GNU logs - #75902, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#75902: guile-gnutls does not set up search paths for the certificates
Resent-From: Tomas Volf <~@wolfsden.cz>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Mon, 27 Jan 2025 22:05:02 +0000
Resent-Message-ID: <handler.75902.B.173801547422040 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 75902 <at> debbugs.gnu.org
From: Tomas Volf <~@wolfsden.cz>
Date: Mon, 27 Jan 2025 23:04:17 +0100
Message-ID: <87ikpzhq1q.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
Received-SPF: pass client-ip=37.205.8.62; envelope-from=~@wolfsden.cz;
 helo=wolfsden.cz
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001,
 SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
 T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 1.0 (+)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.0 (/)

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable


When trying to use (web client) Guile module, one gets the following
error:

=2D-8<---------------cut here---------------start------------->8---
$ guix shell -CN guile guile-gnutls nss-certs -- guile -c '((@ (web client)=
 http-get) "https://gnu.org")'
Backtrace:
In ice-9/boot-9.scm:
  1752:10  7 (with-exception-handler _ _ #:unwind? _ # _)
In unknown file:
           6 (apply-smob/0 #<thunk 7f625f6c1300>)
In ice-9/boot-9.scm:
    724:2  5 (call-with-prompt _ _ #<procedure default-prompt-handle?>)
In ice-9/eval.scm:
    619:8  4 (_ #(#(#<directory (guile-user) 7f625f6c4c80>)))
In ice-9/command-line.scm:
   185:19  3 (_ #<input: string 7f625f6be850>)
In unknown file:
           2 (eval ((@ (web client) http-get) "https://gnu.org") #<d?>)
In web/client.scm:
    576:0  1 (http-get "https://gnu.org" #:body _ # _ #:port _ # #<?> ?)
    286:6  0 (tls-wrap #<closed: file 7f6256da2c40> _ # _)

web/client.scm:286:6: In procedure tls-wrap:
X.509 certificate of 'gnu.org' could not be verified:
  signer-not-found invalid

=2D-8<---------------cut here---------------end--------------->8---

It seems that guile-gnutls fails to find the certificates, which is
unexpected.  Adding `curl' into the list of packages works around the
problem:

=2D-8<---------------cut here---------------start------------->8---
$ guix shell -CN guile guile-gnutls nss-certs curl -- guile -c '((@ (web cl=
ient) http-get) "https://gnu.org")'
=2D-8<---------------cut here---------------end--------------->8---

We can see the difference boils down to different search paths:

=2D-8<---------------cut here---------------start------------->8---
$ guix shell -CN guile guile-gnutls nss-certs --search-paths
export PATH=3D"/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m2mcbyz-profile/bin${PAT=
H:+:}$PATH"
export GUILE_LOAD_PATH=3D"/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m2mcbyz-profi=
le/share/guile/site/3.0${GUILE_LOAD_PATH:+:}$GUILE_LOAD_PATH"
export GUILE_LOAD_COMPILED_PATH=3D"/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m2mc=
byz-profile/lib/guile/3.0/site-ccache:/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m=
2mcbyz-profile/share/guile/site/3.0${GUILE_LOAD_COMPILED_PATH:+:}$GUILE_LOA=
D_COMPILED_PATH"
=2D-8<---------------cut here---------------end--------------->8---

and

=2D-8<---------------cut here---------------start------------->8---
$ guix shell -CN guile guile-gnutls nss-certs curl --search-paths
export PATH=3D"/gnu/store/6zbi90idpfww3y4k7bcnm38lwilnxiql-profile/bin${PAT=
H:+:}$PATH"
export SSL_CERT_DIR=3D"/gnu/store/6zbi90idpfww3y4k7bcnm38lwilnxiql-profile/=
etc/ssl/certs"
export SSL_CERT_FILE=3D"/gnu/store/6zbi90idpfww3y4k7bcnm38lwilnxiql-profile=
/etc/ssl/certs/ca-certificates.crt"
export CURL_CA_BUNDLE=3D"/gnu/store/6zbi90idpfww3y4k7bcnm38lwilnxiql-profil=
e/etc/ssl/certs/ca-certificates.crt"
export GUILE_LOAD_PATH=3D"/gnu/store/6zbi90idpfww3y4k7bcnm38lwilnxiql-profi=
le/share/guile/site/3.0${GUILE_LOAD_PATH:+:}$GUILE_LOAD_PATH"
export GUILE_LOAD_COMPILED_PATH=3D"/gnu/store/6zbi90idpfww3y4k7bcnm38lwilnx=
iql-profile/lib/guile/3.0/site-ccache:/gnu/store/6zbi90idpfww3y4k7bcnm38lwi=
lnxiql-profile/share/guile/site/3.0${GUILE_LOAD_COMPILED_PATH:+:}$GUILE_LOA=
D_COMPILED_PATH"
=2D-8<---------------cut here---------------end--------------->8---

I think guile-gnutls should also declare the SSL_* variables, since it
needs the certificates for vast majority of things one could want to do
with it..

