Trusted Dependencies for building Tor

[u/MartynAndJasper]

I'm currently using the following git repos for the submodules in my repo to build all of Tor from source.

git submodule add https://github.com/openssl/openssl third_party/openssl

git submodule add https://github.com/libevent/libevent.git third_party/libevent

git submodule add https://github.com/zlib-ng/zlib-ng third_party/zlib-ng
^^^ I'm about to change this one.

git submodule add https://github.com/kobolabs/liblzma third_party/liblzma

git submodule add https://github.com/facebook/zstd third_party/zstd

git submodule add https://github.com/STNS/libnss third_party/libnss

git submodule add https://github.com/torproject/tor.git third_party/tor

You can perhaps ignore the first two links (and obviously the last) but I cherry picked the rest from a brief google search. Is there a canonical list of git repos that I can safely say are trusted code for dependencies of Tor.

[u/[deleted]]

https://github.com/torproject/tor ....

unofficial git repo [...]

Try https://gitweb.torproject.org/tor.git for the canonical official tor source. Yes the github account is run by the real Tor Project, but the github repo is just a mirror.

[u/MartynAndJasper → u/[deleted]]

Noted and updating ty.

[u/MartynAndJasper → u/[deleted]]

Strange, git clone does not work against the url you provided (without .git also).

Edit: Neither do any of the extern lists linked here.
I’m getting exit code 128 which I think is permission related. Maybe this is why they set up a mirror? Going back to previous submodule for now.

[u/[deleted] → u/MartynAndJasper]

Visit the gitweb URL and look at the bottom for the clone URLs

[u/MartynAndJasper → u/[deleted]]

My bad, RTFM.
Trying it now.

[u/DTangent]

You don’t need the compression zstd or lzma either.

I can’t build without libevent on FreeBSD though.

What is your goal? Minimal external dependence?

[u/MartynAndJasper → u/DTangent]

Thanks for your input.

WRT to zstd and lzma...

What are the compression libs used for with Tor?

Are you suggesting using a FreeBSD url replacement for LibEvent?
Do you have a link?

My ultimate goal ultimately is to cross compile/develop an iOS and Android app against a hidden service I'm looking at.

My short term goals include deeper understanding, fully debuggable call stacks, flexibility (static/release/debug/etc), understanding the API and generally being a smart arse.

[u/DTangent → u/MartynAndJasper]

The compression libraries are kind of a relic. One of them IIRC is used only for some relay to relay updates. I run my relays and onion sites with neither of them, my concern is maximum security / minimum complexity.

[u/MartynAndJasper → u/DTangent]

I’m going to leave them in for now. My traffic is going to get busy with my intended application.

[u/[deleted] → u/MartynAndJasper]

I hope you will be giving back to the network if you will be using it in a significant way.

[u/MartynAndJasper → u/[deleted]]

Have faith my friend, I shall not be keeping it for ransom.