GNU bug report logs - #36817
Guix Download Fails When SSL_CERT_DIR is a Colon-Separated Path

Previous Next

Full log

Message #10 received at 36817-done <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: Katherine Cox-Buday <cox.katherine.e <at> gmail.com>, 36817-done <at> debbugs.gnu.org
Subject: Re: bug#36817: Guix Download Fails When SSL_CERT_DIR is a
 Colon-Separated Path
Date: Sun, 10 Nov 2019 02:11:53 +0100

[Message part 1 (text/plain, inline)]

Katherine,

(...sorry for the sloooooow response...)

Katherine Cox-Buday <cox.katherine.e <at> gmail.com> writes:

> I was receiving X.509 certificate errors when attempting to run `guix
> download`. After investigating, I found that it was because my
> `SSL_CERT_DIR` environmental variable had two paths separated by a
> colon. The two paths were actually the same. After removing the second
> path, `guix download` began working again.
>
> Wondering how the duplicate paths came to be, I discovered that
> `${GUIX_PROFILE}/etc/profile` had two exports defined for
> `SSL_CERT_DIR`. I discovered this was because I had both openssl and
> libressl installed (if memory serves, I needed openssl for some
> development task that relied on an idiosyncrasy of openssl). Removing
> openssl removed the duplicate entry.

The duplicate exports was because the search path specifications of
OpenSSL and LibreSSL have slightly different "signatures": the former
has a "singly entry" search path, whereas LibreSSLs native-search-paths
have a TODO comment suggesting that they too should be single-entry.

I've fixed it by resolving the TODO: now including both packages in the
same profile will point SSL_CERT_DIR to the profile union.

> I think there may be two bugs:
>
> 1. `guix download` needs to respect colon-separated paths.

Adding support for multiple SSL_CERT_DIR paths could be useful, but I
think the real problem was that LibreSSL and OpenSSL caused inconsistent
entries.  Thus, I'm closing this issue, but feel free to reopen if you
disagree.  :-)

> 2. The profile mechanics in Guix should probably have some way to check
>    if they're redefining the same thing before placing things in `etc/profile`.

Let's open a separate bug report for this if it turns out to be a
recurring problem.

> Thank you to everyone for all of your hard work, and for Guix.

Thank you for the report, and the kind words!  :-)

Fixed in 04cfe91efd41a89d7d01d2cd7b736213059dde5a.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.