* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
@ 2015-07-02 9:57 Petr Hracek
2015-07-02 14:55 ` Eli Zaretskii
2022-04-13 0:30 ` Lars Ingebrigtsen
0 siblings, 2 replies; 16+ messages in thread
From: Petr Hracek @ 2015-07-02 9:57 UTC (permalink / raw)
To: 20960
HI folks,
I have a question to upstream whether CA directory
could be handled by upstream by default?
(setq smime-CA-directory "/etc/ssl/certs/ca-bundle.crt")
Or may be how it could be done by emacs packaging in Fedora?
https://bugzilla.redhat.com/show_bug.cgi?id=1131558
--
Petr Hracek
Software Engineer
Developer Experience
Red Hat, Inc
Mob: +420777056169
email: phracek@redhat.com
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 9:57 bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs Petr Hracek
@ 2015-07-02 14:55 ` Eli Zaretskii
2015-07-02 15:38 ` Glenn Morris
2022-04-13 0:30 ` Lars Ingebrigtsen
1 sibling, 1 reply; 16+ messages in thread
From: Eli Zaretskii @ 2015-07-02 14:55 UTC (permalink / raw)
To: Petr Hracek; +Cc: 20960
> Date: Thu, 02 Jul 2015 11:57:39 +0200
> From: Petr Hracek <phracek@redhat.com>
>
> I have a question to upstream whether CA directory
> could be handled by upstream by default?
What do you mean by "upstream"? Upstream Emacs?
> (setq smime-CA-directory "/etc/ssl/certs/ca-bundle.crt")
That file name is platform-dependent, and even on Unix the bundle can
be found in several different directories.
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 14:55 ` Eli Zaretskii
@ 2015-07-02 15:38 ` Glenn Morris
2015-07-02 16:12 ` Eli Zaretskii
2015-07-02 16:25 ` Stefan Monnier
0 siblings, 2 replies; 16+ messages in thread
From: Glenn Morris @ 2015-07-02 15:38 UTC (permalink / raw)
To: Eli Zaretskii; +Cc: 20960
Eli Zaretskii wrote:
>> (setq smime-CA-directory "/etc/ssl/certs/ca-bundle.crt")
On my RHEL7 system, this isn't a directory.
It is a symlink to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem,
a file.
> That file name is platform-dependent, and even on Unix the bundle can
> be found in several different directories.
So let's compile a list of the standard places and default to the first
that exists, similar to what gnutls-trustfiles does. (Does these two
variables duplicate each other?)
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 15:38 ` Glenn Morris
@ 2015-07-02 16:12 ` Eli Zaretskii
2015-07-02 22:18 ` Glenn Morris
2015-07-02 16:25 ` Stefan Monnier
1 sibling, 1 reply; 16+ messages in thread
From: Eli Zaretskii @ 2015-07-02 16:12 UTC (permalink / raw)
To: Glenn Morris; +Cc: 20960
> From: Glenn Morris <rgm@gnu.org>
> Cc: Petr Hracek <phracek@redhat.com>, 20960@debbugs.gnu.org
> Date: Thu, 02 Jul 2015 11:38:25 -0400
>
> So let's compile a list of the standard places and default to the first
> that exists
Is that really TRT? I don't use Gnus, but smime.el seems to want a
place to keep certificates of people/organizations from which you get
MIME messages. How probable it is to find them in the bundles
distributed by the OS?
I thought the user is supposed to collect the certificates for this
purpose, and keep them in this directory. IOW, these are not
system-wide certificates.
> similar to what gnutls-trustfiles does. (Does these two variables
> duplicate each other?)
gnutls-trustfiles should not be needed, except with old versions of
GnuTLS. The library now finds and uses the system-provided bundle
automatically (and on Windows the system certificates are not kept in
a disk file).
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 16:12 ` Eli Zaretskii
@ 2015-07-02 22:18 ` Glenn Morris
0 siblings, 0 replies; 16+ messages in thread
From: Glenn Morris @ 2015-07-02 22:18 UTC (permalink / raw)
To: Eli Zaretskii; +Cc: 20960
Eli Zaretskii wrote:
>> So let's compile a list of the standard places and default to the first
>> that exists
>
> Is that really TRT? I don't use Gnus, but smime.el seems to want a
> place to keep certificates of people/organizations from which you get
> MIME messages. How probable it is to find them in the bundles
> distributed by the OS?
I don't use it either, and have no idea what it is supposed to be for.
But
https://bugzilla.redhat.com/show_bug.cgi?id=1131558
says it helped. But as I say, the value it's being set to isn't a
directory, so it makes little sense to me.
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 15:38 ` Glenn Morris
2015-07-02 16:12 ` Eli Zaretskii
@ 2015-07-02 16:25 ` Stefan Monnier
2015-12-26 20:57 ` Lars Ingebrigtsen
1 sibling, 1 reply; 16+ messages in thread
From: Stefan Monnier @ 2015-07-02 16:25 UTC (permalink / raw)
To: Glenn Morris; +Cc: 20960
> that exists, similar to what gnutls-trustfiles does. (Do these two
> variables duplicate each other?)
Yes, I believe they are duplicates (with smime-CA-directory predating
the gnutls thingy).
Stefan
^ permalink raw reply [flat|nested] 16+ messages in thread* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 16:25 ` Stefan Monnier
@ 2015-12-26 20:57 ` Lars Ingebrigtsen
2015-12-28 22:02 ` Ted Zlatanov
0 siblings, 1 reply; 16+ messages in thread
From: Lars Ingebrigtsen @ 2015-12-26 20:57 UTC (permalink / raw)
To: Stefan Monnier; +Cc: 20960
Stefan Monnier <monnier@iro.umontreal.ca> writes:
>> that exists, similar to what gnutls-trustfiles does. (Do these two
>> variables duplicate each other?)
>
> Yes, I believe they are duplicates (with smime-CA-directory predating
> the gnutls thingy).
smime-CA-directory should be rewritten to use gnutls-trustfiles (if
gnutls-trustfiles exists). The minor complication is that the former is
a directory and the latter is a list of files, so it wouldn't be exactly
backwards compatible...
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-12-26 20:57 ` Lars Ingebrigtsen
@ 2015-12-28 22:02 ` Ted Zlatanov
2015-12-28 22:30 ` Lars Ingebrigtsen
2017-01-26 19:24 ` Lars Ingebrigtsen
0 siblings, 2 replies; 16+ messages in thread
From: Ted Zlatanov @ 2015-12-28 22:02 UTC (permalink / raw)
To: Lars Ingebrigtsen; +Cc: 20960, Stefan Monnier
On Sat, 26 Dec 2015 21:57:24 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote:
LI> Stefan Monnier <monnier@iro.umontreal.ca> writes:
>>> that exists, similar to what gnutls-trustfiles does. (Do these two
>>> variables duplicate each other?)
>>
>> Yes, I believe they are duplicates (with smime-CA-directory predating
>> the gnutls thingy).
LI> smime-CA-directory should be rewritten to use gnutls-trustfiles (if
LI> gnutls-trustfiles exists). The minor complication is that the former is
LI> a directory and the latter is a list of files, so it wouldn't be exactly
LI> backwards compatible...
We can make `gnutls-trustfiles' support directories?
Ted
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-12-28 22:02 ` Ted Zlatanov
@ 2015-12-28 22:30 ` Lars Ingebrigtsen
2015-12-30 14:52 ` Ted Zlatanov
2017-01-26 19:24 ` Lars Ingebrigtsen
1 sibling, 1 reply; 16+ messages in thread
From: Lars Ingebrigtsen @ 2015-12-28 22:30 UTC (permalink / raw)
To: Stefan Monnier; +Cc: 20960
Ted Zlatanov <tzz@lifelogs.com> writes:
> We can make `gnutls-trustfiles' support directories?
Sure, that would help.
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-12-28 22:30 ` Lars Ingebrigtsen
@ 2015-12-30 14:52 ` Ted Zlatanov
2015-12-31 17:11 ` Lars Magne Ingebrigtsen
0 siblings, 1 reply; 16+ messages in thread
From: Ted Zlatanov @ 2015-12-30 14:52 UTC (permalink / raw)
To: Lars Ingebrigtsen; +Cc: 20960, Stefan Monnier
On Mon, 28 Dec 2015 23:30:05 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote:
LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> We can make `gnutls-trustfiles' support directories?
LI> Sure, that would help.
It should be fairly easy to add... just two questions:
Would it be enough to use `directory-files' with the .pem and .crt
extensions, case-insensitively? Should it be recursive?
Thanks
Ted
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-12-30 14:52 ` Ted Zlatanov
@ 2015-12-31 17:11 ` Lars Magne Ingebrigtsen
0 siblings, 0 replies; 16+ messages in thread
From: Lars Magne Ingebrigtsen @ 2015-12-31 17:11 UTC (permalink / raw)
To: Stefan Monnier; +Cc: 20960
Ted Zlatanov <tzz@lifelogs.com> writes:
> Would it be enough to use `directory-files' with the .pem and .crt
> extensions, case-insensitively? Should it be recursive?
Hm... I don't know whether it should be recursive, but if it should,
that's easy with `directory-files-recursively'. :-)
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-12-28 22:02 ` Ted Zlatanov
2015-12-28 22:30 ` Lars Ingebrigtsen
@ 2017-01-26 19:24 ` Lars Ingebrigtsen
2017-01-31 14:38 ` Ted Zlatanov
1 sibling, 1 reply; 16+ messages in thread
From: Lars Ingebrigtsen @ 2017-01-26 19:24 UTC (permalink / raw)
To: 20960
Ted Zlatanov <tzz@lifelogs.com> writes:
> On Sat, 26 Dec 2015 21:57:24 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote:
>
> LI> Stefan Monnier <monnier@iro.umontreal.ca> writes:
>>>> that exists, similar to what gnutls-trustfiles does. (Do these two
>>>> variables duplicate each other?)
>>>
>>> Yes, I believe they are duplicates (with smime-CA-directory predating
>>> the gnutls thingy).
>
> LI> smime-CA-directory should be rewritten to use gnutls-trustfiles (if
> LI> gnutls-trustfiles exists). The minor complication is that the former is
> LI> a directory and the latter is a list of files, so it wouldn't be exactly
> LI> backwards compatible...
>
> We can make `gnutls-trustfiles' support directories?
On the other hand, this is the only place smime-CA-directory is used:
(defun smime-verify-region (b e)
"Verify S/MIME message in region between B and E.
Returns non-nil on success.
Any details (stdout and stderr) are left in the buffer specified by
`smime-details-buffer'."
(smime-new-details-buffer)
(let ((CAs (append (if smime-CA-file
(list "-CAfile"
(expand-file-name smime-CA-file)))
(if smime-CA-directory
(list "-CApath"
(expand-file-name smime-CA-directory))))))
And:
-CAfile file
a file containing trusted CA certificates, only used with -verify.
-CApath dir
a directory containing trusted CA certificates, only used with
-verify. This directory must be a standard certificate directory:
that is a hash of each subject name (using x509 -hash) should be
linked to each certificate.
Is a list of CA files, and can be in different directories, so there's,
like, no way to used them interchangeably.
So... I dunno. Somebody could just rewrite that function to use all
the files from (gnutls-trustfiles) and see if one of them are OK. I
never use smime, though, so I'm not that person.
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 16+ messages in thread* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2017-01-26 19:24 ` Lars Ingebrigtsen
@ 2017-01-31 14:38 ` Ted Zlatanov
2017-01-31 16:27 ` Lars Ingebrigtsen
0 siblings, 1 reply; 16+ messages in thread
From: Ted Zlatanov @ 2017-01-31 14:38 UTC (permalink / raw)
To: Lars Ingebrigtsen; +Cc: 20960
On Thu, 26 Jan 2017 20:24:16 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote:
LI> Is a list of CA files, and can be in different directories, so there's,
LI> like, no way to used them interchangeably.
