From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: GnuTLS integration manual patch needs review Date: Wed, 19 Aug 2015 09:57:46 -0400 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87wpwrnzxh.fsf@lifelogs.com> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-Trace: ger.gmane.org 1440099492 18116 80.91.229.3 (20 Aug 2015 19:38:12 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 20 Aug 2015 19:38:12 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Thu Aug 20 21:38:01 2015 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1ZSVex-00059o-Fd for ged-emacs-devel@m.gmane.org; Thu, 20 Aug 2015 21:37:59 +0200 Original-Received: from localhost ([::1]:42654 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZS3t5-0004xS-Fn for ged-emacs-devel@m.gmane.org; Wed, 19 Aug 2015 09:58:43 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:37320) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZS3sg-0004t6-Nz for emacs-devel@gnu.org; Wed, 19 Aug 2015 09:58:19 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZS3sd-0004t4-IU for emacs-devel@gnu.org; Wed, 19 Aug 2015 09:58:18 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:56227) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZS3sd-0004rk-Ci for emacs-devel@gnu.org; Wed, 19 Aug 2015 09:58:15 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1ZS3sS-0007nV-TE for emacs-devel@gnu.org; Wed, 19 Aug 2015 15:58:05 +0200 Original-Received: from c-98-229-61-72.hsd1.ma.comcast.net ([98.229.61.72]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 19 Aug 2015 15:58:04 +0200 Original-Received: from tzz by c-98-229-61-72.hsd1.ma.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 19 Aug 2015 15:58:04 +0200 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 68 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: c-98-229-61-72.hsd1.ma.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/25.0.50 (gnu/linux) Cancel-Lock: sha1:tEuKNoHCaQKXiCAr6yGMGv9U/68= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:188978 Archived-At: --=-=-= Content-Type: text/plain The patch here suggests some testing methods to ensure (with the current Emacs) that the GnuTLS integration works, and to secure things if the integration is not available. I'd like some review, please, before I push it into master. Thanks Ted --=-=-= Content-Type: text/x-diff Content-Disposition: inline; filename=gnutls-texi.patch diff --git a/doc/misc/emacs-gnutls.texi b/doc/misc/emacs-gnutls.texi index 4f6ef01..a40aa67 100644 --- a/doc/misc/emacs-gnutls.texi +++ b/doc/misc/emacs-gnutls.texi @@ -97,6 +97,27 @@ This function returns @code{t} if GnuTLS is available in this instance of Emacs. @end defun +If you're on a platform without the GnuTLS integration support, you +can try using the following settings, but they are strongly +discouraged and will have no effect in a future Emacs release (the +exact release where that will happen is as of yet unknown). Again, +these settings are discouraged! + +(You may want to replace the @code{python -m certifi} there with a +static path to your CA trust bundle, for example, +@file{/etc/ssl/certs/ca-certificates.crt}. +@url{https://pypi.python.org/pypi/certifi} is a Python package that +distributes a root CA trust bundle for other programs to use. If you +don't know what any of this means, you should absolutely not be using +these settings. Did we mention they are discouraged?) + +@lisp + '(tls-checktrust t) + '(tls-program + (quote + ("gnutls-cli --x509cafile \"$(python -m certifi)\" -p %p %h"))) +@end lisp + Oh, but sometimes things go wrong. Budgets aren't balanced, television ads lie, and even TLS and SSL connections can fail to work properly. Well, there's something to be done in the last case. @@ -108,6 +129,17 @@ information. @end defvar +You can check your SSL/TLS connectivity with the built-in Emacs URL +package. Switch to the @code{*scratch*} buffer and run: + +@lisp +(require 'url) +;; valid certificate, you should check out Let's Encrypt! +(url-insert-file-contents "https://letsencrypt.org/") +;; invalid certificate authority, abort +(url-insert-file-contents "https://www.financialcryptography.com/") +@end lisp + @defvar gnutls-algorithm-priority The @code{gnutls-algorithm-priority} variable sets the GnuTLS priority string. This is global, not per host name (although --=-=-=--