GNU bug report logs - #32530
[PATCH] gnu: octave: Fix CA certificate use.

Previous Next

Full log

View this message in rfc822 format

From: Marius Bakke <mbakke <at> fastmail.com>
To: Kei Kebreau <kkebreau <at> posteo.net>
Cc: ludo <at> gnu.org, 32530 <at> debbugs.gnu.org
Subject: [bug#32530] [PATCH] gnu: octave: Fix CA certificate use.
Date: Wed, 19 Sep 2018 19:27:28 +0200

[Message part 1 (text/plain, inline)]

Kei Kebreau <kkebreau <at> posteo.net> writes:

> Marius Bakke <mbakke <at> fastmail.com> writes:
>
>> Kei Kebreau <kkebreau <at> posteo.net> writes:
>>
>>> Kei Kebreau <kkebreau <at> posteo.net> writes:
>>>
>>>> Marius Bakke <mbakke <at> fastmail.com> writes:
>>>>
>>>>> Kei Kebreau <kkebreau <at> posteo.net> writes:
>>>>>
>>>>>> * gnu/packages/maths.scm (octave)[arguments]: Add 'wrap-program' phase to wrap
>>>>>> Octave with the path to system CA certificates.
>>>>>> ---
>>>>>>  gnu/packages/maths.scm | 8 +++++++-
>>>>>>  1 file changed, 7 insertions(+), 1 deletion(-)
>>>>>>
>>>>>> diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
>>>>>> index 3d571e8cc..b0caff0f5 100644
>>>>>> --- a/gnu/packages/maths.scm
>>>>>> +++ b/gnu/packages/maths.scm
>>>>>> @@ -1417,7 +1417,13 @@ can solve two kinds of problems:
>>>>>>                  (string-append "Vmakeinfo_program = \""
>>>>>>                                 (assoc-ref inputs "texinfo")
>>>>>>                                 "/bin/makeinfo\"")))
>>>>>> -             #t)))))
>>>>>> +             #t))
>>>>>> +         (add-after 'install 'wrap-program
>>>>>> +           (lambda* (#:key outputs #:allow-other-keys)
>>>>>> +             (let ((out (assoc-ref outputs "out")))
>>>>>> +               (wrap-program (string-append out "/bin/octave")
>>>>>> +                 '("CURLOPT_CAPATH" suffix ("/etc/ssl/certs")))
>>>>>> +               #t))))))
>>>>>
>>>>> Instead of wrapping you can add a native-search-path for CURLOPT_CAPATH
>>>>> (as with CURL_CA_BUNDLE for `curl`).  That way installing certificates
>>>>> to the profile should be sufficient.
>>>>
>>>> Ah! Yes, this works when I add curl to the profile. I didn't do this the
>>>> first time. I'll upload a patch here soon.
>>>
>>> Here's the search path patch. With this, I needed both nss-certs and
>>> cURL installed alongside Octave to get certificates working.
>>
>> [...]
>>
>>> diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
>>> index 6d45dc0cc..8bdba8655 100644
>>> --- a/gnu/packages/curl.scm
>>> +++ b/gnu/packages/curl.scm
>>> @@ -83,7 +83,10 @@
>>>             (variable "CURL_CA_BUNDLE")
>>>             (file-type 'regular)
>>>             (separator #f)                         ;single entry
>>> -           (files '("etc/ssl/certs/ca-certificates.crt")))))
>>> +           (files '("etc/ssl/certs/ca-certificates.crt")))
>>> +          (search-path-specification
>>> +           (variable "CURLOPT_CAPATH")
>>> +           (files '("etc/ssl/certs")))))
>>
>> Adding this native-search-path to the "octave" package should be
>> sufficient.  Then you won't need curl in the profile, nor do we need to
>> rebuild all the things that depend on curl.  Can you try that?
>
> Adding the native-search-path to the "octave" package works!

Excellent!  :-)

[...]

> diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
> index d3e72128c..7389f972b 100644
> --- a/gnu/packages/maths.scm
> +++ b/gnu/packages/maths.scm
> @@ -1397,6 +1397,10 @@ can solve two kinds of problems:
>         ("less" ,less)
>         ("ghostscript" ,ghostscript)
>         ("gnuplot" ,gnuplot)))
> +    (native-search-paths
> +     (list (search-path-specification
> +            (variable "CURLOPT_CAPATH")
> +            (files '("etc/ssl/certs")))))

LGTM.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.