From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: [PATCH] gnu: curl: Update to 7.41.0. Fix #20121. Date: Sun, 22 Mar 2015 14:16:00 -0400 Message-ID: <87r3sg99un.fsf@netris.org> References: <1427019636-24875-1-git-send-email-sleep_walker@gnu.org> <87vbht7yyc.fsf@netris.org> <20150322174115.GA13755@venom> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:50856) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YZkPU-0004UE-8M for guix-devel@gnu.org; Sun, 22 Mar 2015 14:15:41 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YZkPR-0002FN-1F for guix-devel@gnu.org; Sun, 22 Mar 2015 14:15:40 -0400 Received: from world.peace.net ([50.252.239.5]:50922) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YZkPQ-0002FH-Tb for guix-devel@gnu.org; Sun, 22 Mar 2015 14:15:36 -0400 In-Reply-To: <20150322174115.GA13755@venom> (=?utf-8?B?IlRvbcOhxaEgxIxl?= =?utf-8?B?Y2giJ3M=?= message of "Sun, 22 Mar 2015 18:41:15 +0100") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: guix-devel@gnu.org Tom=C3=A1=C5=A1 =C4=8Cech writes: > On Sun, Mar 22, 2015 at 12:56:43PM -0400, Mark H Weaver wrote: >> >>It would be better to avoid passing the --with-ca-path=3D option. We are >>attempting to move away from having any compiled-in system-wide location >>for the CA trust store. Each user should be able to specify their >>desired trust store using environment variables or other settings. > > I verified that patch is now sufficient as solution and I verified > that it respects SSL_CERT_DIR with that so it is ideal solution. Sounds perfect! > Thanks for kicking me step further. (And yes, that patch is really > needed :) Thanks very much for your role in getting that patch produced and upstreamed. It sounds like this will allow our 'git' to consult SSL_CERT_DIR when checking https certificates, which was not possible before when libcurl was linked with GnuTLS. Instead, we had to create a legacy single-file trust store and set SSL_CERT_FILE. There may still be other programs that require the single-file trust store, but I'm glad that libcurl-based programs can now be crossed off that list :) Mark