Kei Kebreau <kkebreau@posteo.net> writes:

> Kei Kebreau <kkebreau@posteo.net> writes:
>
>> Marius Bakke <mbakke@fastmail.com> writes:
>>
>>> Kei Kebreau <kkebreau@posteo.net> writes:
>>>
>>>> * gnu/packages/maths.scm (octave)[arguments]: Add 'wrap-program' phase to wrap
>>>> Octave with the path to system CA certificates.
>>>> ---
>>>>  gnu/packages/maths.scm | 8 +++++++-
>>>>  1 file changed, 7 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
>>>> index 3d571e8cc..b0caff0f5 100644
>>>> --- a/gnu/packages/maths.scm
>>>> +++ b/gnu/packages/maths.scm
>>>> @@ -1417,7 +1417,13 @@ can solve two kinds of problems:
>>>>                  (string-append "Vmakeinfo_program = \""
>>>>                                 (assoc-ref inputs "texinfo")
>>>>                                 "/bin/makeinfo\"")))
>>>> -             #t)))))
>>>> +             #t))
>>>> +         (add-after 'install 'wrap-program
>>>> +           (lambda* (#:key outputs #:allow-other-keys)
>>>> +             (let ((out (assoc-ref outputs "out")))
>>>> +               (wrap-program (string-append out "/bin/octave")
>>>> +                 '("CURLOPT_CAPATH" suffix ("/etc/ssl/certs")))
>>>> +               #t))))))
>>>
>>> Instead of wrapping you can add a native-search-path for CURLOPT_CAPATH
>>> (as with CURL_CA_BUNDLE for `curl`).  That way installing certificates
>>> to the profile should be sufficient.
>>
>> Ah! Yes, this works when I add curl to the profile. I didn't do this the
>> first time. I'll upload a patch here soon.
>
> Here's the search path patch. With this, I needed both nss-certs and
> cURL installed alongside Octave to get certificates working.

[...]

> diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
> index 6d45dc0cc..8bdba8655 100644
> --- a/gnu/packages/curl.scm
> +++ b/gnu/packages/curl.scm
> @@ -83,7 +83,10 @@
>             (variable "CURL_CA_BUNDLE")
>             (file-type 'regular)
>             (separator #f)                         ;single entry
> -           (files '("etc/ssl/certs/ca-certificates.crt")))))
> +           (files '("etc/ssl/certs/ca-certificates.crt")))
> +          (search-path-specification
> +           (variable "CURLOPT_CAPATH")
> +           (files '("etc/ssl/certs")))))

Adding this native-search-path to the "octave" package should be
sufficient.  Then you won't need curl in the profile, nor do we need to
rebuild all the things that depend on curl.  Can you try that?

Thanks for fixing this issue :-)