Patchwork Help acme-client find its certificate store

login
register
mail settings
Submitter Leo Famulari
Date Dec. 13, 2016, 10:15 p.m.
Message ID <20161213221505.GA26365@jasmine>
Download mbox | patch
Permalink /patch/18433/
State New
Headers show

Comments

Leo Famulari - Dec. 13, 2016, 10:15 p.m.
I'm successfully using this package with this change.

I don't know if this is the "right way" to solve this. Your thoughts?
From a732b5ffaae2b80496d9c7fc5f957c69919072e5 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Mon, 12 Dec 2016 21:04:43 -0500
Subject: [PATCH] gnu: acme-client: Provide path to certificates.

* gnu/packages/tls.scm (acme-client)[arguments]: Add 'patch-paths' phase.
---
 gnu/packages/tls.scm | 7 +++++++
 1 file changed, 7 insertions(+)
Leo Famulari - Dec. 14, 2016, 2:19 p.m.
On Tue, Dec 13, 2016 at 05:15:05PM -0500, Leo Famulari wrote:
> I'm successfully using this package with this change.
> 
> I don't know if this is the "right way" to solve this. Your thoughts?

To clarify, here is what happens on Debian Jessie without this change:

$ acme-client -nN example.com
acme-client: tls_config_set_ca_file: failed to open CA file '/etc/ssl/cert.pem': No such file or directory: No such file or directory

And here are the upstream notes on this subject [0]:

"You can also set DEFAULT_CA_FILE for the location of the certificate
file loaded by libtls."

https://github.com/kristapsdz/acme-client-portable/blob/master/README.md#configuration

> +             (let ((pem (string-append (assoc-ref inputs "libressl")
> +                                       "/etc/ssl/cert.pem")))
> +               (substitute* "http.c"
> +                 (("/etc/ssl/cert.pem") pem))

The upstream maintainer recommends setting this value in 'config.h', but
it's only used in 'http.c', so I thought this solution would be a little
easier to read.
Marius Bakke - Dec. 14, 2016, 3:44 p.m.
Leo Famulari <leo@famulari.name> writes:

> On Tue, Dec 13, 2016 at 05:15:05PM -0500, Leo Famulari wrote:
>> I'm successfully using this package with this change.
>> 
>> I don't know if this is the "right way" to solve this. Your thoughts?
>
> To clarify, here is what happens on Debian Jessie without this change:
>
> $ acme-client -nN example.com
> acme-client: tls_config_set_ca_file: failed to open CA file '/etc/ssl/cert.pem': No such file or directory: No such file or directory
>
> And here are the upstream notes on this subject [0]:
>
> "You can also set DEFAULT_CA_FILE for the location of the certificate
> file loaded by libtls."
>
> https://github.com/kristapsdz/acme-client-portable/blob/master/README.md#configuration
>
>> +             (let ((pem (string-append (assoc-ref inputs "libressl")
>> +                                       "/etc/ssl/cert.pem")))
>> +               (substitute* "http.c"
>> +                 (("/etc/ssl/cert.pem") pem))
>
> The upstream maintainer recommends setting this value in 'config.h', but
> it's only used in 'http.c', so I thought this solution would be a little
> easier to read.

LGTM. I did not know libressl maintains their own root trust.

Patch

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index f5ffe42b9..e577421fa 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -717,6 +717,13 @@  number generator")
              (string-append "PREFIX=" (assoc-ref %outputs "out")))
        #:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'patch-paths
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let ((pem (string-append (assoc-ref inputs "libressl")
+                                       "/etc/ssl/cert.pem")))
+               (substitute* "http.c"
+                 (("/etc/ssl/cert.pem") pem))
+               #t)))
          (delete 'configure)))) ; no './configure' script
     (native-inputs
      `(("pkg-config" ,pkg-config)))