Re: [core-updates] Setting SSL_CERT_FILE in the build environment

[Zheng Junjie <zhengjunjie@iscas.ac.cn>]

[-- Attachment #1.1: Type: text/plain, Size: 702 bytes --]

Ricardo Wurmus <rekado@elephly.net> writes:

> Ricardo Wurmus <rekado@elephly.net> writes:
>
>> Ricardo Wurmus <rekado@elephly.net> writes:
>>
>>> How can we generate a certificate bundle in the build environment?
>>> Apparently it is not enough to just add the nss-certs package.
>>
>> Apparently it is totally enough to just add the nss-certs package, and
>> that's what I did in commit cf2fbc8f20e26c56d0e864f302a191a1d95962cd.
>
> I got confused by the fact that only python-requests-next fails to
> build; the older python-requests has always been fine.
>
> So I reverted that commit and admit that I still don't have an answer to
> the above question.  Ideas welcome!

This patch should fix it.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-gnu-python-requests-next-Fix-build.patch --]
[-- Type: text/x-patch, Size: 3527 bytes --]

From f41bf905cfb1395a53cfc0d79315148ac9ba0a79 Mon Sep 17 00:00:00 2001
Message-ID: <f41bf905cfb1395a53cfc0d79315148ac9ba0a79.1721059686.git.zhengjunjie@iscas.ac.cn>
From: Zheng Junjie <zhengjunjie@iscas.ac.cn>
Date: Tue, 16 Jul 2024 00:06:39 +0800
Subject: [PATCH] gnu: python-requests-next: Fix build.

* gnu/packages/python-web.scm (python-requests-next): Fix build.
[native-inputs]: Add nss-certs.
[arguments]: Add set-SSL_CERT_FILE phase.
<#:modules>: Adjust it.

Change-Id: I1592ef3329fdcd681df618bb12fbc205aa028be3
---
 gnu/packages/python-web.scm | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/python-web.scm b/gnu/packages/python-web.scm
index bca7da9139..7cf54dc07a 100644
--- a/gnu/packages/python-web.scm
+++ b/gnu/packages/python-web.scm
@@ -94,6 +94,7 @@ (define-module (gnu packages python-web)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages base)
   #:use-module (gnu packages bash)
+  #:use-module (gnu packages certs)
   #:use-module (gnu packages check)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages curl)
@@ -3614,6 +3615,8 @@ (define-public python-requests-next
               (base32
                "0q5742pnibwy74169kacin3dmqg9jzmzk7qab5aq5caffcbm8djm"))))
     (build-system python-build-system)
+    (native-inputs
+     (list nss-certs))
     (propagated-inputs
      (list python-certifi
            python-charset-normalizer
@@ -3621,7 +3624,37 @@ (define-public python-requests-next
            python-urllib3))
     (arguments
      ;; FIXME: Some tests require network access.
-     '(#:tests? #f))
+     (list #:tests? #f
+           #:modules `((guix build utils)
+                       (guix build python-build-system)
+                       (rnrs io ports)
+                       (ice-9 ftw)
+                       (srfi srfi-26))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before  'sanity-check 'set-SSL_CERT_FILE
+                 ;; adjust from (guix profiles) ca-certificate-bundle
+                 (lambda _
+                   (define (pem-file? file)
+                     (string-suffix? ".pem" file))
+                   (define (ca-files top)
+                     (let ((cert-dir (string-append top "/etc/ssl/certs")))
+                       (map (cut string-append cert-dir "/" <>)
+                            (or (scandir cert-dir pem-file?) '()))))
+                   (define (concatenate-files files result)
+                     "Make RESULT the concatenation of all of FILES."
+                     (define (dump file port)
+                       (display (call-with-input-file file get-string-all)
+                                port)
+                       (newline port))
+                     (call-with-output-file result
+                       (lambda (port)
+                         (for-each (cut dump <> port) files))))
+                   (concatenate-files (ca-files
+                                       #$(this-package-native-input
+                                          "nss-certs"))
+                                      "/tmp/ca-certificates.crt")
+                   (setenv "SSL_CERT_FILE" "/tmp/ca-certificates.crt"))))))
     (home-page "http://python-requests.org/")
     (synopsis "Python HTTP library")
     (description

base-commit: 05e6bd3efe1b03190839d2b91b09fa768c4ef83c
-- 
2.45.2


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]