SSL_CERT_DIR is not always unary

  • Open
  • quality assurance status badge
Details
2 participants
  • David Arroyo
  • Tobias Geerinckx-Rice
Owner
unassigned
Submitted by
David Arroyo
Severity
normal
Merged with
D
D
David Arroyo wrote on 22 Feb 2022 05:47
(address . bug-guix@gnu.org)
2556bad4-8f11-4245-9cd0-15fdbe803ac2@www.fastmail.com
The guix shell profile, at least on non-guix SD systems, contains the line

export SSL_CERT_DIR="${GUIX_PROFILE:-/gnu/store/xxxx-profile}/etc/ssl/certs${SSL_CERT_DIR:+:}$SSL_CERT_DIR"

Since it prepends to the SSL_CERT_DIR variable, if a silly user were to accidentally source this file twice, say, to pick up changes they've made to a file that sources this file, the variable will contain duplicate paths.

However, several locations in the guix source assume SSL_CERT_DIR is a single directory. As an example, I ran into this issue when attempting to use `guix import opam -r faraday`:

Starting download of /tmp/guix-file.XFPss4
X.509 certificate of 'github.com' could not be verified:
signer-not-found
invalid

Running the command with `strace -f` showed that guix was attempting to open $SSL_CERT_DIR, rather than the first colon-delimited item in $SSL_CERT_DIR.

It might be better to clobber this variable in the guix shell profile, rather than render it unusable for some subcommands. If not that, then we should remove the assumption that it contains a single path element.
T
T
Tobias Geerinckx-Rice wrote on 22 Feb 2022 18:14
(address . control@debbugs.gnu.org)
DCBC384E-302B-4B3C-8E8B-F8C93AB067FB@tobias.gr
merge 54101 54102

Kind regards,

T G-R

Sent on the go. Excuse or enjoy my brevity.
?
Your comment

Commenting via the web interface is currently disabled.

To comment on this conversation send an email to 54101@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 54101
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch