Subject: Re: [bug#75026] [PATCH core-updates 1/7] gnu: gnutls: Update to 3.8.8.
From: Maxim Cournoyer <[email-masked]>
To: Ludovic Courtès <[email-masked]>
Cc: [email-masked]
Date: Wed, 21 May 2025 16:33:35 +0900
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Ludovic,

Ludovic Courtès <[email-masked]> writes:

[...]

>> +           #~(list (string-append
>> +                    "XFAIL_TESTS="
>> +                    ;; This test checks that the default trust store is
>> +                    ;; readable; expect it to fail since the trust store
>> +                    ;; doesn't exist in the build environment.
>> +                    "trust-store "
>
> This suggests that the patch above was still useful, after all?  (The
> patch still applies apparently:
> <https://ci.guix.gnu.org/build/6753571/log>.)

There was an issue where the certificates added were not trusted by
p11-kit, despite being added to something called the 'trust_paths',
haha!  The trick was to expose them via an 'anchors/' subdirectory.
p11-kit special-case this for trusted .pem certificates made available
via a directory.

> Also, lack of the patch might trigger failures in the test suites of
> dependents.  What does ‘guix build -P1 gnutls’ say?
>
>> +                    ;; This one fails only inside the build environment, for
>> +                    ;; reasons unknown (see:
>> +                    ;; <https://gitlab.com/gnutls/gnutls/-/issues/1634>).
>> +                    "tls13/compress-cert-neg2 "))
>
> This is weird, would be interesting to investigate, maybe stracing the
> test to see why it would fail in the build environment and not outside
> of it?

That's been resolved via the '--with-zlib=link configuration flag.

I'll close this series and submit a fresh one, since the curl updates
has been moved to another series.

-- 
Thanks,
Maxim