all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Konrad Hinsen <konrad.hinsen@fastmail.net>
To: help-guix@gnu.org
Subject: Certificates in pure and containerized environments
Date: Thu, 30 Sep 2021 12:08:53 +0200	[thread overview]
Message-ID: <m18rzextmy.fsf@fastmail.net> (raw)

Dear Guix experts,

I am trying to move the execution of a Python script into a pure
environment, but it fails because of certificate issues for which I am
looking for a good fix.

The minimal example I came up with is:

   guix environment --pure \
           --ad-hoc python -- \
           python3 -c 'import urllib.request; print(urllib.request.urlopen("http://wwwbis.sidc.be/DATA/uset/Wlight/2003/11/UPH20031109112104.FTS"))'

This fails with the error message

    urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)>

I have no idea why Python's urllib checks a certificate chain for a http
URL, but that's not my subject now. A variant that works fine is

   guix environment --pure --preserve=^SSL_CERT \
           --ad-hoc python -- \
           python3 -c 'import urllib.request; print(urllib.request.urlopen("http://wwwbis.sidc.be/DATA/uset/Wlight/2003/11/UPH20031109112104.FTS"))'

which adds two environment variables to the temporary environment:

   SSL_CERT_DIR=/home/hinsen/.guix-profile/etc/ssl/certs
   SSL_CERT_FILE=/home/hinsen/.guix-profile/etc/ssl/certs/ca-certificates.crt

Since all the certificates come from Guix, I expect that I should also
be able to use

   guix environment --pure \
           --ad-hoc python nss-certs -- \
           python3 -c 'import urllib.request; print(urllib.request.urlopen("http://wwwbis.sidc.be/DATA/uset/Wlight/2003/11/UPH20031109112104.FTS"))'

but this doesn't work - same error as initially.

I am not happy with exposing an environment variable from my personal
account, as I want my run to be reproducible and portable to any machine
running Guix, Ideally, I'd even move on to a containerized environment.
Is there any way to achieve this?

Thanks in advance,
  Konrad



             reply	other threads:[~2021-09-30 10:09 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-30 10:08 Konrad Hinsen [this message]
2021-10-03 16:45 ` Certificates in pure and containerized environments Wiktor Żelazny
2021-10-04  7:25   ` zimoun
2021-10-04  9:37     ` Konrad Hinsen
2021-10-04 10:04       ` zimoun
2021-10-10 15:42     ` Wiktor Żelazny
2021-10-11  6:27       ` Konrad Hinsen
2021-10-05 17:42   ` Maxim Cournoyer
2021-10-08  8:47     ` Konrad Hinsen
2021-10-11 15:05       ` Maxim Cournoyer
2021-10-13 11:51         ` Konrad Hinsen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=m18rzextmy.fsf@fastmail.net \
    --to=konrad.hinsen@fastmail.net \
    --cc=help-guix@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.