GNU logs - #46779, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#46779: GnuTLS uses the hard-coded /etc/ssl/certs location for TLS certificates
Resent-From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 25 Feb 2021 20:04:01 +0000
Resent-Message-ID: <handler.46779.B.161428339720331 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 46779 <at> debbugs.gnu.org
From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Date: Thu, 25 Feb 2021 15:03:01 -0500
Message-ID: <87im6f9aq2.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain
Received-SPF: pass client-ip=2607:f8b0:4864:20::f34;
 envelope-from=maxim.cournoyer@HIDDEN; helo=mail-qv1-xf34.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)

Hello,

Consider this:

$ guix environment --container --network -E SSL --expose=$SSL_CERT_FILE
--expose=$SSL_CERT_DIR --ad-hoc wget -- wget https://gnu.org

It works on a Guix System, but fails on a foreign distribution, even in
a profile where nss-certs were installed and with the above SSL
environment value properly set.

This is because GnuTLS, which wget uses, looks up the certificates under
the /etc/ssl/certs hard-coded location.  On Guix System, the
SSL_CERT_FILE is set to /etc/ssl/certs/ca-certificates.crt, which
explains why it works there.

We should patch GnuTLS so that it also honors the SSL_* environment
variables documented in the Guix manual.

Maxim

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Subject: bug#46779: Acknowledgement (GnuTLS uses the hard-coded
 /etc/ssl/certs location for TLS certificates)
Message-ID: <handler.46779.B.161428339720331.ack <at> debbugs.gnu.org>
References: <87im6f9aq2.fsf@HIDDEN>
X-Gnu-PR-Message: ack 46779
X-Gnu-PR-Package: guix
Reply-To: 46779 <at> debbugs.gnu.org
Date: Thu, 25 Feb 2021 20:04:01 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 46779 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
46779: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D46779
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#46779: GnuTLS uses the hard-coded /etc/ssl/certs location for TLS certificates
Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Mon, 01 Mar 2021 09:56:02 +0000
Resent-Message-ID: <handler.46779.B46779.161459250417064 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Cc: 46779 <at> debbugs.gnu.org
From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
References: <87im6f9aq2.fsf@HIDDEN>
Date: Mon, 01 Mar 2021 10:54:55 +0100
In-Reply-To: <87im6f9aq2.fsf@HIDDEN> (Maxim Cournoyer's message of "Thu, 25
 Feb 2021 15:03:01 -0500")
Message-ID: <87y2f7td00.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi,

Maxim Cournoyer <maxim.cournoyer@HIDDEN> skribis:

> We should patch GnuTLS so that it also honors the SSL_* environment
> variables documented in the Guix manual.

Note that (1) the SSL_* variables are originally from OpenSSL, and (2)
GnuTLS developers made the conscious decision to not honor any
environment variable, leaving it up to application developers to do
that.

That=E2=80=99s the reason we are in this situation.  See the thread at
<https://lists.gnu.org/archive/html/guix-devel/2014-02/msg00237.html>.

Now, I agree it=E2=80=99s inconvenient for those applications that don=E2=
=80=99t do
anything.  Perhaps we should check if it=E2=80=99s reasonable to report it
upstream when we encounter such issues, or if there=E2=80=99s just too many=
 of
them?

Thanks,
Ludo=E2=80=99.

Last modified: Mon, 1 Mar 2021 10:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.