev = "96f73f4497fd6fdafd40dc50f24c95c90cd4acc9";
postCheckout = ''
cd $out/3rdparty
git submodule update --init \
fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \
feralinteractive/feralinteractive
feralinteractive/feralinteractive wolfssl/wolfssl
'';
hash = "sha256-Cu4Zaze0FZ00sRvPtUzUkOiX5ZAHWTtmWa536gNOTNY=";
hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso=";
};
passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
@@ -82,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
(lib.cmakeBool "USE_SYSTEM_LIBPNG" true)
(lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
(lib.cmakeBool "USE_SYSTEM_CURL" true)
(lib.cmakeBool "USE_SYSTEM_WOLFSSL" true)
(lib.cmakeBool "USE_SYSTEM_FAUDIO" true)
(lib.cmakeBool "USE_SYSTEM_OPENAL" true)
(lib.cmakeBool "USE_SYSTEM_PUGIXML" true)
@@ -127,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: {
zlib
libusb1
curl
wolfssl
python3
pugixml
sdl3
@@ -168,7 +165,25 @@ stdenv.mkDerivation (finalAttrs: {
maintainers = with lib.maintainers; [
ilian
];
license = lib.licenses.gpl2Only;
license = [
lib.licenses.gpl2Only
# Vendors wolfSSL, which changed its licence from
# `GPL-2.0-or-later` to `GPL-3.0-or-later`, which is incompatible
# with RPCS3s `GPL-2.0-only`. They have a “GPLv2 exception list”
# (<https://github.com/wolfSSL/wolfssl/blob/v5.9.1-stable/LICENSING>),
# but this is dubious; either the exception likely negates the
# licence change by letting you take wolfSSL out of a
# `GPL-2.0-only` combination and redistribute it under those
# terms, negating the licence change entirely, or else it doesnt
# allow distribution of the combination under the `GPL-2.0-only`
# at all and therefore would still constitute a licence
# violation to redistribute.
#
# We use `lib.licenses.unfree` to represent this awkward
# situation and keep Hydra from building the package.
lib.licenses.gpl3Plus
lib.licenses.unfree
];
platforms = [
"x86_64-linux"
"aarch64-linux"
+2 -2
View File
@@ -6,7 +6,7 @@
pkg-config,
lua5_1,
json_c,
libubox-wolfssl,
libubox,
ubus,
libxcrypt,
unstableGitUpdater,
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs = [
lua5_1
json_c
libubox-wolfssl
libubox
ubus
libxcrypt
];
-135
View File
@@ -1,135 +0,0 @@
{
lib,
stdenv,
fetchFromGitHub,
autoreconfHook,
util-linux,
openssl,
cacert,
# The primary --enable-XXX variant. 'all' enables most features, but causes build-errors for some software,
# requiring to build a special variant for that software. Example: 'haproxy'
variant ? "all",
extraConfigureFlags ? [ ],
enableJni ? false,
enableARMCryptoExtensions ?
stdenv.hostPlatform.isAarch64
&& ((builtins.match "^.*\\+crypto.*$" stdenv.hostPlatform.gcc.arch) != null),
enableLto ? !(stdenv.hostPlatform.isStatic || stdenv.cc.isClang),
}:
stdenv.mkDerivation (finalAttrs: {
pname = "wolfssl-${variant}";
version = "5.9.1";
src = fetchFromGitHub {
owner = "wolfSSL";
repo = "wolfssl";
tag = "v${finalAttrs.version}-stable";
hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE=";
};
postPatch = ''
patchShebangs ./scripts
# ensure test detects musl-based systems too
substituteInPlace scripts/ocsp-stapling2.test \
--replace '"linux-gnu"' '"linux-"'
''
+ lib.optionalString enableJni ''
# Some tests fail when JNI is enabled
sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d;
/TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d;
/TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c
sed -i '/quic/d' tests/include.am
sed -i '/WOLFSSL_QUIC/,/#endif/d' tests/unit.c
'';
configureFlags = [
"--enable-${variant}"
"--enable-reproducible-build"
]
++ lib.optionals (variant == "all") [
# Extra feature flags to add while building the 'all' variant.
# Since they conflict while building other variants, only specify them for this one.
"--enable-pkcs11"
"--enable-writedup"
"--enable-base64encode"
]
++ [
# We're not on tiny embedded machines.
# Increase TLS session cache from 33 sessions to 20k.
"--enable-bigcache"
# Use WolfSSL's Single Precision Math with timing-resistant cryptography.
"--enable-sp=yes${
lib.optionalString (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isAarch) ",asm"
}"
"--enable-sp-math-all"
"--enable-harden"
]
++ lib.optionals (stdenv.hostPlatform.isx86_64) [
# Enable AVX/AVX2/AES-NI instructions, gated by runtime detection via CPUID.
"--enable-intelasm"
"--enable-aesni"
]
