From mboxrd@z Thu Jan  1 00:00:00 1970
From: Mark H Weaver <mhw@netris.org>
Subject: Re: root certificate
Date: Thu, 14 Jun 2018 13:49:22 -0400
Message-ID: <87muvxp8bh.fsf@netris.org>
References: <87y3flo3rc.fsf@santanas.co.za> <87d0wuv0nv.fsf@netris.org>
	<87muvx3ncl.fsf@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain
Return-path: <help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:52305)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mhw@netris.org>) id 1fTWOf-0002PW-Tw
	for help-guix@gnu.org; Thu, 14 Jun 2018 13:50:58 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <mhw@netris.org>) id 1fTWOb-0003Ch-0w
	for help-guix@gnu.org; Thu, 14 Jun 2018 13:50:58 -0400
Received: from world.peace.net ([64.112.178.59]:39242)
	by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
	(Exim 4.71) (envelope-from <mhw@netris.org>) id 1fTWOa-00039C-S6
	for help-guix@gnu.org; Thu, 14 Jun 2018 13:50:52 -0400
In-Reply-To: <87muvx3ncl.fsf@gmail.com> (Chris Marusich's message of "Wed, 13
	Jun 2018 23:15:38 -0700")
List-Id: <help-guix.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/help-guix>,
	<mailto:help-guix-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/help-guix/>
List-Post: <mailto:help-guix@gnu.org>
List-Help: <mailto:help-guix-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/help-guix>,
	<mailto:help-guix-request@gnu.org?subject=subscribe>
Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org
Sender: "Help-Guix" <help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org>
To: Chris Marusich <cmmarusich@gmail.com>
Cc: help-guix@gnu.org

Hi Chris,

Chris Marusich <cmmarusich@gmail.com> writes:

> Mark H Weaver <mhw@netris.org> writes:
>
>>            ;; Create hash symlinks suitable for OpenSSL ('SSL_CERT_DIR' and
>>            ;; similar.)
>>            (chdir (string-append %output "/etc/ssl/certs"))
>>            (invoke (string-append perl "/bin/perl")
>>                    (string-append openssl "/bin/c_rehash")
>>                    ".")))))
>
> I didn't know about c_rehash until now.  Interesting!  In the past, I've
> defined my own certificate packages as described in my own separate
> replies to this thread, and they worked even though I didn't invoke
> c_rehash.  Could this simply have been because the software I use
> happens to work even when the symlinks created by c_rehash don't exist?

According to the c_rehash man page, "many programs that use OpenSSL
require directories to be set up like this in order to find
certificates."  I'm not sure, but I guess that programs based on GnuTLS
do not need the symlinks.

> It looks like the ca-certificate-bundle profile hook (defined in
> guix/profiles.scm) doesn't currently invoke c_rehash.  Should it?

If I understand correctly, as long as each certificate package runs
'c_rehash' individually, then running 'c_rehash' during the profile hook
should have no effect, because all of the certificates will already have
their associated hash symlinks installed.

     Regards,
       Mark