diff mbox series

[bug#38873] gnu: curl: Make libcurl respect SSL_CERT_{DIR, FILE}

Message ID 20200102171826.v4j3d35ocx7tvp2j@zdrowyportier.kadziolka.net
State Accepted
Headers show
Series [bug#38873] gnu: curl: Make libcurl respect SSL_CERT_{DIR, FILE} | expand

Checks

Context Check Description
cbaines/applying patch success Successfully applied

Commit Message

Maja Kądziołka Jan. 2, 2020, 5:18 p.m. UTC 
* gnu/packages/curl.scm (curl-7.66.0): Use patch.
* gnu/packages/patches/libcurl-use-ssl-cert-env.patch: New file.

This fixes the SSL errors occuring when trying to use rust:cargo's
download functionality.

As an additional advantage, this will probably allow removing some
package-specific work-arounds that have already been made. I have
found such work-arounds in cmake and kodi, but am not familiar enough
with either to confidently remove them.
---
 gnu/packages/curl.scm                         |  4 +-
 .../patches/libcurl-use-ssl-cert-env.patch    | 61 +++++++++++++++++++
 2 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/libcurl-use-ssl-cert-env.patch

Comments

Maja Kądziołka Jan. 12, 2020, 4:32 p.m. UTC | #1 
For reference: I have submitted this patch to curl itself, it seems that
they find this unnecessary to have upstream:
https://github.com/curl/curl/pull/4809
Marius Bakke Jan. 13, 2020, 10:57 p.m. UTC | #2 
Jakub Kądziołka <kuba@kadziolka.net> writes:

> * gnu/packages/curl.scm (curl-7.66.0): Use patch.
> * gnu/packages/patches/libcurl-use-ssl-cert-env.patch: New file.
>
> This fixes the SSL errors occuring when trying to use rust:cargo's
> download functionality.
>
> As an additional advantage, this will probably allow removing some
> package-specific work-arounds that have already been made. I have
> found such work-arounds in cmake and kodi, but am not familiar enough
> with either to confidently remove them.

Thanks!  We should probably adjust the (native-search-paths ...) field
of cURL to account for these new variables too.  Can you also rebase it
on 'core-updates'?

From reading the upstream discussion, there does not seem to be any
inherent problems with the patch.  So, LGTM.  Are you willing to
maintain it when it inevitably requires porting to newer versions?  :-)
diff mbox series

Patch

diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index aa5d24c401..c5cd88ec2e 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -9,6 +9,7 @@ 
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -153,7 +154,8 @@  tunneling, and so on.")
                                   version ".tar.xz"))
               (sha256
                (base32
-                "1hcqxpibhknhjy56wcxz5vd6m9ggx3ykwp3wp5wx05ih36481d6v"))))))
+                "1hcqxpibhknhjy56wcxz5vd6m9ggx3ykwp3wp5wx05ih36481d6v"))
+              (patches (search-patches "libcurl-use-ssl-cert-env.patch"))))))
 
 (define-public kurly
   (package
diff --git a/gnu/packages/patches/libcurl-use-ssl-cert-env.patch b/gnu/packages/patches/libcurl-use-ssl-cert-env.patch
new file mode 100644
index 0000000000..a68e64adc1
--- /dev/null
+++ b/gnu/packages/patches/libcurl-use-ssl-cert-env.patch
@@ -0,0 +1,61 @@ 
+Make libcurl respect the SSL_CERT_{DIR,FILE} variables by default. The variables
+are fetched during initialization to preserve thread-safety (curl_global_init(3)
+must be called when no other threads exist).
+===================================================================
+--- curl-7.66.0.orig/lib/easy.c	2020-01-02 15:43:11.883921171 +0100
++++ curl-7.66.0/lib/easy.c	2020-01-02 16:18:54.691882797 +0100
+@@ -134,6 +134,9 @@
+ #  pragma warning(default:4232) /* MSVC extension, dllimport identity */
+ #endif
+ 
++char * Curl_ssl_cert_dir = NULL;
++char * Curl_ssl_cert_file = NULL;
++
+ /**
+  * curl_global_init() globally initializes curl given a bitwise set of the
+  * different features of what to initialize.
+@@ -155,6 +158,9 @@
+ #endif
+   }
+ 
++  Curl_ssl_cert_dir = curl_getenv("SSL_CERT_DIR");
++  Curl_ssl_cert_file = curl_getenv("SSL_CERT_FILE");
++
+   if(!Curl_ssl_init()) {
+     DEBUGF(fprintf(stderr, "Error: Curl_ssl_init failed\n"));
+     return CURLE_FAILED_INIT;
+@@ -260,6 +266,9 @@
+   Curl_ssl_cleanup();
+   Curl_resolver_global_cleanup();
+ 
++  free(Curl_ssl_cert_dir);
++  free(Curl_ssl_cert_file);
++
+ #ifdef WIN32
+   Curl_win32_cleanup(init_flags);
+ #endif
+diff -ur curl-7.66.0.orig/lib/url.c curl-7.66.0/lib/url.c
+--- curl-7.66.0.orig/lib/url.c	2020-01-02 15:43:11.883921171 +0100
++++ curl-7.66.0/lib/url.c	2020-01-02 16:21:11.563880346 +0100
+@@ -524,6 +524,21 @@
+     if(result)
+       return result;
+ #endif
++    extern char * Curl_ssl_cert_dir;
++    extern char * Curl_ssl_cert_file;
++    if(Curl_ssl_cert_dir) {
++        if(result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_ORIG], Curl_ssl_cert_dir))
++            return result;
++        if(result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_PROXY], Curl_ssl_cert_dir))
++            return result;
++    }
++
++    if(Curl_ssl_cert_file) {
++        if(result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_ORIG], Curl_ssl_cert_file))
++            return result;
++        if(result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_PROXY], Curl_ssl_cert_file))
++            return result;
++    }
+   }
+ 
+   set->wildcard_enabled = FALSE;