Subject: bug#28170: closed (Re: [bug#28170] Add gnutls/dane + use it where its needed (gnurl, libmicrohttpd, gnunet))

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 01 Oct 2017 09:53:02 +0000

Your bug report

#28170: Add gnutls/dane + use it where its needed (gnurl, libmicrohttpd, gnunet)

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
28170: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=28170
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#28170] Add gnutls/dane + use it where its needed (gnurl, libmicrohttpd, gnunet)
From: Christopher Baines <[email-masked]>
To: ng0 <[email-masked]>
Cc: [email-masked]
Date: Sun, 1 Oct 2017 10:52:39 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

On Sat, 30 Sep 2017 16:36:05 +0000
ng0 <[email-masked]> wrote:

> Christopher Baines transcribed 3.6K bytes:
> > On Sat, 30 Sep 2017 15:01:52 +0000
> > ng0 <[email-masked]> wrote:
> >   
> > > ng0 transcribed 2.1K bytes:  
> > > > Christopher Baines transcribed 1.7K bytes:    
> > > > > On Sat, 30 Sep 2017 14:12:55 +0000
> > > > > ng0 <[email-masked]> wrote:
> > > > >     
> > > > > > The fix in this version is to only add the necessary input
> > > > > > to the inherited gnutls.    
> > > > > 
> > > > > Ok. One hopefully final thing. From the commit message [1],
> > > > > it's not clear to me if this is fixing an issue with the
> > > > > GNUnet package, by providing it with the right dependencies,
> > > > > or, adding additional functionality to the GNUnet package, by
> > > > > providing a more capable GnuTLS?
> > > > > 
> > > > > 1: "GNUnet and its dependency chain needs GnuTLS with DANE
> > > > > support."   
> > > > It provides the right GnuTLS to GNUnet, libmicrohttpd and gnURL.
> > > > Certain features of these applications will not work without it.
> > > > GnuTLS without Dane is not fatal error for these packages, but
> > > > Dane is recommended.
> > > > I have no idea how I should put this into the very strict
> > > > dictionary we have in commit messages… In more free-form it
> > > > would be no problem for me.
> > > > -- 
> > > > ng0
> > > > GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
> > > > GnuPG: https://krosos.org/dist/keys/
> > > > https://www.infotropique.org https://krosos.org    
> > > 
> > > Okay, I now see what you mean.
> > > 
> > > To make it short: the correct dependency is provided in place
> > > of the current working-but-not-correct GnuTLS.
> > > 
> > > Is that more clear?  
> > 
> > I think you've made it clear to me now.
> > 
> > From what you're saying, I think its the 2nd thing I said. Making
> > this change will enable some functionality in the GNUnet package
> > (and possibly some of the other packages changed).
> > 
> > I'm not sure using the word "correct" helps, unless you say what the
> > dependencies are correct/incorrect with respect to, for example, if
> > the GNUnet documentation says that it should be built with GnuTLS
> > with Dane support, then that would be a reason to talk about
> > correctness.  
> 
> Yes it does state this, in the documentation and all these
> applications list the dependency in README aswell.
> This is why I thought the original, first version, comment I made in
> gnutls/dane was enough. But I'll have to be more clear then.
> Well if gnURL doesn't state it in its README I have to add it, if it's
> not in there it's my mistake - it's correct nevertheless.
> 
> > As for the commit format. As I understand the conventions, you can
> > put anything in between the first line, and the changelog at the
> > bottom. For example, one case where I ended up writing quite a bit
> > is here [1].
> > 
> > It doesn't have to be very specific, but something about the intent
> > or intended effect of the change in each commit would be very
> > useful.
> > 
> > 1:
> > http://git.savannah.gnu.org/cgit/guix.git/commit/?id=6230e155afd8c43c12ee3f03032aac34433db11a  
> 
> Okay, thanks. I will change the commit messages and
> reference our (GNUnet) README and documentation sections.

I've now merged the patches that were attached to this email :)

Thanks,

Chris

Subject: Add gnutls/dane + use it where its needed (gnurl, libmicrohttpd, gnunet)
From: ng0 <[email-masked]>
To: [email-masked]
Date: Mon, 21 Aug 2017 09:57:26 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

The dependency chain of GNUnet demands GnuTLS with DANE support.
You can use it without DANE, but there are certain parts which
will not work. DANE is recommended. (ports of FREEBSD uses
gnutls-dane for libmicrohttpd aswell for example).

The attached patches:
- Add 'gnutls/dane'
- Use it in
  - libmicrohttpd
  - gnurl
  - gnunet
-- 
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://n0is.noblogs.org/my-keys
https://www.infotropique.org https://krosos.org
From c9dedfd1a6f91d557006b00505a428be84102b1e Mon Sep 17 00:00:00 2001
From: ng0 <[email-masked]>
Date: Mon, 21 Aug 2017 09:28:51 +0000
Subject: [PATCH 1/4] gnu: gnutls: Add 'gnutls-dane'.

* gnu/packages/tls.scm (gnutls/dane): New variable.
---
 gnu/packages/tls.scm | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 88c71a908..43c37690d 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -6,7 +6,7 @@
 ;;; Copyright © 2015 David Thompson <[email-masked]>
 ;;; Copyright © 2015, 2016, 2017 Leo Famulari <[email-masked]>
 ;;; Copyright © 2016, 2017 Efraim Flashner <[email-masked]>
-;;; Copyright © 2016, 2017 ng0 <[email-masked]>
+;;; Copyright © 2016, 2017 ng0 <[email-masked]>
 ;;; Copyright © 2016 Hartmut Goebel <[email-masked]>
 ;;; Copyright © 2017 Marius Bakke <[email-masked]>
 ;;;
@@ -36,6 +36,7 @@
   #:use-module (guix build-system cmake)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages)
+  #:use-module (gnu packages dns)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages libbsd)
   #:use-module (gnu packages libffi)
@@ -253,6 +254,17 @@ required structures.")
     (inputs `(("guile" ,guile-2.2)
               ,@(alist-delete "guile" (package-inputs gnutls))))))
 
+(define-public gnutls/dane
+  ;; GnuTLS with build libgnutls-dane, implementing DNS-based
+  ;; Authentication of Named Entities. This is required for GNS functionality
+  ;; by GNUnet and gnURL.
+  (package
+    (inherit gnutls)
+    (source (package-source gnutls-3.5.13))
+    (name "gnutls-dane")
+    (inputs `(("unbound" ,unbound)
+              ,@(package-inputs gnutls)))))
+
 (define-public openssl
   (package
    (name "openssl")
-- 
2.14.1

From 54bde59405ccae78aa48f9cdd325b3280178408e Mon Sep 17 00:00:00 2001
From: ng0 <[email-masked]>
Date: Mon, 21 Aug 2017 09:38:55 +0000
Subject: [PATCH 2/4] gnu: gnurl: Use 'gnutls/dane' as input.

GNUnet and its dependency chain needs GnuTLS with DANE support.

* gnu/packages/gnunet.scm (gnurl)[inputs]: Replace gnutls with 'gnutls/dane'.
---
 gnu/packages/gnunet.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/gnunet.scm b/gnu/packages/gnunet.scm
index 7ff1a3f6f..93aab2894 100644
--- a/gnu/packages/gnunet.scm
+++ b/gnu/packages/gnunet.scm
@@ -197,7 +197,7 @@ and support for SSL3 and TLS.")
    (build-system gnu-build-system)
    (outputs '("out"
               "doc"))                             ; 1.5 MiB of man3 pages
-   (inputs `(("gnutls" ,gnutls)
+   (inputs `(("gnutls" ,gnutls/dane)
              ("libidn" ,libidn)
              ("zlib" ,zlib)))
    (native-inputs
-- 
2.14.1

From 6bdd32e899d955cb14980cf98a645204247528c4 Mon Sep 17 00:00:00 2001
From: ng0 <[email-masked]>
Date: Mon, 21 Aug 2017 09:45:54 +0000
Subject: [PATCH 3/4] gnu: libmicrohttpd: Use 'gnutls/dane' as input.

GNUnet and its dependency chain needs GnuTLS with DANE support.

* gnu/packages/gnunet.scm (libmicrohttpd)[inputs]: Replace gnutls with 'gnutls/dane'.
---
 gnu/packages/gnunet.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/gnunet.scm b/gnu/packages/gnunet.scm
index 93aab2894..5d8d72fbb 100644
--- a/gnu/packages/gnunet.scm
+++ b/gnu/packages/gnunet.scm
@@ -155,7 +155,7 @@ tool to extract metadata from a file and print the results.")
    (build-system gnu-build-system)
    (inputs
     `(("curl" ,curl)
-      ("gnutls" ,gnutls)
+      ("gnutls" ,gnutls/dane)
       ("libgcrypt" ,libgcrypt)
       ("openssl" ,openssl)
       ("zlib" ,zlib)))
-- 
2.14.1

From 78ec8c48d225bddb51078b9ec57d6ff432598f53 Mon Sep 17 00:00:00 2001
From: ng0 <[email-masked]>
Date: Mon, 21 Aug 2017 09:48:32 +0000
Subject: [PATCH 4/4] gnu: gnunet: Use 'gnutls/dane' as input.

GNUnet and its dependency chain needs GnuTLS with DANE support.

* gnu/packages/gnunet.scm (gnunet)[inputs]: Replace gnutls with 'gnutls/dane'.
---
 gnu/packages/gnunet.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/gnunet.scm b/gnu/packages/gnunet.scm
index 5d8d72fbb..83b0ba613 100644
--- a/gnu/packages/gnunet.scm
+++ b/gnu/packages/gnunet.scm
@@ -277,7 +277,7 @@ supports HTTP, HTTPS and GnuTLS.")
       ("gnurl" ,gnurl)
       ("gstreamer" ,gstreamer)
       ("gst-plugins-base" ,gst-plugins-base)
-      ("gnutls" ,gnutls)
+      ("gnutls" ,gnutls/dane)
       ("libextractor" ,libextractor)
       ("libgcrypt" ,libgcrypt)
       ("libidn" ,libidn)
-- 
2.14.1