GNU bug report logs - #30619
Cuirass requires TLS certificates

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 30619 in the body.
You can then email your comments to 30619 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Andreas Enge <andreas <at> enge.fr>
To: bug-guix <at> gnu.org
Subject: Cuirass requires TLS certificates
Date: Mon, 26 Feb 2018 21:51:58 +0100

Hello,

the cuirass service requires TLS certificates to do continuous integration
of guix (or more generally, git repositories served over https). This works
when nss-certs is installed as a global package in the system.

Should the service depend on the nss-certs package? Or maybe take as an
optional configuration parameter a certificate package?

Andreas

Message #8 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Andreas Enge <andreas <at> enge.fr>
Cc: 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Tue, 27 Feb 2018 17:00:40 +0100

Andreas Enge <andreas <at> enge.fr> skribis:

> the cuirass service requires TLS certificates to do continuous integration
> of guix (or more generally, git repositories served over https). This works
> when nss-certs is installed as a global package in the system.
>
> Should the service depend on the nss-certs package? Or maybe take as an
> optional configuration parameter a certificate package?

I thought that, instead of assuming /etc/ssl/certs exists, the Cuirass
service could use (file-append nss-certs "/etc/ssl/certs/ca-certificates.crt").
That would make it self-contained.

That’s currently not possible though because this certificate bundle is
built as a profile hook.  We would first need to export the procedure
that creates bundles, possibly by moving it to a new (guix
x509-certificates) module.

Thoughts?

Ludo’.

Message #11 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: ludo <at> gnu.org (Ludovic Courtès), Mathieu Othacehe
 <othacehe <at> gnu.org>
Cc: Andreas Enge <andreas <at> enge.fr>, 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Thu, 16 Sep 2021 09:33:15 +0200

Hi,

On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès) wrote:
> Andreas Enge <andreas <at> enge.fr> skribis:
>
>> the cuirass service requires TLS certificates to do continuous integration
>> of guix (or more generally, git repositories served over https). This works
>> when nss-certs is installed as a global package in the system.
>>
>> Should the service depend on the nss-certs package? Or maybe take as an
>> optional configuration parameter a certificate package?
>
> I thought that, instead of assuming /etc/ssl/certs exists, the Cuirass
> service could use (file-append nss-certs "/etc/ssl/certs/ca-certificates.crt").
> That would make it self-contained.
>
> That’s currently not possible though because this certificate bundle is
> built as a profile hook.  We would first need to export the procedure
> that creates bundles, possibly by moving it to a new (guix
> x509-certificates) module.

What is the status of this old bug [1]?  Well, if it is not fixed yet,
it seems a forgotten bug. :-)

1: <http://issues.guix.gnu.org/issue/30619>

Cheers,
simon

Message #14 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: ludo <at> gnu.org (Ludovic Courtès)
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Tue, 12 Oct 2021 23:57:11 +0200

Hi,

On Thu, 16 Sep 2021 at 09:33, zimoun <zimon.toutoune <at> gmail.com> wrote:
> On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès) wrote:
>> Andreas Enge <andreas <at> enge.fr> skribis:
>>
>>> the cuirass service requires TLS certificates to do continuous integration
>>> of guix (or more generally, git repositories served over https). This works
>>> when nss-certs is installed as a global package in the system.
>>>
>>> Should the service depend on the nss-certs package? Or maybe take as an
>>> optional configuration parameter a certificate package?
>>
>> I thought that, instead of assuming /etc/ssl/certs exists, the Cuirass
>> service could use (file-append nss-certs "/etc/ssl/certs/ca-certificates.crt").
>> That would make it self-contained.
>>
>> That’s currently not possible though because this certificate bundle is
>> built as a profile hook.  We would first need to export the procedure
>> that creates bundles, possibly by moving it to a new (guix
>> x509-certificates) module.
>
> What is the status of this old bug [1]?  Well, if it is not fixed yet,
> it seems a forgotten bug. :-)
>
> 1: <http://issues.guix.gnu.org/issue/30619>

From my understanding, this old bug could be closed.  But I am not sure
to get it right about this TLS story.  So closing?


