ludo@gnu.org (Ludovic Courtès) writes:

> Hello,
>
> Marius Bakke <mbakke@fastmail.com> skribis:
>
>> Kei Kebreau <kkebreau@posteo.net> writes:
>
> [...]
>
>>> Here's the search path patch. With this, I needed both nss-certs and
>>> cURL installed alongside Octave to get certificates working.
>
> This is expected (see <https://issues.guix.info/issue/22138>), which is
> why I wrote it wouldn’t quite solve the issue; still, it’s a step in the
> right direction.  :-)
>
>>> diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
>>> index 6d45dc0cc..8bdba8655 100644
>>> --- a/gnu/packages/curl.scm
>>> +++ b/gnu/packages/curl.scm
>>> @@ -83,7 +83,10 @@
>>>             (variable "CURL_CA_BUNDLE")
>>>             (file-type 'regular)
>>>             (separator #f)                         ;single entry
>>> -           (files '("etc/ssl/certs/ca-certificates.crt")))))
>>> +           (files '("etc/ssl/certs/ca-certificates.crt")))
>>> +          (search-path-specification
>>> +           (variable "CURLOPT_CAPATH")
>>> +           (files '("etc/ssl/certs")))))
>>
>> Adding this native-search-path to the "octave" package should be
>> sufficient.
>
> I think we should avoid doing this though, because conceptually
> CURLOPT_CAPATH “belongs” to cURL, not to Octave.

Conceptually maybe, but to my knowledge libcurl itself does not support
run-time search paths (due to thread safety concerns IIRC).

This search path does seem to be Octave specific.  From the ChangeLog:

--8<---------------cut here---------------start------------->8---
2018-04-18  John W. Eaton  <jwe@octave.org>

        allow users to set path to CA certificates for cURL

        * url-transfer.cc (curl_transfer::curl_transfer): Check for
        CURLOPT_CAINFO and CURLOPT_CAPATH environment variables.  If set, use
        them to set the corresponding options for the cURL library.

        Files: liboctave/util/url-transfer.cc
--8<---------------cut here---------------end--------------->8---