++ lib.optionals (stdenv.hostPlatform.isAarch64) [
# No runtime detection under ARM and no platform function checks like for X86.
(if enableARMCryptoExtensions then "--enable-armasm=inline" else "--disable-armasm")
]
++ lib.optionals enableJni [
"--enable-jni"
]
++ extraConfigureFlags;
# Breaks tls13 tests on aarch64-darwin.
hardeningDisable = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
"zerocallusedregs"
];
# LTO should help with the C implementations.
env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto";
env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto";
# Don't attempt connections to external services in the test suite.
env.WOLFSSL_EXTERNAL_TEST = "0";
outputs = [
"dev"
"doc"
"lib"
"out"
];
nativeBuildInputs = [
autoreconfHook
util-linux
];
# FAILURES:
# 497: test_wolfSSL_EVP_PBE_scrypt
doCheck = !stdenv.hostPlatform.isLoongArch64;
nativeCheckInputs = [
openssl
cacert
];
postInstall = ''
# fix recursive cycle:
# wolfssl-config points to dev, dev propagates bin
moveToOutput bin/wolfssl-config "$dev"
# moveToOutput also removes "$out" so recreate it
mkdir -p "$out"
'';
meta = {
description = "Small, fast, portable implementation of TLS/SSL for embedded devices";
mainProgram = "wolfssl-config";
homepage = "https://www.wolfssl.com/";
changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${finalAttrs.version}-stable";
platforms = lib.platforms.all;
license = lib.licenses.gpl3Plus;
maintainers = with lib.maintainers; [
fab
vifino
];
};
})
@@ -6,7 +6,6 @@
pkg-config,
libubox-nossl,
ssl_implementation,
additional_buildInputs ? [ ],
}:
stdenv.mkDerivation {
@@ -35,7 +34,7 @@ stdenv.mkDerivation {
cmake
pkg-config
];
buildInputs = [ ssl_implementation ] ++ additional_buildInputs;
buildInputs = [ ssl_implementation ];
passthru = {
inherit ssl_implementation;
+3
View File
@@ -1128,6 +1128,7 @@ mapAliases {
libtorrent = throw "'libtorrent' has been renamed to 'libtorrent-rakshasa' for clearer distinction from 'libtorrent-rasterbar'"; # Added 2025-09-10
libtransmission = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26
libtransmission_3 = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26
libubox-wolfssl = throw "'libubox-wolfssl' has been removed, use 'libubox' or 'libubox-mbedtls'"; # Added 2026-03-29
libuinputplus = throw "'libuinputplus' has been removed, as it was unmaintained upstream since 2021, no longer builds, and is no longer used by anything"; # Added 2025-11-02
libviper = throw "'libviper' was removed as it is broken and not maintained upstream"; # Added 2025-05-17
libWindowsWM = libwindowswm; # Added 2026-01-19
@@ -2077,6 +2078,7 @@ mapAliases {
unixODBCDrivers = warnAlias "'unixODBCDrivers' has been renamed to 'unixodbcDrivers'" unixodbcDrivers; # Added 2026-02-12
unrar_6 = throw "'unrar_6' has been renamed to/replaced by 'unrar'"; # Added 2026-03-11
unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24
ustream-ssl-wolfssl = throw "'ustream-ssl-wolfssl' has been removed, use 'ustream-ssl' or 'ustream-ssl-mbedtls'"; # Added 2026-03-29
usync = throw "'usync' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18
util-linuxCurses = throw "'util-linuxCurses' has been renamed to/replaced by 'util-linux'"; # Converted to throw 2025-10-27
utillinux = warnAlias "'utillinux' has been renamed to/replaced by 'util-linux'" util-linux; # Converted to warning 2025-10-28
@@ -2158,6 +2160,7 @@ mapAliases {
wlroots_0_17 = throw "'wlroots_0_17' has been removed in favor of newer versions"; # Added 2026-03-07
wlx-overlay-s = throw "'wlx-overlay-s' and 'wayvr-dashboard' have been merged into a single application. Please switch to 'wayvr'"; # Added 2026-01-09
wmii_hg = throw "'wmii_hg' has been renamed to/replaced by 'wmii'"; # Converted to throw 2025-10-27
wolfssl = throw "'wolfssl' has been removed because it has an unclear licensing situation and no remaining users in Nixpkgs"; # Added 2026-04-03
woof = throw "'woof' has been removed as it is broken and unmaintained upstream"; # Added 2025-09-04
worldengine-cli = throw "'worldengine-cli' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
wpa_supplicant_ro_ssids = throw "'wpa_supplicant_ro_ssids' has been renamed to/replaced by 'wpa_supplicant'"; # Converted to throw 2025-10-27
-10
View File
@@ -6119,11 +6119,6 @@ with pkgs;
ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; };
ustream-ssl-wolfssl = callPackage ../development/libraries/ustream-ssl {
ssl_implementation = wolfssl;
additional_buildInputs = [ openssl ];
};
ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl {
ssl_implementation = mbedtls_2;
};
@@ -6737,11 +6732,6 @@ with pkgs;
libubox = callPackage ../development/libraries/libubox { with_ustream_ssl = true; };
libubox-wolfssl = callPackage ../development/libraries/libubox {
with_ustream_ssl = true;
ustream-ssl = ustream-ssl-wolfssl;
};
libubox-mbedtls = callPackage ../development/libraries/libubox {
with_ustream_ssl = true;
ustream-ssl = ustream-ssl-mbedtls;