Cheers,
simon

Message #17 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: zimoun <zimon.toutoune <at> gmail.com>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Fri, 15 Oct 2021 17:20:57 +0200

Hi,

zimoun <zimon.toutoune <at> gmail.com> skribis:

> On Thu, 16 Sep 2021 at 09:33, zimoun <zimon.toutoune <at> gmail.com> wrote:
>> On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès) wrote:
>>> Andreas Enge <andreas <at> enge.fr> skribis:
>>>
>>>> the cuirass service requires TLS certificates to do continuous integration
>>>> of guix (or more generally, git repositories served over https). This works
>>>> when nss-certs is installed as a global package in the system.
>>>>
>>>> Should the service depend on the nss-certs package? Or maybe take as an
>>>> optional configuration parameter a certificate package?
>>>
>>> I thought that, instead of assuming /etc/ssl/certs exists, the Cuirass
>>> service could use (file-append nss-certs "/etc/ssl/certs/ca-certificates.crt").
>>> That would make it self-contained.
>>>
>>> That’s currently not possible though because this certificate bundle is
>>> built as a profile hook.  We would first need to export the procedure
>>> that creates bundles, possibly by moving it to a new (guix
>>> x509-certificates) module.
>>
>> What is the status of this old bug [1]?  Well, if it is not fixed yet,
>> it seems a forgotten bug. :-)
>>
>> 1: <http://issues.guix.gnu.org/issue/30619>
>
> From my understanding, this old bug could be closed.  But I am not sure
> to get it right about this TLS story.  So closing?

The Cuirass Shepherd service still does:

              #:environment-variables
              (list "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" …)

which means that users still need to install certificates globally.

Now, whether it’s an issue, I don’t know.

Maybe we can close?

Thanks,
Ludo’.

Message #20 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Fri, 26 Nov 2021 02:38:22 +0100

Hi,

On Fri, 15 Oct 2021 at 17:20, Ludovic Courtès <ludo <at> gnu.org> wrote:
> zimoun <zimon.toutoune <at> gmail.com> skribis:
>> On Thu, 16 Sep 2021 at 09:33, zimoun <zimon.toutoune <at> gmail.com> wrote:
>>> On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès) wrote:

> The Cuirass Shepherd service still does:
>
>               #:environment-variables
>               (list "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" …)
>
> which means that users still need to install certificates globally.
>
> Now, whether it’s an issue, I don’t know.
>
> Maybe we can close?

I propose to close since I do not see what could the next action.

1: <http://issues.guix.gnu.org/issue/30619>


Cheers,
simon

Message #23 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: zimoun <zimon.toutoune <at> gmail.com>, Ludovic Courtès
 <ludo <at> gnu.org>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Fri, 26 Nov 2021 06:28:20 +0000

zimoun schreef op vr 26-11-2021 om 02:38 [+0100]:
> Hi,
> 
> On Fri, 15 Oct 2021 at 17:20, Ludovic Courtès <ludo <at> gnu.org> wrote:
> > zimoun <zimon.toutoune <at> gmail.com> skribis:
> > > On Thu, 16 Sep 2021 at 09:33, zimoun <zimon.toutoune <at> gmail.com>
> > > wrote:
> > > > On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès)
> > > > wrote:
> 
> > The Cuirass Shepherd service still does:
> > 
> >               #:environment-variables
> >               (list "GIT_SSL_CAINFO=/etc/ssl/certs/ca-
> > certificates.crt" …)
> > 
> > which means that users still need to install certificates globally.
> > 
> > Now, whether it’s an issue, I don’t know.
> > 
> > Maybe we can close?
> 
> I propose to close since I do not see what could the next action.
> 
> 1: <http://issues.guix.gnu.org/issue/30619>

The next action would be splitting of the bundle generation from the
profile code, and adding a ‘certificates’ field defaulting to nss-
certs, as Ludo seemed to suggest.

This could be useful if the server the channel repositories are on use
self-signed certificates (are git repositories of channels over https
the reason cuirass requires TLS certificates).


Greetings,
Maxime

Message #26 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: zimoun <zimon.toutoune <at> gmail.com>, Ludovic Courtès
 <ludo <at> gnu.org>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Fri, 26 Nov 2021 06:31:06 +0000

Maxime Devos schreef op vr 26-11-2021 om 06:28 [+0000]:
> [...]
> This could be useful if the server the channel repositories are on
> use
> self-signed certificates (are git repositories of channels over https
> the reason cuirass requires TLS certificates).

This was meant to be:

‘This could be useful if the server the channel repositories are on
use self-signed certificates (are git repositories of channels over
https the reason cuirass requires TLS certificates?).’

Message #29 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: zimoun <zimon.toutoune <at> gmail.com>, Ludovic Courtès
 <ludo <at> gnu.org>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619 <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Fri, 26 Nov 2021 06:32:10 +0000

Maxime Devos schreef op vr 26-11-2021 om 06:28 [+0000]:
> This could be useful if the server the channel repositories are on
> use
> self-signed certificates (are git repositories of channels over https
> the reason cuirass requires TLS certificates).

Oops, this argument doesn't have much value, because those certificates
might as well be added to the system profile.

Message #32 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: Maxime Devos <maximedevos <at> telenet.be>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>,
 Ludovic Courtès <ludo <at> gnu.org>, 30619 <at> debbugs.gnu.org,
 Andreas Enge <andreas <at> enge.fr>
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Wed, 05 Jan 2022 00:09:22 +0100

Hi Maxime.

