bug#28948: feh does encounter certificate errors with valid certificates

[Marius Bakke <mbakke@fastmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 736 bytes --]

ng0 <ng0@infotropique.org> writes:

> feh https://i.imgur.com/263enxT.jpg
> feh opens image
>
> Problem:
> user@abyayala ~/src/guix/guix$ feh https://i.imgur.com/263enxT.jpg
> feh WARNING: open url: server certificate verification failed. CAfile: none CRLfile: none
> feh WARNING: https://i.imgur.com/263enxT.jpg - File does not exist
> feh: No loadable images specified.
> See 'man feh' for detailed usage information

This is the same issue with libcurl as has been discussed many times in
the past.  Since it won't be fixed upstream any time soon (support for
CURL_CA_BUNDLE has been removed also for Windows), I suggest we "bite
the bullet" this time and add a hard-coded default.

I've verified that this patch works (on GuixSD):


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-gnu-curl-Look-up-SSL-certificates-in-etc-ssl-certs-b.patch --]
[-- Type: text/x-patch, Size: 2082 bytes --]

From 2ae03883c2526965f1a93cf5c691c41f02dc14b4 Mon Sep 17 00:00:00 2001
From: Marius Bakke <mbakke@fastmail.com>
Date: Fri, 9 Jun 2017 16:45:38 +0200
Subject: [PATCH] gnu: curl: Look up SSL certificates in /etc/ssl/certs by
 default.

* gnu/packages/curl.scm (curl)[arguments]<#:configure-flags>: Add '--with-ca-path'.
<#:phases>: Delete test that tries to use it.
---
 gnu/packages/curl.scm | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 2e4a48d1e..7248a6d40 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -67,7 +67,14 @@
        ("pkg-config" ,pkg-config)
        ("python" ,python-2)))
    (arguments
-    `(#:configure-flags '("--with-gnutls" "--with-gssapi")
+    `(#:configure-flags '("--with-gnutls" "--with-gssapi"
+                          ;; Hard-code a default CA certificate path so that
+                          ;; most things work "out of the box", at least on
+                          ;; GuixSD and Debian-based distributions.
+                          ;; libcurl does not support overriding this at runtime
+                          ;; except through the API, and it's impractical to
+                          ;; patch every application to respect CURL_CA_BUNDLE.
+                          "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt")
       ;; Add a phase to patch '/bin/sh' occurances in tests/runtests.pl
       #:phases
       (modify-phases %standard-phases
@@ -87,6 +94,10 @@
            (substitute* "tests/runtests.pl"
              (("/bin/sh") (which "sh")))
 
+           ;; XXX: This test fails because the default CA bundle path
+           ;; does not exist in the build environment.
+           (delete-file "tests/data/test324")
+
            ;; XXX FIXME: Test #1510 seems to work on some machines and not
            ;; others, possibly based on the kernel version.  It works on GuixSD
            ;; on x86_64 with linux-libre-4.1, but fails on Hydra for both i686
-- 
2.14.3


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]