[bug#32530] [PATCH] gnu: octave: Fix CA certificate use.

[Kei Kebreau <kkebreau@posteo.net>]

[-- Attachment #1.1: Type: text/plain, Size: 2692 bytes --]

Marius Bakke <mbakke@fastmail.com> writes:

> Kei Kebreau <kkebreau@posteo.net> writes:
>
>> Kei Kebreau <kkebreau@posteo.net> writes:
>>
>>> Marius Bakke <mbakke@fastmail.com> writes:
>>>
>>>> Kei Kebreau <kkebreau@posteo.net> writes:
>>>>
>>>>> * gnu/packages/maths.scm (octave)[arguments]: Add 'wrap-program' phase to wrap
>>>>> Octave with the path to system CA certificates.
>>>>> ---
>>>>>  gnu/packages/maths.scm | 8 +++++++-
>>>>>  1 file changed, 7 insertions(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
>>>>> index 3d571e8cc..b0caff0f5 100644
>>>>> --- a/gnu/packages/maths.scm
>>>>> +++ b/gnu/packages/maths.scm
>>>>> @@ -1417,7 +1417,13 @@ can solve two kinds of problems:
>>>>>                  (string-append "Vmakeinfo_program = \""
>>>>>                                 (assoc-ref inputs "texinfo")
>>>>>                                 "/bin/makeinfo\"")))
>>>>> -             #t)))))
>>>>> +             #t))
>>>>> +         (add-after 'install 'wrap-program
>>>>> +           (lambda* (#:key outputs #:allow-other-keys)
>>>>> +             (let ((out (assoc-ref outputs "out")))
>>>>> +               (wrap-program (string-append out "/bin/octave")
>>>>> +                 '("CURLOPT_CAPATH" suffix ("/etc/ssl/certs")))
>>>>> +               #t))))))
>>>>
>>>> Instead of wrapping you can add a native-search-path for CURLOPT_CAPATH
>>>> (as with CURL_CA_BUNDLE for `curl`).  That way installing certificates
>>>> to the profile should be sufficient.
>>>
>>> Ah! Yes, this works when I add curl to the profile. I didn't do this the
>>> first time. I'll upload a patch here soon.
>>
>> Here's the search path patch. With this, I needed both nss-certs and
>> cURL installed alongside Octave to get certificates working.
>
> [...]
>
>> diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
>> index 6d45dc0cc..8bdba8655 100644
>> --- a/gnu/packages/curl.scm
>> +++ b/gnu/packages/curl.scm
>> @@ -83,7 +83,10 @@
>>             (variable "CURL_CA_BUNDLE")
>>             (file-type 'regular)
>>             (separator #f)                         ;single entry
>> -           (files '("etc/ssl/certs/ca-certificates.crt")))))
>> +           (files '("etc/ssl/certs/ca-certificates.crt")))
>> +          (search-path-specification
>> +           (variable "CURLOPT_CAPATH")
>> +           (files '("etc/ssl/certs")))))
>
> Adding this native-search-path to the "octave" package should be
> sufficient.  Then you won't need curl in the profile, nor do we need to
> rebuild all the things that depend on curl.  Can you try that?

Adding the native-search-path to the "octave" package works!

>
> Thanks for fixing this issue :-)


[-- Attachment #1.2: 0001-gnu-octave-Add-a-search-path-for-CURLOPT_CAPATH.patch --]
[-- Type: text/plain, Size: 932 bytes --]

From df88f083f8974b1cb17d03ede300505ec3ecabc1 Mon Sep 17 00:00:00 2001
From: Kei Kebreau <kkebreau@posteo.net>
Date: Sun, 16 Sep 2018 22:17:06 -0400
Subject: [PATCH] gnu: octave: Add a search path for CURLOPT_CAPATH.

* gnu/packages/maths.scm (octave)[native-search-paths]: New field.
---
 gnu/packages/maths.scm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index d3e72128c..7389f972b 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -1397,6 +1397,10 @@ can solve two kinds of problems:
        ("less" ,less)
        ("ghostscript" ,ghostscript)
        ("gnuplot" ,gnuplot)))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "CURLOPT_CAPATH")
+            (files '("etc/ssl/certs")))))
     (arguments
      `(#:configure-flags
        (list (string-append "--with-shell="
-- 
2.19.0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]