From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ricardo Wurmus Subject: Re: GnuTLS and the =?utf-8?Q?=E2=80=9Ctrust_store=E2=80=9D?= Date: Fri, 6 Jan 2017 15:20:03 +0100 Message-ID: References: <20170104144655.12321-1-ng0@libertad.pw> <20170104144655.12321-2-ng0@libertad.pw> <874m1ezugu.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <871swizsqv.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <87vatuimnp.fsf_-_@gnu.org> <87inpty4tw.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <87zij52jd2.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:53067) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cPVNs-0001AW-1t for guix-devel@gnu.org; Fri, 06 Jan 2017 09:20:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cPVNo-000536-Tu for guix-devel@gnu.org; Fri, 06 Jan 2017 09:20:44 -0500 In-Reply-To: <87zij52jd2.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?utf-8?Q?Court=C3=A8s?= Cc: guix-devel@gnu.org Ludovic Court=C3=A8s writes: > Ricardo Wurmus skribis: > >> Marius Bakke writes: >> >>> Curl respects the variable "CURL_CA_BUNDLE". I think we could add a >>> "native-search-path" for that, similar to how it's done for "git". >> >> =E2=80=9Ccurl=E2=80=9D does but libcurl does not. > > But that=E2=80=99s probably on purpose. What do the cURL developers re= commend > for their users? > > If they recommend that users roll their own mechanism to designate the > trust store, then they probably do (?), and I think we should avoid > interfering with that. I don=E2=80=99t know what they recommend but on an FHS-compliant system l= ibcurl would be configured to default to a well-known path for the default CA bundle. This allows users of libcurl to just not care about implementing a mechanism to override the default CA bundle, because it would fall back to the well-known system-wide path. One of these packages is =E2=80=9Cr-curl=E2=80=9D, which just assumes tha= t the libcurl defaults are fine. We patch it to enable CURL_CA_BUNDLE lookup (a feature that was intended only for Windows). Since GuixSD does not offer this path and Guix can be used on different systems I think we need to provide an alternative. One alternative is to replace the well-known path with a call to getenv("CURL_CA_BUNDLE"). ~~ Ricardo