Subject: bug#25975: Use HTTPS in `guix pull`

From: Leo Famulari <[email-masked]>
Date: Sat, 11 Mar 2017 01:42:48 -0500

On Fri, Mar 10, 2017 at 11:33:41AM +0100, Ludovic Courtès wrote:
> > I thought about this a bit yesterday. Only three certificate files are
> > needed for the Let's Encrypt certificate store: the root certificate,
> > the active intermediate, and the backup intermediate.*
> >
> > We know where they can be downloaded from, and we know their SHA256
> > hash, so we could download them directly instead of using a package.
> 
> Maybe a trivial-build-system package to download these 3 files and put
> them in a directory would do.

Here's a patch.
From 6fea91135a625a13d92d6951d150d8dc5eb68dc1 Mon Sep 17 00:00:00 2001
From: Leo Famulari <[email-masked]>
Date: Tue, 28 Feb 2017 20:21:10 -0500
Subject: [PATCH] gnu: Add le-certs.

* gnu/packages/certs.scm (le-certs): New variable.
---
 gnu/packages/certs.scm | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/gnu/packages/certs.scm b/gnu/packages/certs.scm
index 246e5ca14..fb96b6994 100644
--- a/gnu/packages/certs.scm
+++ b/gnu/packages/certs.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2015 Andreas Enge <[email-masked]>
 ;;; Copyright © 2015 Mark H Weaver <[email-masked]>
 ;;; Copyright © 2016 Ludovic Courtès <[email-masked]>
+;;; Copyright © 2017 Leo Famulari <[email-masked]>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -139,3 +140,59 @@
 taken from the NSS package and thus ultimately from the Mozilla project.")
     (home-page "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS")
     (license license:mpl2.0)))
+
+(define-public le-certs
+  (package
+    (name "le-certs")
+    (version "0")
+    (source #f)
+    (build-system trivial-build-system)
+    (arguments
+     '(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((root (assoc-ref %build-inputs "isrgrootx1.pem"))
+               (intermediate (assoc-ref %build-inputs "letsencryptauthorityx3.pem"))
+               (backup (assoc-ref %build-inputs "letsencryptauthorityx4.pem"))
+               (out (string-append (assoc-ref %outputs "out") "/etc/ssl/certs")))
+           (mkdir-p out)
+           (map (lambda (cert)
+                  (copy-file cert (string-append out "/"
+                                                 (strip-store-file-name cert))))
+                (list root intermediate backup))))))
+    (inputs
+     `(; The Let's Encrypt root certificate, "ISRG Root X1".
+       ("isrgrootx1.pem"
+        ,(origin
+           (method url-fetch)
+           (uri "https://letsencrypt.org/certs/isrgrootx1.pem")
+           (sha256
+            (base32
+             "0zhd1ps7sz4w1x52xk3v7ng6d0rcyi7y7rcrplwkmilnq5hzjv1y"))))
+       ;; "Let’s Encrypt Authority X3 ", the active Let's Encrypt intermediate
+       ;; certificate.
+       ("letsencryptauthorityx3.pem"
+        ,(origin
+           (method url-fetch)
+           (uri "https://letsencrypt.org/certs/letsencryptauthorityx3.pem")
+           (sha256
+            (base32
+             "0zbamj6c7zqw1j9mbqygc8k1ykgj6xiisp9svmlif5lkbnyjhnkk"))))
+       ;; "Let’s Encrypt Authority X4", the backup Let's Encrypt intermediate
+       ;; certificate.  This will be used for disaster recovery and will only be
+       ;; used should Let's Encrypt lose the ability to issue with "Let’s
+       ;; Encrypt Authority X3".
+       ("letsencryptauthorityx4.pem"
+        ,(origin
+           (method url-fetch)
+           (uri "https://letsencrypt.org/certs/letsencryptauthorityx4.pem")
+           (sha256
+            (base32
+             "003dc94c8qwj634h0dq743x7hqv9rdcfaisdksprkmi2jd107xq4"))))))
+    (home-page "https://github.com/lfam/le-certs")
+    (synopsis "Let's Encrypt root and intermediate certificates")
+    (description "This package provides a certificate store containing only the
+Let's Encrypt root and intermediate certificates.  It is intended to be used
+within Guix.")
+    (license license:public-domain))) ; XXX what license?
-- 
2.12.0