From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: Re: GnuTLS and the =?utf-8?Q?=E2=80=9Ctrust_store=E2=80=9D?= Date: Thu, 05 Jan 2017 15:11:23 +0100 Message-ID: <87inpty4tw.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> References: <20170104144655.12321-1-ng0@libertad.pw> <20170104144655.12321-2-ng0@libertad.pw> <874m1ezugu.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <871swizsqv.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <87vatuimnp.fsf_-_@gnu.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:44586) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cP8lM-0000b0-Jy for guix-devel@gnu.org; Thu, 05 Jan 2017 09:11:29 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cP8lJ-0002GG-QR for guix-devel@gnu.org; Thu, 05 Jan 2017 09:11:28 -0500 In-Reply-To: <87vatuimnp.fsf_-_@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?utf-8?Q?Court=C3=A8s?= Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s writes: > Hello! > > Marius Bakke skribis: > >> Marius Bakke writes: >> >>> ng0 writes: >>> >>>> * gnu/packages/curl.scm (curl)[arguments]: Add "--with-ca-bundle" conf= igure flag. > > [...] > >> I realized shortly after posting why this wasn't done already. Curl has >> 1403 dependent packages, which would apply for "nss-certs" as well if >> that is added as input. Obviously we want to be able to update TLS >> certificates quickly without rebuilding ~1/4 of the tree. > > Indeed. It=E2=80=99s a situation where we do not want to have a static b= inding > between cURL and nss-certs; instead, they should be composed > dynamically, along the lines of what we already recommend at: > > https://www.gnu.org/software/guix/manual/html_node/X_002e509-Certificat= es.html Curl respects the variable "CURL_CA_BUNDLE". I think we could add a "native-search-path" for that, similar to how it's done for "git". ng0, can you try that? --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlhuVAsACgkQoqBt8qM6 VPrOhAgAzXyyzo7DRHOeKQqYJ8ntpTzKm3tmVG6UPkxISM1rS+WLjh9G2coCuZNQ haWSfVKrkUap9BDdfk/Js6X4j8BDK2ZuZ+DpzXbGLic3xYtOBlGVByqFah21Fe6Y yiPrXoupbv/WWywa5lhAaZA2TjcYo/pvlmrQiJPLYHlubXeLtI9opbNlH3qpdpga EwF9T2QpcIZrlqmpOSq1HQHKdonz1gwJPPH0JWKOaMviJuDaX7GobQVBuW5WLPJ0 ku/CFQzPXC/rEIRoml9EJwi4aGSIRtWeQ+WAY7PmfNaQ0kVBBcdA07tkmFHucjdg PM7ibir9sTEOb86XA+6BcHolHtak+g== =r/oI -----END PGP SIGNATURE----- --=-=-=--