Where can I find the ca-certificates.crt file from the nss-certs package?

Where can I find the ca-certificates.crt file from the nss-certs package?

[Reza Housseini]

Hello Guix

For an application I need a ca-certificates.crt file and according to 
[1] I can get it from the package nss-certs, but

ls $(guix build nss-certs) | grep ca-certificates.crt
does not list any certificates, what am I doing wrong?

Best,
Reza

[1] https://guix.gnu.org/en/manual/devel/en/guix.html#X_002e509-Certificates

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Adam McCartney]

On 2024-05-17, Reza Housseini wrote:
>Hello Guix
>
>For an application I need a ca-certificates.crt file and according to 
>[1] I can get it from the package nss-certs, but
>
>ls $(guix build nss-certs) | grep ca-certificates.crt
>does not list any certificates, what am I doing wrong?
>
>Best,
>Reza
>
>[1] https://guix.gnu.org/en/manual/devel/en/guix.html#X_002e509-Certificates
Hi Reza,

I think it might depend on a couple of things, are you using guix system or guix
as a package manager in a foreign distro?

Does it maybe have something to do with the _profile_ that you are using to
install the packages? I've been confused by this behaviour recently myself.
Do you know what profile you are using to install the nss-certs and the package
that requires them? And is this profile active?

If you provide a bit more info, maybe I can offer a few examples that help to
clarify.

regards,
Adam

-- 
  Adam McCartney - https://admccartney.mur.at 
/

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Reza Housseini]

Hi Adam

Thanks for the response. I am using Guix System and tried to configure a 
configuration file for offlineimap with guix home

(simple-service 'offlineimaprc
			  home-files-service-type
			  (list `(".offlineimaprc"
				  ,(mixed-text-file "offlineimaprc" "

[general]
accounts = Gmail
maxsyncaccounts = 3
pythonfile = ~/.config/mailpassword.py

[Account Gmail]
localrepository = Local
remoterepository = Remote

[Repository Local]
type = Maildir
localfolders = ~/Maildir

[Repository Remote]
type = IMAP
remotehost = imap.gmail.com
remoteuser = reza.housseini@gmail.com
remotepasseval = mailpassword('gmail')
ssl = yes
sslcacertfile = " nss-certs "/etc/ssl/certs/ca-certificates.crt
maxconnections = 1
"))))

yes it is a really odd behavior, because when I run guix shell 
nss-certs, I can find $GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt...

On 5/17/24 09:39, Adam McCartney wrote:
> On 2024-05-17, Reza Housseini wrote:
>> Hello Guix
>>
>> For an application I need a ca-certificates.crt file and according to 
>> [1] I can get it from the package nss-certs, but
>>
>> ls $(guix build nss-certs) | grep ca-certificates.crt
>> does not list any certificates, what am I doing wrong?
>>
>> Best,
>> Reza
>>
>> [1] 
>> https://guix.gnu.org/en/manual/devel/en/guix.html#X_002e509-Certificates
> Hi Reza,
> 
> I think it might depend on a couple of things, are you using guix system 
> or guix
> as a package manager in a foreign distro?
> 
> Does it maybe have something to do with the _profile_ that you are using to
> install the packages? I've been confused by this behaviour recently myself.
> Do you know what profile you are using to install the nss-certs and the 
> package
> that requires them? And is this profile active?
> 
> If you provide a bit more info, maybe I can offer a few examples that 
> help to
> clarify.
> 
> regards,
> Adam
> 

-- 
Reza Housseini

This message is signed with my GnuPG key:

     C0F3 0812 9AF2 80F4 0830 C2C1 C375 C6AF 0512 5C52

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Andreas Enge]

Hello,

Am Fri, May 17, 2024 at 11:49:19AM +0200 schrieb Reza Housseini:
> yes it is a really odd behavior, because when I run guix shell nss-certs, I
> can find $GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt...

I do not know, but I suppose that this file may be created as a profile
hook, in the sense that it is not directly contained in the package,
but created and put into the profile during a call to "guix shell"
or "guix install".

Andreas

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Adam McCartney]

On 2024-05-17, Reza Housseini wrote:
> Hi Adam
>
> Thanks for the response. I am using Guix System and tried to configure a
> configuration file for offlineimap with guix home
>
> (simple-service 'offlineimaprc
>                         home-files-service-type
>                         (list `(".offlineimaprc"
>                                 ,(mixed-text-file "offlineimaprc" "
>
> [general]
> accounts = Gmail
> maxsyncaccounts = 3
> pythonfile = ~/.config/mailpassword.py
>
> [Account Gmail]
> localrepository = Local
> remoterepository = Remote
>
> [Repository Local]
> type = Maildir
> localfolders = ~/Maildir
>
> [Repository Remote]
> type = IMAP
> remotehost = imap.gmail.com
> remoteuser = reza.housseini@gmail.com
> remotepasseval = mailpassword('gmail')
> ssl = yes
> sslcacertfile = " nss-certs "/etc/ssl/certs/ca-certificates.crt
> maxconnections = 1
> "))))
>
> yes it is a really odd behavior, because when I run guix shell nss-certs,
> I can find $GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt...
>

Hmm, I'm very much a newbie in terms of guix system, but maybe it has
something to do with the fact that `nss-certs` is now included by
default with guix system.[^1]

Can you run `sudo herd status nss-certs` and post the output?

Also the output of `echo "$SSL_CERT_DIR"` might be instructive.


[^1]:https://issues.guix.gnu.org/70451

p.s.: sorry for the duplicate emails I keep forgetting to reply to list!

-- 
  Adam McCartney - https://admccartney.mur.at 
/

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Reza Housseini]

> Hmm, I'm very much a newbie in terms of guix system, but maybe it has
> something to do with the fact that `nss-certs` is now included by
> default with guix system.[^1]

Yes I saw this and already reconfigured my system accordingly

> Can you run `sudo herd status nss-certs` and post the output?

there is no service with this name

> Also the output of `echo "$SSL_CERT_DIR"` might be instructive.

this is oddly enough /etc/ssl/certs, but no ca-certificates.crt file there

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Adam McCartney]

On 2024-05-17, Reza Housseini wrote:
>>Hmm, I'm very much a newbie in terms of guix system, but maybe it has
>>something to do with the fact that `nss-certs` is now included by
>>default with guix system.[^1]
>
>Yes I saw this and already reconfigured my system accordingly
>
>>Can you run `sudo herd status nss-certs` and post the output?
>
>there is no service with this name
>
Yeah, so I guess this is consistent with the new behaviour described in that
thread. So nss-certs should now be included with %base-packages. Do you include 
%base-packages somewhere in your system configuration?

>>Also the output of `echo "$SSL_CERT_DIR"` might be instructive.
>
>this is oddly enough /etc/ssl/certs, but no ca-certificates.crt file there
>
So the directory is completely empty?

-- 
  Adam McCartney - https://admccartney.mur.at 
/

Re: Where can I find the ca-certificates.crt file from the nss-certs package?

[Efraim Flashner]

[-- Attachment #1: Type: text/plain, Size: 1174 bytes --]

On Fri, May 17, 2024 at 11:49:19AM +0200, Reza Housseini wrote:
> Hi Adam
> 
> Thanks for the response. I am using Guix System and tried to configure a
> configuration file for offlineimap with guix home
> 
> (simple-service 'offlineimaprc
> 			  home-files-service-type
> 			  (list `(".offlineimaprc"
> 				  ,(mixed-text-file "offlineimaprc" "
> 
> [general]
> accounts = Gmail
> maxsyncaccounts = 3
> pythonfile = ~/.config/mailpassword.py
> 
> [Account Gmail]
> localrepository = Local
> remoterepository = Remote
> 
> [Repository Local]
> type = Maildir
> localfolders = ~/Maildir
> 
> [Repository Remote]
> type = IMAP
> remotehost = imap.gmail.com
> remoteuser = reza.housseini@gmail.com
> remotepasseval = mailpassword('gmail')
> ssl = yes
> sslcacertfile = " nss-certs "/etc/ssl/certs/ca-certificates.crt
> maxconnections = 1
> "))))

What I end up using is:
(or (getenv "GIT_SSL_CAINFO") (getenv "SSL_CERT_FILE"))

-- 
Efraim Flashner   <efraim@flashner.co.il>   רנשלפ םירפא
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]