From: Mark H Weaver <mhw@netris.org>
To: Andreas Enge <andreas@enge.fr>
Cc: guix-devel@gnu.org
Subject: Re: [PATCH] gnu: gnutls: Configure location of system-wide trust store
Date: Wed, 04 Feb 2015 10:35:57 -0500 [thread overview]
Message-ID: <877fvxit9e.fsf@netris.org> (raw)
In-Reply-To: <20150204123652.GA21908@debian.eduroam.u-bordeaux.fr> (Andreas Enge's message of "Wed, 4 Feb 2015 13:36:52 +0100")
Andreas Enge <andreas@enge.fr> writes:
> On Mon, Feb 02, 2015 at 06:11:02PM -0500, Mark H Weaver wrote:
>> + "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt")))
>
> I would suggest to use --with-default-trust-store-dir=/etc/ssl/certs instead.
> The option is available in gnutls-3.3.12, which I am building in the
> wip-gnutls branch right now, and which looks good to push.
>
> This would allow us to provide not only a single file, but to potentially
> merge different trust stores. We could also, for instance, prepare a package
> per certification authority, so that the user could install exactly the
> ones he trusts.
Sounds good to me! Thanks :)
Since GnuTLS updates require so much rebuilding, I would prefer to wait
for Hydra to finish the rebuild of intel platforms on another branch
before merging into master.
> PS: Ideally, I still think it would be optimal if gnutls used a per user
> environment variable, in the spirit of liberating users and not
> system administrators. I will enquire. But for the time being, the
> global specification looks better than nothing.
I agree it would be good if upstream supported such a variable, so
please do propose it to them! I think it has to be done upstream
because of the potential security implications of setuid programs, as I
mentioned in the thread a year ago.
> When I have some time,
> I will try to look into how to package certificates of certification
> authorities. Putting individual certificates into /etc/ssl/certs
> (and running c_rehash before installation) should make them usable
> by gnutls and openssl alike.
I've been looking into this as well, but will address it in another
message.
Thanks!
Mark
next prev parent reply other threads:[~2015-02-04 15:36 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-02-02 23:11 [PATCH] gnu: gnutls: Configure location of system-wide trust store Mark H Weaver
2015-02-03 0:01 ` David Thompson
2015-02-03 20:53 ` Ludovic Courtès
2015-02-03 20:57 ` Marek Benc
2015-02-04 12:36 ` Andreas Enge
2015-02-04 12:42 ` Andreas Enge
2015-02-04 15:35 ` Mark H Weaver [this message]
2015-02-05 9:59 ` Andreas Enge
2015-02-08 13:36 ` Andreas Enge
2015-02-08 14:29 ` Andreas Enge
2015-02-08 15:24 ` Andreas Enge
2015-02-08 15:59 ` Mark H Weaver
2015-02-15 5:17 ` Mark H Weaver
2015-02-15 9:16 ` Andreas Enge
2015-02-15 16:59 ` Mark H Weaver
2015-02-23 21:34 ` Ludovic Courtès
2015-02-24 20:31 ` Mark H Weaver
2015-02-25 0:25 ` Andreas Enge
2015-03-02 22:12 ` /etc/ssl/certs and the certificate bundle Ludovic Courtès
2015-03-03 2:25 ` Mark H Weaver
2015-03-03 7:29 ` [PATCHES] profiles: Produce a single-file CA " Mark H Weaver
2015-03-03 8:27 ` Mark H Weaver
2015-03-03 12:23 ` Andreas Enge
2015-03-03 12:32 ` Ludovic Courtès
2015-03-03 19:33 ` Mark H Weaver
2015-03-03 20:04 ` Ludovic Courtès
2015-03-03 12:43 ` Ludovic Courtès
2015-03-03 12:55 ` Andreas Enge
2015-03-03 20:27 ` Ludovic Courtès
-- strict thread matches above, loose matches on Subject: below --
2014-02-19 2:47 [PATCH] gnu: gnutls: Configure location of system-wide trust store Mark H Weaver
2014-02-19 9:26 ` Andreas Enge
2014-02-19 10:13 ` Mark H Weaver
2014-02-19 12:13 ` Andreas Enge
2014-02-19 13:40 ` Ludovic Courtès
2014-02-19 14:08 ` Andreas Enge
2014-02-19 14:37 ` Sree Harsha Totakura
2014-02-19 21:52 ` Ludovic Courtès
2014-02-20 19:39 ` Andreas Enge
2014-02-20 22:08 ` Ludovic Courtès
2014-02-20 18:01 ` Mark H Weaver
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877fvxit9e.fsf@netris.org \
--to=mhw@netris.org \
--cc=andreas@enge.fr \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).