From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: Re: `guix pull` over HTTPS Date: Fri, 10 Feb 2017 17:22:01 +0100 Message-ID: <87lgte10eu.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> References: <20170209155512.GA11291@jasmine> <20170210003054.GA12412@jasmine> <87fujmcb6w.fsf@gnu.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47581) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ccDxZ-000430-Cz for guix-devel@gnu.org; Fri, 10 Feb 2017 11:22:12 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ccDxU-0001vw-HS for guix-devel@gnu.org; Fri, 10 Feb 2017 11:22:09 -0500 In-Reply-To: <87fujmcb6w.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?utf-8?Q?Court=C3=A8s?= , Leo Famulari Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s writes: > Leo Famulari skribis: > >> On Thu, Feb 09, 2017 at 04:55:12PM +0100, Leo Famulari wrote: >>> Does anyone have any specific concerns or advice about changing the >>> value of %snapshot-url in (guix scripts pull) to use the HTTPS URL? >>> Should the change be that simple, or should we do more? >> >> While testing, I realized that an X.509 certificate store is not a >> standard feature of GuixSD, so using Savannah's HTTPS URL will not work >> in all cases. >> >> SSL_CERT_FILE and SSL_CERT_DIR appear to be set unconditionally in (gnu >> system operating-system-environment-variables), so it's not enough to >> test that they are set in order to decide which protocol to download the >> Guix source code with. >> >> Any advice on how to proceed? > > Initially, I didn=E2=80=99t want to have =E2=80=98nss-certs=E2=80=99 in = =E2=80=98%base-packages=E2=80=99 or > anything like that, on the grounds that the whole X.509 CA story is > completely broken IMO. I wonder if we should revisit that, on the > grounds that =E2=80=9Cit=E2=80=99s better than nothing.=E2=80=9D > > The next question is what to do with foreign distros, and whether we > should bundle =E2=80=98nss-certs=E2=80=99 in the binary tarball, which is= not exciting. > > Alternately we could have a package that provides only the Let=E2=80=99s = Encrypt > certificate chain, if that=E2=80=99s what Savannah uses. > > Thoughts? If the private key used on https://git.savannah.gnu.org/ is static, one option would be to "pin" the corresponding public key. However, some LE clients also rotate the private key when renewing, so we'd need to ask SV admins. And also receive notices in advance if the key ever changes. Pinning the intermediate CAs might work, but what to do when the certificate is signed by a new intermediate (which may happen[0])? How to deliver updates to users with old certs? See: https://www.owasp.org/index.php/Pinning_Cheat_Sheet and https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning ..for quick and long introductions, respectively. [0] https://community.letsencrypt.org/t/hpkp-best-practices-if-you-choose-t= o-implement/4625?source_topic_id=3D2450 --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlid6KkACgkQoqBt8qM6 VPppMwf+Ih95DEZccx13LTJ9w02E/AIBaLsF5hQLkv57r+UFiI4q4ILPJu7vYESY Oh6+Dlegpn+rq9QZ8iHcq7RpxL1MbiAfv8X8H+Ift3JgKOuP3hSe3eyQQatFVNNV KGLo4YYcAc6lR+EMJEwL5OSKWlKpa68HT9TehQjKzk3aIPd79KcU6aJT0ewQIWtb xrG9qisBv2sEj8vLdUGtoNnCKHcWsbV+OODGkEfHGtmGPFSvI/+YgJEHMG76I2p4 hwbwzE9dwFdKxBY8qh8Ht2r+XUiBokqHxCpVAq6S4m+q2UhRZjwqPPieD27f1EVZ IUv+IgylxUSInoXhYlijX90tcb7iuQ== =t0sW -----END PGP SIGNATURE----- --=-=-=--