LI> So... I dunno. Somebody could just rewrite that function to use all
LI> the files from (gnutls-trustfiles) and see if one of them are OK. I
LI> never use smime, though, so I'm not that person.
I'm lost. Should we support directories or not?
Ted
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2017-01-31 14:38 ` Ted Zlatanov
@ 2017-01-31 16:27 ` Lars Ingebrigtsen
2017-01-31 18:45 ` Ted Zlatanov
0 siblings, 1 reply; 16+ messages in thread
From: Lars Ingebrigtsen @ 2017-01-31 16:27 UTC (permalink / raw)
To: 20960
Ted Zlatanov <tzz@lifelogs.com> writes:
> On Thu, 26 Jan 2017 20:24:16 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote:
>
> LI> Is a list of CA files, and can be in different directories, so there's,
> LI> like, no way to used them interchangeably.
>
> LI> So... I dunno. Somebody could just rewrite that function to use all
> LI> the files from (gnutls-trustfiles) and see if one of them are OK. I
> LI> never use smime, though, so I'm not that person.
>
> I'm lost. Should we support directories or not?
Because of the way the inputs for the smime commands are structured,
making gnutls-trustfiles support directories doesn't help us. I think.
I may be misreading the man pages or having a brain fart. :-)
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2017-01-31 16:27 ` Lars Ingebrigtsen
@ 2017-01-31 18:45 ` Ted Zlatanov
0 siblings, 0 replies; 16+ messages in thread
From: Ted Zlatanov @ 2017-01-31 18:45 UTC (permalink / raw)
To: Lars Ingebrigtsen; +Cc: 20960
On Tue, 31 Jan 2017 17:27:56 +0100 Lars Ingebrigtsen <larsi@gnus.org> wrote:
LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> I'm lost. Should we support directories or not?
LI> Because of the way the inputs for the smime commands are structured,
LI> making gnutls-trustfiles support directories doesn't help us. I think.
LI> I may be misreading the man pages or having a brain fart. :-)
Since it's less work, I concur and procrastination wins again.
Ted
^ permalink raw reply [flat|nested] 16+ messages in thread
* bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs
2015-07-02 9:57 bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs Petr Hracek
2015-07-02 14:55 ` Eli Zaretskii
@ 2022-04-13 0:30 ` Lars Ingebrigtsen
1 sibling, 0 replies; 16+ messages in thread
From: Lars Ingebrigtsen @ 2022-04-13 0:30 UTC (permalink / raw)
To: Petr Hracek; +Cc: 20960
Petr Hracek <phracek@redhat.com> writes:
> I have a question to upstream whether CA directory
> could be handled by upstream by default?
>
> (setq smime-CA-directory "/etc/ssl/certs/ca-bundle.crt")
>
> Or may be how it could be done by emacs packaging in Fedora?
(I'm going through old bug reports that unfortunately weren't resolved
at the time.)
In Emacs 29, I've made smime-CA-file default to the value from
`gnutls-trustfiles', so that this should basically work out of the box
on most systems now.
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2022-04-13 0:30 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-07-02 9:57 bug#20960: handling /etc/ssl/certs/ca-bundle.crt by default in emacs Petr Hracek
2015-07-02 14:55 ` Eli Zaretskii
2015-07-02 15:38 ` Glenn Morris
2015-07-02 16:12 ` Eli Zaretskii
2015-07-02 22:18 ` Glenn Morris
2015-07-02 16:25 ` Stefan Monnier
2015-12-26 20:57 ` Lars Ingebrigtsen
2015-12-28 22:02 ` Ted Zlatanov
2015-12-28 22:30 ` Lars Ingebrigtsen
2015-12-30 14:52 ` Ted Zlatanov
2015-12-31 17:11 ` Lars Magne Ingebrigtsen
2017-01-26 19:24 ` Lars Ingebrigtsen
2017-01-31 14:38 ` Ted Zlatanov
2017-01-31 16:27 ` Lars Ingebrigtsen
2017-01-31 18:45 ` Ted Zlatanov
2022-04-13 0:30 ` Lars Ingebrigtsen
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).