On Fri, 26 Nov 2021 at 06:28, Maxime Devos <maximedevos <at> telenet.be> wrote:
> zimoun schreef op vr 26-11-2021 om 02:38 [+0100]:
>> On Fri, 15 Oct 2021 at 17:20, Ludovic Courtès <ludo <at> gnu.org> wrote:
>> > zimoun <zimon.toutoune <at> gmail.com> skribis:
>> > > On Thu, 16 Sep 2021 at 09:33, zimoun <zimon.toutoune <at> gmail.com>
>> > > > On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès)
>>
>> > The Cuirass Shepherd service still does:
>> >
>> >               #:environment-variables
>> >               (list "GIT_SSL_CAINFO=/etc/ssl/certs/ca-
>> > certificates.crt" …)
>> >
>> > which means that users still need to install certificates globally.
>> >
>> > Now, whether it’s an issue, I don’t know.
>> >
>> > Maybe we can close?
>>
>> I propose to close since I do not see what could the next action.
>>
>> 1: <http://issues.guix.gnu.org/issue/30619>
>
> The next action would be splitting of the bundle generation from the
> profile code, and adding a ‘certificates’ field defaulting to nss-
> certs, as Ludo seemed to suggest.

Do you have an idea how to implement this suggestion?  Otherwise, I
think closing is reasonable. :-)

Cheers,
simon

Message #35 received at 30619 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: zimoun <zimon.toutoune <at> gmail.com>
Cc: Mathieu Othacehe <othacehe <at> gnu.org>,
 Ludovic Courtès <ludo <at> gnu.org>, 30619 <at> debbugs.gnu.org,
 Andreas Enge <andreas <at> enge.fr>
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Wed, 05 Jan 2022 10:53:20 +0100

[Message part 1 (text/plain, inline)]

zimoun schreef op wo 05-01-2022 om 00:09 [+0100]:
> Hi Maxime.
> 
> On Fri, 26 Nov 2021 at 06:28, Maxime Devos <maximedevos <at> telenet.be> wrote:
> > zimoun schreef op vr 26-11-2021 om 02:38 [+0100]:
> > > On Fri, 15 Oct 2021 at 17:20, Ludovic Courtès <ludo <at> gnu.org> wrote:
> > > > zimoun <zimon.toutoune <at> gmail.com> skribis:
> > > > > On Thu, 16 Sep 2021 at 09:33, zimoun <zimon.toutoune <at> gmail.com>
> > > > > > On Tue, 27 Feb 2018 at 17:00, ludo <at> gnu.org (Ludovic Courtès)
> > > 
> > > > The Cuirass Shepherd service still does:
> > > > 
> > > >               #:environment-variables
> > > >               (list "GIT_SSL_CAINFO=/etc/ssl/certs/ca-
> > > > certificates.crt" …)
> > > > 
> > > > which means that users still need to install certificates globally.
> > > > 
> > > > Now, whether it’s an issue, I don’t know.
> > > > 
> > > > Maybe we can close?
> > > 
> > > I propose to close since I do not see what could the next action.
> > > 
> > > 1: <http://issues.guix.gnu.org/issue/30619>
> > 
> > The next action would be splitting of the bundle generation from the
> > profile code, and adding a ‘certificates’ field defaulting to nss-
> > certs, as Ludo seemed to suggest.
> 
> Do you have an idea how to implement this suggestion?  Otherwise, I
> think closing is reasonable. :-)

That suggestion (+ Ludovic's suggestion of a
(guix x509-certificates) module) was my suggested implementation, it
just needs to be translated from a description in English to an actual
patch .

Anyway, I don't think closing is reasonable, because the bug
(certificates need to be installed globally) still exist, and it
is actionable (there's even a suggested implementation,
so a sufficiently motivated party (not me currently) could address the
issue.

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Message #40 received at 30619-done <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: zimoun <zimon.toutoune <at> gmail.com>, control <at> debbugs.gnu.org
Cc: Mathieu Othacehe <othacehe <at> gnu.org>, Andreas Enge <andreas <at> enge.fr>,
 30619-done <at> debbugs.gnu.org
Subject: Re: bug#30619: Cuirass requires TLS certificates
Date: Fri, 21 Jan 2022 11:44:10 +0100

[Message part 1 (text/plain, inline)]

bugs 30619 + donewontfix
thanks

> [various discussion]

While I believe a 'certificates' field or the like would be nice,
there does not appear to be a need or interest, hence closing.

If someone would like to implement some solution or has a need,
they can reopen the bug (see
<https://debbugs.gnu.org/server-control.html>).

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.