From: Mark H Weaver <mhw@netris.org>
To: Andreas Enge <andreas@enge.fr>
Cc: guix-devel@gnu.org
Subject: Re: [PATCH] gnu: gnutls: Configure location of system-wide trust store
Date: Sun, 15 Feb 2015 11:59:19 -0500 [thread overview]
Message-ID: <87sie79km0.fsf@netris.org> (raw)
In-Reply-To: <20150215091632.GA9692@debian> (Andreas Enge's message of "Sun, 15 Feb 2015 10:16:32 +0100")
Andreas Enge <andreas@enge.fr> writes:
> Hello Mark,
>
> I am a bit lost with this explanation:
>
> On Sun, Feb 15, 2015 at 12:17:59AM -0500, Mark H Weaver wrote:
>> I've set GIT_SSL_CAINFO in my environment for a long time to make Git
>> check certificates properly on GuixSD, but without the single-file
>> certificate bundle, I've lost certificate checking in Git.
>
> Is this because upon installing nss-certs, you uninstalled your single file?
Yes. Of course I could make it manually, put it somewhere else, and set
GIT_SSL_CAINFO to point to it, but I'd like to find a solution that
works out of the box for other GuixSD users.
> Since we had no certificates at all before, I fail to understand how the
> situation could be worse now than it was.
No, it's not worse than it was before. Sorry if I gave that impression.
The only issue is that we might need to generate a single-file
certificate bundle for now, because I haven't found a way to get 'git'
to check certificates on GuixSD without a single-file cert bundle, at
least not when curl is build with GnuTLS.
> Would implementing the p11-kit suggestion for gnutls solve the problem?
Good question! I don't know the answer. It seems that when 'git' uses
libcurl built with GnuTLS, it doesn't ask GnuTLS to use the system-wide
trust store. Maybe that's something we could fix somehow.
> Your further analysis might also imply that we need search path definitions
> for git and curl (although this does not seem to be enough at the moment).
I can't speak for the curl command-line tool, because I never use it,
but we might need one for 'git'.
Mark
next prev parent reply other threads:[~2015-02-15 16:59 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-02-02 23:11 [PATCH] gnu: gnutls: Configure location of system-wide trust store Mark H Weaver
2015-02-03 0:01 ` David Thompson
2015-02-03 20:53 ` Ludovic Courtès
2015-02-03 20:57 ` Marek Benc
2015-02-04 12:36 ` Andreas Enge
2015-02-04 12:42 ` Andreas Enge
2015-02-04 15:35 ` Mark H Weaver
2015-02-05 9:59 ` Andreas Enge
2015-02-08 13:36 ` Andreas Enge
2015-02-08 14:29 ` Andreas Enge
2015-02-08 15:24 ` Andreas Enge
2015-02-08 15:59 ` Mark H Weaver
2015-02-15 5:17 ` Mark H Weaver
2015-02-15 9:16 ` Andreas Enge
2015-02-15 16:59 ` Mark H Weaver [this message]
2015-02-23 21:34 ` Ludovic Courtès
2015-02-24 20:31 ` Mark H Weaver
2015-02-25 0:25 ` Andreas Enge
2015-03-02 22:12 ` /etc/ssl/certs and the certificate bundle Ludovic Courtès
2015-03-03 2:25 ` Mark H Weaver
2015-03-03 7:29 ` [PATCHES] profiles: Produce a single-file CA " Mark H Weaver
2015-03-03 8:27 ` Mark H Weaver
2015-03-03 12:23 ` Andreas Enge
2015-03-03 12:32 ` Ludovic Courtès
2015-03-03 19:33 ` Mark H Weaver
2015-03-03 20:04 ` Ludovic Courtès
2015-03-03 12:43 ` Ludovic Courtès
2015-03-03 12:55 ` Andreas Enge
2015-03-03 20:27 ` Ludovic Courtès
-- strict thread matches above, loose matches on Subject: below --
2014-02-19 2:47 [PATCH] gnu: gnutls: Configure location of system-wide trust store Mark H Weaver
2014-02-19 9:26 ` Andreas Enge
2014-02-19 10:13 ` Mark H Weaver
2014-02-19 12:13 ` Andreas Enge
2014-02-19 13:40 ` Ludovic Courtès
2014-02-19 14:08 ` Andreas Enge
2014-02-19 14:37 ` Sree Harsha Totakura
2014-02-19 21:52 ` Ludovic Courtès
2014-02-20 19:39 ` Andreas Enge
2014-02-20 22:08 ` Ludovic Courtès
2014-02-20 18:01 ` Mark H Weaver
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87sie79km0.fsf@netris.org \
--to=mhw@netris.org \
--cc=andreas@enge.fr \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).