all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* bug#24466: `guix download` accepts expired TLS certificates
@ 2016-09-19  1:14 Leo Famulari
  2016-11-07 22:45 ` Ludovic Courtès
  0 siblings, 1 reply; 2+ messages in thread
From: Leo Famulari @ 2016-09-19  1:14 UTC (permalink / raw)
  To: 24466

[-- Attachment #1: Type: text/plain, Size: 615 bytes --]

While testing Nicolas's patch "Update giac-xcas", I found that `guix
download` accepts expired TLS certificates.

I tried visiting the upstream site in order to verify the hash of the
updated package, and my browsers (Firefox and Chromium) warned me that
the site's certificate had expired ~1 day ago.

However, `guix build -S` did not warn me or prevent me from downloading
the source code.

Perhaps it doesn't matter for the case of `guix build -S`, since we
already know what we expect to download. But, for `guix download`, this
is a bug.

[0]
http://lists.gnu.org/archive/html/guix-devel/2016-09/msg01460.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* bug#24466: `guix download` accepts expired TLS certificates
  2016-09-19  1:14 bug#24466: `guix download` accepts expired TLS certificates Leo Famulari
@ 2016-11-07 22:45 ` Ludovic Courtès
  0 siblings, 0 replies; 2+ messages in thread
From: Ludovic Courtès @ 2016-11-07 22:45 UTC (permalink / raw)
  To: Leo Famulari; +Cc: 24466-done

Leo Famulari <leo@famulari.name> skribis:

> While testing Nicolas's patch "Update giac-xcas", I found that `guix
> download` accepts expired TLS certificates.
>
> I tried visiting the upstream site in order to verify the hash of the
> updated package, and my browsers (Firefox and Chromium) warned me that
> the site's certificate had expired ~1 day ago.
>
> However, `guix build -S` did not warn me or prevent me from downloading
> the source code.
>
> Perhaps it doesn't matter for the case of `guix build -S`, since we
> already know what we expect to download. But, for `guix download`, this
> is a bug.

This is fixed by commit bc3c41ce36349ed4ec758c70b48a7059e363043a.

Now ‘guix download’ shows a message like this upon failure:

--8<---------------cut here---------------start------------->8---
$ SSL_CERT_DIR=/nowhere ./pre-inst-env guix download https://mirror.guixsd.org/index.html

Starting download of /tmp/guix-file.jT2WjA
From https://mirror.guixsd.org/index.html...
ERROR: X.509 certificate of 'mirror.guixsd.org' could not be verified:
  signer-not-found
  invalid

failed to download "/tmp/guix-file.jT2WjA" from "https://mirror.guixsd.org/index.html"
--8<---------------cut here---------------end--------------->8---

The message is not optimal, but it convey the message that something is
wrong.

For fixed-output derivations (‘guix build -S’, etc.), the behavior is
unchanged: server certificates are happily ignored.  This is IMO the
right thing because (1) we know the hash of the expected content, which
is the only authentication method that matters, and (2) checking
certificates would require having fixed-output derivations depend on
‘nss’.

Thanks,
Ludo’.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2016-11-07 22:46 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-19  1:14 bug#24466: `guix download` accepts expired TLS certificates Leo Famulari
2016-11-07 22:45 ` Ludovic Courtès

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.