all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* `guix pull` over HTTPS
@ 2017-02-09 15:55 Leo Famulari
  2017-02-10  0:30 ` Leo Famulari
                   ` (2 more replies)
  0 siblings, 3 replies; 33+ messages in thread
From: Leo Famulari @ 2017-02-09 15:55 UTC (permalink / raw)
  To: guix-devel


[-- Attachment #1.1: Type: text/plain, Size: 1301 bytes --]

Currently, the default source for `guix pull` is
<http://git.savannah.gnu.org/cgit/guix.git/snapshot/master.tar.gz>.

It's suboptimal to download the Guix source code over HTTP, since the
data can be mutated and recorded in transit. [0]

The Savannah admins have been working tirelessly to improve the Savannah
infrastructure, and they will soon announce the public availability of
Git served over HTTPS. [1]

HTTPS is not a security panacea but, in my opinion, we should use it if
it's available, at least until `guix pull` can verify commit signatures.

However, it's a little harder to get right than HTTP. For example, `guix
pull` could fail if there is a problem with the user's certificate
store, or if their clock is wrong.

Does anyone have any specific concerns or advice about changing the
value of %snapshot-url in (guix scripts pull) to use the HTTPS URL?
Should the change be that simple, or should we do more?

The attached patch works for me on a foreign distro when SSL_CERT_DIR
and SSL_CERT_FILE are set as described in the manual (section 7.2.9
X.509 Certificates) and GnuTLS-Guile is available in my environment.

[0] Discussion of the general problems with `guix pull`:
http://bugs.gnu.org/22883

[1]
http://lists.gnu.org/archive/html/savannah-hackers-public/2017-02/msg00034.html

[-- Attachment #1.2: 0001-pull-Download-GNU-Guix-with-HTTPS.patch --]
[-- Type: text/plain, Size: 859 bytes --]

From 63eca1a41d993c04d662736589872fbc7123a168 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Thu, 9 Feb 2017 12:13:42 +0100
Subject: [PATCH] pull: Download GNU Guix with HTTPS.

* guix/scripts/pull.scm (%snapshot-url): Use HTTPS URL.
---
 guix/scripts/pull.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guix/scripts/pull.scm b/guix/scripts/pull.scm
index 3f940f94d..2312eed29 100644
--- a/guix/scripts/pull.scm
+++ b/guix/scripts/pull.scm
@@ -45,7 +45,7 @@
 
 (define %snapshot-url
   ;; "http://hydra.gnu.org/job/guix/master/tarball/latest/download"
-  "http://git.savannah.gnu.org/cgit/guix.git/snapshot/master.tar.gz"
+  "https://git.savannah.gnu.org/cgit/guix.git/snapshot/master.tar.gz"
   )
 
 (define-syntax-rule (with-environment-variable variable value body ...)
-- 
2.11.0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply related	[flat|nested] 33+ messages in thread

end of thread, other threads:[~2017-03-06 12:27 UTC | newest]

Thread overview: 33+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-09 15:55 `guix pull` over HTTPS Leo Famulari
2017-02-10  0:30 ` Leo Famulari
2017-02-10 15:33   ` Ludovic Courtès
2017-02-10 16:22     ` Marius Bakke
2017-02-10 22:21       ` Ludovic Courtès
2017-02-10 22:43         ` Marius Bakke
2017-02-10 22:52           ` ng0
2017-02-11 14:28           ` Ludovic Courtès
2017-02-11 19:25             ` Leo Famulari
2017-02-11 19:48               ` Ricardo Wurmus
2017-02-12 13:36                 ` Ludovic Courtès
2017-02-28  5:46             ` Leo Famulari
2017-02-28 14:59               ` Marius Bakke
2017-02-28 16:29                 ` Leo Famulari
2017-02-28 16:45                   ` Marius Bakke
2017-02-28 20:44                     ` Marius Bakke
2017-02-28 21:44                       ` Marius Bakke
2017-02-28 21:54                         ` Marius Bakke
2017-03-01  2:36                           ` Marius Bakke
2017-03-01  5:14                             ` Leo Famulari
2017-03-01 21:20                               ` [PATCH v3] pull: Default to HTTPS Marius Bakke
2017-03-01 22:07                                 ` Leo Famulari
2017-03-01 21:21                               ` `guix pull` over HTTPS Marius Bakke
2017-03-06 10:04                               ` Ludovic Courtès
2017-03-06 10:06                         ` Ludovic Courtès
2017-03-06 12:27                           ` Marius Bakke
2017-02-28 23:05                   ` Marius Bakke
2017-03-01  0:19                     ` Leo Famulari
2017-02-28 16:39                 ` [PATCH] pull: Use HTTPS by default Marius Bakke
2017-03-01  1:01                   ` Leo Famulari
2017-02-10 18:55   ` `guix pull` over HTTPS Christopher Allan Webber
2017-02-10 15:29 ` Ludovic Courtès
2017-02-13 21:23 ` Bob Proulx

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.