From: Ted Zlatanov <tzz@lifelogs.com>
To: emacs-devel@gnu.org
Subject: Re: need help with certificate bundles for ALL the platforms Emacs supports
Date: Mon, 13 Feb 2012 08:24:30 -0500 [thread overview]
Message-ID: <87ipja7to1.fsf@lifelogs.com> (raw)
In-Reply-To: jwvvcnbzag5.fsf-monnier+emacs@gnu.org
On Sun, 12 Feb 2012 22:28:24 -0500 Stefan Monnier <monnier@IRO.UMontreal.CA> wrote:
>> +(defcustom gnutls-trustfiles '(
>> + ;; Debian, Ubuntu, Gentoo and Arch Linux
>> + "/etc/ssl/certs/ca-certificates.crt"
>> + ;; Fedora and RHEL
>> + "/etc/pki/tls/certs/ca-bundle.crt"
>> + ;; Suse
>> + "/etc/ssl/ca-bundle.pem"
>> + )
>> + "List of functions or filenames yielding CA bundle locations.
>> +The files may be in PEM or DER format, as per the GnuTLS documentation.
>> +The files may not exist, in which case they will be ignored.
>> +Functions will be called and may return a filename or a list of filenames."
>> + :group 'gnutls
>> + :type '(repeat (choice (function :tag "Function")
>> + (file :tag "Bundle filename"))))
SM> How 'bout something like
(defcustom gnutls-trustfile
(let ((file (if (boundp 'cert-bundle-location)
cert-bundle-location))
(candidates
'("/etc/ssl/certs/ca-certificates.crt" ; Debian, Gentoo, Arch.
"/etc/pki/tls/certs/ca-bundle.crt" ; Fedora and RHEL.
"/etc/ssl/ca-bundle.pem" ; Suse.
)))
(while candidates
(if (file-readable-p (car candidates))
(setq file (car candidate) candidates nil)
(setq candidates (cdr candidates))))
file)
"Name of the CA bundle file.
The file may be in PEM or DER format, as per the GnuTLS documentation."
:group 'gnutls
:type '(choice (const nil) (file :tag "Bundle filename")))
The trustfiles parameter is a list of files, all the way through to
gnutls.c. I don't think it should be demoted to a single file in the
customization interface, and it still needs a function choice.
Also I don't want to decide the default bundle file names at the time
the defcustom is evaluated. Since `gnutls-trustfiles' can contain
function calls, I'd like it to be called when it's needed. For
instance, it's very common to store certificates as PEM files in a
directory, and the user should be able to choose that approach instead
of managing a concatenated bundle. If we built the file list only once,
the modular approach would fail. Another situation is on W32, where the
cert bundle has to be dynamically built (which will require some caching
but should still be done as close to using the bundle as possible).
Ted
next prev parent reply other threads:[~2012-02-13 13:24 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-30 2:02 Emacs 24.0.93 Pretest Windows Binaries published Christoph Scholtes
2012-01-30 4:55 ` Drew Adams
2012-01-30 17:47 ` Eli Zaretskii
2012-01-30 18:17 ` [h-e-w] " Drew Adams
2012-01-30 18:57 ` Eli Zaretskii
2012-01-30 19:08 ` Drew Adams
2012-01-30 19:09 ` Eli Zaretskii
2012-01-30 18:49 ` Eli Zaretskii
2012-01-31 14:03 ` Christoph Scholtes
2012-01-31 14:15 ` Drew Adams
2012-02-02 19:22 ` Ted Zlatanov
2012-02-02 19:52 ` Drew Adams
2012-02-02 21:46 ` Ted Zlatanov
2012-02-02 22:05 ` Drew Adams
2012-02-03 13:26 ` Ted Zlatanov
2012-02-03 7:48 ` Eli Zaretskii
2012-02-03 13:23 ` GnuTLS invasion of Emacs (was: Emacs 24.0.93 Pretest Windows Binaries published) Ted Zlatanov
2012-02-03 16:29 ` GnuTLS invasion of Emacs published) Eli Zaretskii
2012-02-03 16:51 ` Ted Zlatanov
2012-02-09 14:16 ` need help with certificate bundles for ALL the platforms Emacs supports (was: GnuTLS invasion of Emacs published)) Ted Zlatanov
2012-02-09 18:53 ` Eli Zaretskii
2012-02-10 13:06 ` need help with certificate bundles for ALL the platforms Emacs supports Ted Zlatanov
2012-02-10 15:51 ` Eli Zaretskii
2012-02-10 16:37 ` Ted Zlatanov
2012-02-11 17:22 ` Andy Moreton
2012-02-11 17:45 ` Eli Zaretskii
2012-02-12 2:43 ` Ted Zlatanov
2012-02-12 4:05 ` Eli Zaretskii
2012-02-12 13:36 ` Ted Zlatanov
2012-02-13 10:29 ` Andy Moreton
2012-02-13 13:15 ` Ted Zlatanov
2012-02-10 17:11 ` Ted Zlatanov
2012-02-10 18:57 ` Stefan Monnier
2012-02-12 22:13 ` Ted Zlatanov
2012-02-13 3:28 ` Stefan Monnier
2012-02-13 13:24 ` Ted Zlatanov [this message]
2012-02-13 15:12 ` Stefan Monnier
2012-02-13 16:30 ` Ted Zlatanov
2012-02-13 21:04 ` Stefan Monnier
2012-02-13 21:54 ` Ted Zlatanov
2012-02-13 21:55 ` Lars Ingebrigtsen
2012-02-13 22:20 ` Stefan Monnier
2012-02-14 0:05 ` Ted Zlatanov
2012-02-14 2:13 ` Stefan Monnier
2012-02-14 2:32 ` Glenn Morris
2012-02-14 13:01 ` Ted Zlatanov
2012-02-03 13:25 ` Emacs 24.0.93 Pretest Windows Binaries published Stefan Monnier
2012-02-03 0:48 ` [h-e-w] " Richard M. Heiberger
2012-02-03 8:12 ` Eli Zaretskii
2012-02-03 10:03 ` Stephen J. Turnbull
2012-02-03 10:31 ` Eli Zaretskii
2012-02-03 13:49 ` Stephen J. Turnbull
2012-02-03 15:44 ` Eli Zaretskii
2012-02-12 4:04 ` Lennart Borgman
2012-02-12 4:08 ` Lennart Borgman
2012-02-12 16:23 ` Eli Zaretskii
2012-02-12 22:19 ` Lennart Borgman
2012-02-13 3:29 ` Stefan Monnier
2012-02-13 3:51 ` Eli Zaretskii
2012-02-13 19:23 ` Lennart Borgman
2012-02-14 22:43 ` Lennart Borgman
-- strict thread matches above, loose matches on Subject: below --
2012-02-13 22:30 need help with certificate bundles for ALL the platforms Emacs supports nyc4bos
2012-02-14 13:14 ` Ted Zlatanov
2012-02-14 14:04 ` Andy Moreton
2012-02-14 15:53 ` Ted Zlatanov
2012-02-16 18:47 ` nyc4bos
2012-02-17 13:06 ` Ted Zlatanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ipja7to1.fsf@lifelogs.com \
--to=tzz@lifelogs.com \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.