Have a nice day,
Tomas

=2D-=20
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJCBAEBCgAsFiEEt4NJs4wUfTYpiGikL7/ufbZ/wakFAmeYAuEOHH5Ad29sZnNk
ZW4uY3oACgkQL7/ufbZ/walKnhAAgMHr0fRFxh6x4Ghh5q0ts2XClSI7m4yfdz4S
q7hicMaz6fKlS9PJMYTrTOlskAn48NvfLV7dGoCLrMIZrqPZRc8+BvnsvoJJgoU6
BAK6+F0zBPFSEpu60tm1AKQp6ZMGJ9gGWPgOAVwt3a9A6ZciiAcY+sgq8WLRd6bU
LegyE0ePZFXq6WAACMDijO5NBf45V4FSIlA6bWWkFkYI7KalsjJlCC8DYvOC+D9+
x1BlMVPQ7hnCVj5DW3bqA1FpT6BXYO6GTs9U0njaKCYtbD7jPQO8vmH21u38qcoe
6c0nqXBTR6EoyBRXv0pquKXz6nXr30Obi3TAecw1jSuODoRhWto8Rb6HQVmPN8VV
Bp6Sieyunl/RnF2NEIu2FUmSc6qrpwm4qGSGC0GECVaONH346ZBQWR9+q4tUNn2M
W0DA9MUT+XxnAICREZW8llYI9q4QK4qs5pNEzt1QpicxJIqchcyY9mjwMX7JCyQj
2eJiRnqvXRkgs/LdDJh2wHMdJlBgqK56iKKDAgCxErgCvH4aTyBttLC/0AGtmRYY
EzEV4Imillt4uSoSwLyPWMOcTzVpSr2NxkpnTHMJk6aJlpfIYlVVSy2L0SKUWK+0
ATFbSqlXYQF0/p0aUY0yw4PBzAIypE8Pwf5VMVuPzmMnVIvPVZF8UvZ81XiZbwFC
SdRI8js=
=hLQN
-----END PGP SIGNATURE-----
--=-=-=--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Tomas Volf <~@wolfsden.cz>
Subject: bug#75902: Acknowledgement (guile-gnutls does not set up search
 paths for the certificates)
Message-ID: <handler.75902.B.173801547422040.ack <at> debbugs.gnu.org>
References: <87ikpzhq1q.fsf@HIDDEN>
X-Gnu-PR-Message: ack 75902
X-Gnu-PR-Package: guix
Reply-To: 75902 <at> debbugs.gnu.org
Date: Mon, 27 Jan 2025 22:05:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 75902 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
75902: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D75902
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#75902: guile-gnutls does not set up search paths for the certificates
Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Sat, 15 Feb 2025 21:07:02 +0000
Resent-Message-ID: <handler.75902.B75902.173965357029630 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Tomas Volf <~@wolfsden.cz>
Cc: 75902 <at> debbugs.gnu.org
From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
In-Reply-To: <87ikpzhq1q.fsf@HIDDEN> (Tomas Volf's message of "Mon, 27
 Jan 2025 23:04:17 +0100")
References: <87ikpzhq1q.fsf@HIDDEN>
Date: Sat, 15 Feb 2025 22:05:55 +0100
Message-ID: <87bjv2x6j0.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi,

Tomas Volf <~@wolfsden.cz> skribis:

> We can see the difference boils down to different search paths:
>
> $ guix shell -CN guile guile-gnutls nss-certs --search-paths
> export PATH=3D"/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m2mcbyz-profile/bin${P=
ATH:+:}$PATH"
> export GUILE_LOAD_PATH=3D"/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m2mcbyz-pro=
file/share/guile/site/3.0${GUILE_LOAD_PATH:+:}$GUILE_LOAD_PATH"
> export GUILE_LOAD_COMPILED_PATH=3D"/gnu/store/gg2qybb41rpcl0fs4ay98s2q3m2=
mcbyz-profile/lib/guile/3.0/site-ccache:/gnu/store/gg2qybb41rpcl0fs4ay98s2q=
3m2mcbyz-profile/share/guile/site/3.0${GUILE_LOAD_COMPILED_PATH:+:}$GUILE_L=
OAD_COMPILED_PATH"

GnuTLS (and thus Guile-GnuTLS) does not honor an environment variable.
Instead it=E2=80=99s up to applications to set up their certificate search =
path.

See for example the discussion at <https://issues.guix.gnu.org/46779>.

Thanks,
Ludo=E2=80=99.

Last modified: Sat, 15 Feb 2025 21:15:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.