From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: [PATCH] gnu: curl: Update to 7.41.0. Fix #20121. Date: Sun, 22 Mar 2015 12:56:43 -0400 Message-ID: <87vbht7yyc.fsf@netris.org> References: <1427019636-24875-1-git-send-email-sleep_walker@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:38806) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YZjAm-0003kp-5k for guix-devel@gnu.org; Sun, 22 Mar 2015 12:56:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YZjAi-0005Jy-5L for guix-devel@gnu.org; Sun, 22 Mar 2015 12:56:24 -0400 In-Reply-To: <1427019636-24875-1-git-send-email-sleep_walker@gnu.org> (=?utf-8?B?IlRvbcOhxaEJxIxlY2giJ3M=?= message of "Sun, 22 Mar 2015 11:20:36 +0100") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: =?utf-8?B?VG9tw6HFoSDEjGVjaA==?= Cc: guix-devel@gnu.org Tom=C3=A1=C5=A1 =C4=8Cech writes: > @@ -60,7 +64,18 @@ > ("pkg-config" ,pkg-config) > ("python" ,python-2))) > (arguments > - `(#:configure-flags '("--with-gnutls" "--with-gssapi") > + `(#:configure-flags > + '("--with-gnutls" "--with-gssapi" "--enable-http" > + ;; This option requires parameter so let's use this one > + ;; - when it exists, it makes sense > + ;; - when it doesn't exist, we can still use SSL_CERT_DIR enviro= nment > + ;; variable to set it per user or for whole system > + ;; Fixes #20121. > + "--with-ca-path=3D/etc/ssl/certs" It would be better to avoid passing the --with-ca-path=3D option. We are attempting to move away from having any compiled-in system-wide location for the CA trust store. Each user should be able to specify their desired trust store using environment variables or other settings. We currently pass a similar configure-time option to GnuTLS for now, but only because GnuTLS provides no other way to specify the location of an old-style system trust store. We should be able to remove this when we have the more modern p11-kit system working. Can you find a way to make 'curl' work without compiling-in a hard-coded system trust store location? Mark