Subject: bug#46779: GnuTLS uses the hard-coded /etc/ssl/certs location for TLS certificates

From: Ludovic Courtès <[email-masked]>
Date: Wed, 20 Nov 2024 11:45:15 +0100

Hello,

Maxim Cournoyer <[email-masked]> skribis:

> I guess we could rename NIX_SSL_CERT_FILE to just SSL_CERT_FILE in the
> above patch and add the $SSL_CERT_FILE search path to bring us closer to
> what OpenSSL supports?

As a rule of thumb, I would avoid diverging from upstream, especially
for touchy points like this one: it quickly gets problematic when a
same-named package behaves differently across distros.

In this case, because GnuTLS does not honor any environment variables,
applications/libraries linked against it have to provide their own
mechanism for users to specify the certificate search path.  Normally,
they already do that.

WDYT?

Ludo’.