Re: `guix pull` over HTTPS

[ludo@gnu.org (Ludovic Courtès)]

Hi Leo!

Leo Famulari <leo@famulari.name> skribis:

> HTTPS is not a security panacea but, in my opinion, we should use it if
> it's available, at least until `guix pull` can verify commit signatures.

Agreed.  At least it prevents eavesdropping and allows us to
authenticate the server (assuming the CA is trustworthy).

But as you write, the eventual goal is to authenticate the code rather
the server, which will provide much better assurance.

> However, it's a little harder to get right than HTTP. For example, `guix
> pull` could fail if there is a problem with the user's certificate
> store, or if their clock is wrong.
>
> Does anyone have any specific concerns or advice about changing the
> value of %snapshot-url in (guix scripts pull) to use the HTTPS URL?
> Should the change be that simple, or should we do more?

I think it should be this simple.

Of course there will be issues with people having the wrong SSL_CERT_DIR
& co. settings.  Also that means Guile-GnuTLS becomes a hard dependency,
which I think is fine.

Thanks,
Ludo’.