From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Subject: bug#24466: `guix download` accepts expired TLS certificates Date: Mon, 07 Nov 2016 23:45:23 +0100 Message-ID: <87bmxqvri4.fsf@gnu.org> References: <20160919011454.GA6941@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:50397) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c3sg2-0005am-1t for bug-guix@gnu.org; Mon, 07 Nov 2016 17:46:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c3sfy-00081f-Lp for bug-guix@gnu.org; Mon, 07 Nov 2016 17:46:06 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:33398) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1c3sfy-00081T-J3 for bug-guix@gnu.org; Mon, 07 Nov 2016 17:46:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1c3sfy-0000vi-EB for bug-guix@gnu.org; Mon, 07 Nov 2016 17:46:02 -0500 Sender: "Debbugs-submit" Resent-To: bug-guix@gnu.org Resent-Message-ID: In-Reply-To: <20160919011454.GA6941@jasmine> (Leo Famulari's message of "Sun, 18 Sep 2016 21:14:54 -0400") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Leo Famulari Cc: 24466-done@debbugs.gnu.org Leo Famulari skribis: > While testing Nicolas's patch "Update giac-xcas", I found that `guix > download` accepts expired TLS certificates. > > I tried visiting the upstream site in order to verify the hash of the > updated package, and my browsers (Firefox and Chromium) warned me that > the site's certificate had expired ~1 day ago. > > However, `guix build -S` did not warn me or prevent me from downloading > the source code. > > Perhaps it doesn't matter for the case of `guix build -S`, since we > already know what we expect to download. But, for `guix download`, this > is a bug. This is fixed by commit bc3c41ce36349ed4ec758c70b48a7059e363043a. Now =E2=80=98guix download=E2=80=99 shows a message like this upon failure: --8<---------------cut here---------------start------------->8--- $ SSL_CERT_DIR=3D/nowhere ./pre-inst-env guix download https://mirror.guixs= d.org/index.html Starting download of /tmp/guix-file.jT2WjA >From https://mirror.guixsd.org/index.html... ERROR: X.509 certificate of 'mirror.guixsd.org' could not be verified: signer-not-found invalid failed to download "/tmp/guix-file.jT2WjA" from "https://mirror.guixsd.org/= index.html" --8<---------------cut here---------------end--------------->8--- The message is not optimal, but it convey the message that something is wrong. For fixed-output derivations (=E2=80=98guix build -S=E2=80=99, etc.), the b= ehavior is unchanged: server certificates are happily ignored. This is IMO the right thing because (1) we know the hash of the expected content, which is the only authentication method that matters, and (2) checking certificates would require having fixed-output derivations depend on =E2=80=98nss=E2=80=99. Thanks, Ludo=E2=80=99.