From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: [PATCH] gnu: gnutls: Configure location of system-wide trust store Date: Wed, 04 Feb 2015 10:35:57 -0500 Message-ID: <877fvxit9e.fsf@netris.org> References: <87r3u7di49.fsf@netris.org> <20150204123652.GA21908@debian.eduroam.u-bordeaux.fr> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42716) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YJ1zl-0007Qp-JT for guix-devel@gnu.org; Wed, 04 Feb 2015 10:36:02 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YJ1zg-0001he-Rj for guix-devel@gnu.org; Wed, 04 Feb 2015 10:36:01 -0500 Received: from world.peace.net ([50.252.239.5]:33812) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YJ1zg-0001hZ-OC for guix-devel@gnu.org; Wed, 04 Feb 2015 10:35:56 -0500 In-Reply-To: <20150204123652.GA21908@debian.eduroam.u-bordeaux.fr> (Andreas Enge's message of "Wed, 4 Feb 2015 13:36:52 +0100") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Andreas Enge Cc: guix-devel@gnu.org Andreas Enge writes: > On Mon, Feb 02, 2015 at 06:11:02PM -0500, Mark H Weaver wrote: >> + "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"))) > > I would suggest to use --with-default-trust-store-dir=/etc/ssl/certs instead. > The option is available in gnutls-3.3.12, which I am building in the > wip-gnutls branch right now, and which looks good to push. > > This would allow us to provide not only a single file, but to potentially > merge different trust stores. We could also, for instance, prepare a package > per certification authority, so that the user could install exactly the > ones he trusts. Sounds good to me! Thanks :) Since GnuTLS updates require so much rebuilding, I would prefer to wait for Hydra to finish the rebuild of intel platforms on another branch before merging into master. > PS: Ideally, I still think it would be optimal if gnutls used a per user > environment variable, in the spirit of liberating users and not > system administrators. I will enquire. But for the time being, the > global specification looks better than nothing. I agree it would be good if upstream supported such a variable, so please do propose it to them! I think it has to be done upstream because of the potential security implications of setuid programs, as I mentioned in the thread a year ago. > When I have some time, > I will try to look into how to package certificates of certification > authorities. Putting individual certificates into /etc/ssl/certs > (and running c_rehash before installation) should make them usable > by gnutls and openssl alike. I've been looking into this as well, but will address it in another message. Thanks! Mark