bug#36817: Guix Download Fails When SSL_CERT_DIR is a Colon-Separated Path

bug#36817: Guix Download Fails When SSL_CERT_DIR is a Colon-Separated Path

[Katherine Cox-Buday]

I was receiving X.509 certificate errors when attempting to run `guix
download`. After investigating, I found that it was because my
`SSL_CERT_DIR` environmental variable had two paths separated by a
colon. The two paths were actually the same. After removing the second
path, `guix download` began working again.

Wondering how the duplicate paths came to be, I discovered that
`${GUIX_PROFILE}/etc/profile` had two exports defined for
`SSL_CERT_DIR`. I discovered this was because I had both openssl and
libressl installed (if memory serves, I needed openssl for some
development task that relied on an idiosyncrasy of openssl). Removing
openssl removed the duplicate entry.

I think there may be two bugs:

1. `guix download` needs to respect colon-separated paths.
2. The profile mechanics in Guix should probably have some way to check
   if they're redefining the same thing before placing things in `etc/profile`.

Thank you to everyone for all of your hard work, and for Guix.

-- 
Katherine

bug#36817: Guix Download Fails When SSL_CERT_DIR is a Colon-Separated Path

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1963 bytes --]

Katherine,

(...sorry for the sloooooow response...)

Katherine Cox-Buday <cox.katherine.e@gmail.com> writes:

> I was receiving X.509 certificate errors when attempting to run `guix
> download`. After investigating, I found that it was because my
> `SSL_CERT_DIR` environmental variable had two paths separated by a
> colon. The two paths were actually the same. After removing the second
> path, `guix download` began working again.
>
> Wondering how the duplicate paths came to be, I discovered that
> `${GUIX_PROFILE}/etc/profile` had two exports defined for
> `SSL_CERT_DIR`. I discovered this was because I had both openssl and
> libressl installed (if memory serves, I needed openssl for some
> development task that relied on an idiosyncrasy of openssl). Removing
> openssl removed the duplicate entry.

The duplicate exports was because the search path specifications of
OpenSSL and LibreSSL have slightly different "signatures": the former
has a "singly entry" search path, whereas LibreSSLs native-search-paths
have a TODO comment suggesting that they too should be single-entry.

I've fixed it by resolving the TODO: now including both packages in the
same profile will point SSL_CERT_DIR to the profile union.

> I think there may be two bugs:
>
> 1. `guix download` needs to respect colon-separated paths.

Adding support for multiple SSL_CERT_DIR paths could be useful, but I
think the real problem was that LibreSSL and OpenSSL caused inconsistent
entries.  Thus, I'm closing this issue, but feel free to reopen if you
disagree.  :-)

> 2. The profile mechanics in Guix should probably have some way to check
>    if they're redefining the same thing before placing things in `etc/profile`.

Let's open a separate bug report for this if it turns out to be a
recurring problem.

> Thank you to everyone for all of your hard work, and for Guix.

Thank you for the report, and the kind words!  :-)

Fixed in 04cfe91efd41a89d7d01d2cd7b736213059dde5a.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]